SIM Swap Scams: Where Criminals Get the Data to Take Your Number

For a study on the sim swap, four researchers at Princeton University opened 50 prepaid accounts with five US carriers: AT&T, T-Mobile, Verizon, Tracfone and US Mobile. Then they called customer service, posed as the account holders, which in a sense they were, and asked for a new SIM card. When the representative asked a verification question, they gave a wrong answer on purpose. According to the draft of their study, dated January 2020, the switch still went through in 39 of 50 attempts. At the three largest carriers it worked every single time.

The line from that paper this article is really about comes a little later. Nearly all of the questions the carriers used to recognize their customers, the authors wrote, could be answered from public records. That is where a sim swap actually begins, well before anyone dials a carrier. To take your number, a criminal has to pass as you, and to pass as you they need to know things about you. Below is what those things are, where they usually sit in plain view, and how to collect them yourself before someone else does.

What sim swapping actually does

Your phone number does not live in your phone. It lives in a record at your carrier that says which SIM card or eSIM currently belongs to it. Lose your phone, and the carrier issues a new SIM and points the number at it, while the old card goes quiet. Anyone who has replaced a lost phone has been through this.

In sim swapping, a stranger runs that same routine for themselves. The Federal Trade Commission puts it plainly in its consumer guidance. Someone contacts your carrier and says the phone was lost or damaged. Then they get your number activated on a SIM card in their own device. The FBI’s Internet Crime Complaint Center defines it as the use of “unsophisticated social engineering techniques” against carriers to move a victim’s service onto a phone the criminal holds.

On your end, the phone simply stops working. No data, no texts, no calls. From that moment your number rings somewhere else.

The point of all this comes next. Countless services send one-time codes by text, for logins and above all for password resets. In a 2022 public service announcement, the FBI described the usual sequence. First the number, then “Forgot Password,” then the account. Email, bank, brokerage and crypto exchange all tend to trust the same phone number, which makes it a master key that nobody designed as one.

A close cousin is the port out scam. Instead of asking your own carrier for a new SIM, the criminal asks a different carrier to bring your number over to a fresh account. The result looks identical from your side. Your phone goes dead, and your codes go to someone else.

A retail store, a trash folder and $24 million

The best documented case belongs to Michael Terpin, a cryptocurrency investor who had been an AT&T customer since 2011. In June 2017 someone impersonated him and took over his number for the first time, and he lost some crypto. By his account, AT&T then promised him extra security, a six-digit code instead of a four-digit one for account changes.

In 2018 it happened again anyway. This time the attacker, a teenager named Ellis Pinsky, did not have to answer a single question. He bribed an employee at an authorized AT&T retailer, who moved the number onto a SIM controlled by Pinsky and an accomplice. AT&T’s account notes later said the SIM had been replaced “per customer request.” It was not. With Terpin’s number in hand, the two reset passwords and got into his online accounts, including a cloud storage service. In its trash folder sat a document with the keys to his crypto holdings. The loss came to $24 million.

That is how the Ninth Circuit Court of Appeals, a federal appeals court for the western states, laid out the facts in its opinion of September 30, 2024. Terpin had sued AT&T. The court threw out his fraud claims and his demand for punitive damages, but revived a claim under the Federal Communications Act and sent it back to the trial court. A footnote mentions the civil judgments against the attackers: $22 million against Pinsky and $75 million against his accomplice.

To be honest, this case only half fits the topic. The path to the number went through a paid insider, and the opinion says nothing about public records. What was public was the fact that Terpin made a rich target. That is exactly why the FBI advises people not to advertise cryptocurrency holdings on social media or forums. The same PSA also tells carriers to verify calls from third-party retailers asking for customer information, which reads like a direct lesson from cases like this one.

What the carrier wants to hear

Back to the Princeton study, because it is the best public record of what carrier reps actually ask. The researchers listed the challenges they ran into. Personal details came up, namely street address, email address and date of birth. Account details came up too, such as the last four digits of the payment card, the activation date, or the date and amount of the last payment. Some reps asked for a PIN or password or for answers to security questions. In most cases a single correct answer was enough, even after several wrong ones.

Then comes the sentence that matters here. Nearly all of these challenges, the authors wrote, came from public records. A dedicated attacker could plausibly obtain a victim’s date of birth, address, email address or security answers through online profiles. The last four digits of a card are printed on plenty of receipts, and an activation date can sometimes be bought from data brokers.

The study is a few years old and it looked at prepaid accounts, so carriers may ask different questions today. The principle has not aged, though. The FTC warns that an identity thief can use what you post publicly “to answer the security questions required to verify your identity.” That is a short step from what the Princeton team found. And the Federal Communications Commission, the regulator for phone carriers, said in 2023 that data breaches raise the risk by exposing the details that make it easier to steal someone’s cell phone account.

There are two doors, then. One is the call center or the store, where a person checks your details. The other is your online carrier account, and its password may already be sitting in an old breach if you used it anywhere else.

The groundwork: what is already out there about you

This is where OSINT comes in, short for open source intelligence, the practice of drawing conclusions from public sources. You can retrace what an attacker would do, calmly and for yourself only. The table lines up what carriers typically ask with where it often sits in the open.

The first rows are covered step by step in our guide to searching yourself online. What breaches say about you is the subject of our piece on how to check a data breach. If you want to understand how this kind of research works in general, start with what OSINT is, which is also part of our OSINT series.

Do not expect one source that gives everything away. It is usually a puzzle. The birth date shows up in a 2016 birthday post, the number in an old listing for a bike, the email address in a breach. Each piece looks harmless. Put together, they come close to the checklist a carrier rep works through.

How common sim swap scams are

The FBI’s Internet Crime Complaint Center, IC3 for short, collects reports of online crime and lists sim swapping as its own category. Its numbers are the most detailed public figures there are.

Reports have dropped steadily since 2022. The reports do not say whether that reflects better checks at the carriers or cases being filed under other labels, such as cryptocurrency fraud or identity theft. The average loss is worth a look, though. In 2025 it came to almost $18,000 per complaint. In 2024, people aged 60 and over filed 205 of these complaints, with losses of about $6.3 million.

The FCC rules

In November 2023 the FCC unanimously adopted new rules for this exact problem. Carriers must use secure methods to authenticate a customer before moving a number to a new device or a new carrier. They also have to notify customers immediately when someone requests a SIM change or a port-out. Compliance was originally due in July 2024. The FCC later suspended that date and tied it to a further federal review, after which it will announce when the rules take effect.

For you, the practical upshot is simple. Carriers now offer more than they used to. Ask yours what protection it has against SIM changes and port-outs, which is a fair five-minute call.

Warning signs that matter

The first sign is almost always the same. Your phone loses service, and not for a few seconds in an elevator but for good. The FTC describes it as no data, no text messages, no phone calls. An unexpected notice from your carrier may follow, saying your SIM card has been activated on a new device. The FBI’s advice boils down to the same thing: pay attention to any change in your ability to send and receive texts.

Before you panic, rule out the obvious. Restart the phone, and check whether someone else on the same network has a signal where you are standing. If their phone works and yours does not, take it seriously.

Further signs show up in your other accounts. Password change emails you did not trigger, logins from unknown devices, a new email address on your carrier account. One more distinction is worth knowing. A text asking you to tap a link or confirm details because of a supposed SIM problem is itself a scam attempt. What those messages look like is covered in our article on smishing and SMS scams.

How to prevent sim swap attacks

The most important step takes five minutes. Set a PIN or passcode on your mobile account if there is none yet, and pick one that appears nowhere else. The FTC lists this first. A number someone could guess from your birthday, your street address or your dog’s name on Instagram does not count.

Your online carrier account deserves the same care. Whoever gets into it can often change account details, and with some carriers order a replacement SIM or eSIM directly. Give it a password you use nowhere else. If the carrier offers extra login protection, turn it on, ideally with something other than the same phone number. Germany’s federal data protection commissioner warned in 2023 that an eSIM makes stolen carrier account credentials even more useful, because nothing has to be mailed anymore. The point applies to US carriers just as well.

The next step limits the damage if someone gets the number anyway. The FTC notes that text message verification may not stop a SIM card swap, and recommends an authentication app or a security key. The FBI gives the same advice. Start with your email, because that is where nearly every other password gets reset. Then move on to banking, brokerage, cloud storage and anything holding crypto. Where a service supports them, passkeys are the stronger choice, since they are bound to your device and never travel by text.

Check where your number serves as a recovery option, too. Many accounts still allow a reset by text even after you switched your login to an app. That back door stays open as long as the number is listed there.

Then there is the exposure from the table above. The FTC suggests avoiding your full name, address and phone number on public sites, and the FBI adds a warning against posting about crypto holdings. You do not have to disappear for this. Taking the number off profiles and old listings, hiding your birth year and keeping birthday posts out of public view goes a long way. If you want to know how easily your number can be tied back to your name, our guide on looking up who a number belongs to walks through the usual routes.

One last point concerns calls. The FBI advises never to give your account details, password or PIN to someone who calls claiming to be your carrier. Hang up and call the number on your carrier’s official website instead.

If it has already happened

Speed counts. Call your carrier from another phone, using the official number, and have them restore your number and lock the account. Alert your bank and any crypto exchange right after, because money tends to move within hours. Report the crime to the IC3 at ic3.gov and to local police. How to then take back your accounts one by one and make sure nobody is still inside is covered in detail in our piece Am I hacked?.

What remains

A sim swap feels like a technical attack, and at the end there really is a stranger’s SIM card in a stranger’s phone. Before that, though, there is usually legwork. Someone has to know you are worth the trouble, which number you have, who your carrier is and what the rep is going to ask. Or they need a password that ended up in a breach years ago.

That is where you have more leverage than it seems. A PIN with your carrier, a unique password for the carrier account and text codes removed from your most important accounts make the swap harder and far less rewarding. The rest is one quiet hour spent looking yourself up the way a stranger would.

Frequently asked questions

What is a sim swap?

In a sim swap, a criminal convinces your mobile carrier to move your phone number onto a SIM card or eSIM in a device they control. Your own phone loses service, and your calls and text messages go to them. The danger lies in what comes next: many accounts send login and password reset codes by text, so whoever holds the number can often reset passwords and get into email, banking or crypto accounts.

How do I know if I have been sim swapped?

The clearest sign is a phone that suddenly shows no service, no data, no texts and no calls, while other phones in the same place work fine. If you also receive a notice from your carrier about a new SIM card, an eSIM activation or a port-out request that you did not make, treat it as an emergency. Rule out a dead zone, then call your carrier from another phone using the number on its official website.

How to prevent sim swap attacks?

Add a PIN or passcode to your mobile account and use one that appears nowhere else. Give your online carrier account a unique password and turn on extra login protection if it is offered. Move important accounts away from text message codes to an authenticator app, a security key or passkeys, starting with your email. And keep your phone number, birth date and home address off public profiles, because those are the details carriers use to recognize you.

What is a port out scam?

A port out scam is a close relative of the sim swap. Instead of asking your own carrier for a new SIM card, the criminal asks a different carrier to transfer your number over to a new account they control. The effect is the same, your phone goes dead and your number works for someone else. Federal rules adopted in November 2023 require carriers to authenticate customers securely before a port-out and to notify them right away when one is requested.

What should I do if my number was hijacked?

Call your carrier immediately from another phone and ask them to restore your number and lock the account. Then alert your bank and any crypto exchange you use, because stolen funds tend to move within hours. Change the passwords of your most important accounts from a clean device, email first, and report the crime to the FBI Internet Crime Complaint Center at ic3.gov and to local police. Keep every carrier notice and timestamp.