SIM Swap Attacks: How They Work and How to Protect Your Number

This is the rare security topic where the victim does nothing wrong. There is no bad link to click and no password to leak. Your number simply stops working, and by the time you understand why, somebody is reading the one-time codes that guard everything else you own.

We sell phone numbers, which gives us an obvious interest in this topic. It also means we should say plainly that our product does not solve it, and then explain what does.

What actually happens

Your number does not live in the SIM. It lives in your operator's subscriber database, and the SIM is just the credential currently pointing at it. Move the pointer and the number moves with it.

An attacker contacts your carrier posing as you and asks for the number to be moved to a new SIM or eSIM, usually framed as a lost phone or an upgrade. To pass the check they use details about you: date of birth, address, the last digits of a payment card, recent call history. Those come from data breaches, public profiles and social engineering, and they are often easier to collect than people assume. In the worst cases the check is bypassed entirely by paying somebody inside a shop.

Once the transfer completes your handset loses service, because only one SIM can hold the number. Theirs now receives your calls and texts. Then they work through the accounts that use your number for recovery, requesting password resets and reading the codes as they arrive.

Why the number is such a valuable target

Because a whole generation of services decided a phone number was a reasonable proof of identity. Email recovery, bank logins, exchange withdrawals, social accounts and payment apps all fall back to it.

That makes your number a single key to a large number of locks, held by a company whose customer service staff are trained to be helpful to people who have lost their phone. It is a design with an obvious failure mode, and the failure mode is this attack.

The four defences, in order of how much they help

• Take SMS off your important accounts. This is the one that actually ends the threat. An authenticator app generates codes on the device, a passkey or hardware key is better still, and neither can be redirected by moving a number. Start with email, because email is the master key to everything else, then banking and exchanges.
• Set a port freeze or number lock with your carrier. Most major operators offer something like this: a PIN, a port-out block, or a setting that requires in-person identification before a number can move. It is usually buried in account settings and takes a few minutes. Almost nobody turns it on.
• Stop using your number as a public identifier. An attacker needs to know which number belongs to which person to start. Remove it from social profiles, marketplace listings and anywhere it sits next to your real name. A number nobody can link to you is not a target.
• Separate the number from the accounts it protects. If a service insists on SMS, use a line that is not your public, everyday number and is not printed on anything. Separation does not stop the attack, it shrinks the blast radius.

The first point is the whole article, really. Every other measure makes the attack harder, while removing SMS makes it pointless. Our walkthrough of getting verification codes while travelling covers the practical side of that migration.

The warning sign, and what to do in the first ten minutes

The symptom is loss of service with no explanation. No bars, no data, in a place where coverage is normally fine, and a Wi-Fi connection that still works. People assume a network outage and wait. Waiting is the expensive choice.

If it happens unexpectedly, act as though it is an attack until proven otherwise. Call your carrier from another phone and ask whether the number has been transferred. Then, from a device still logged in, change the password on your email account first and remove the phone number as a recovery method. After email, do banking and exchanges. The attacker is working through the same list, and the only thing that matters is who reaches each account first.

Reporting it to the carrier and to your bank matters afterwards, but the first ten minutes are a race, not a support ticket.

• Your number does not live in the SIM. It lives in a database at your operator, and the attack is a conversation with the people who can edit it.

Does an eSIM help?

Not against this, and anyone telling you otherwise is selling something. The attack happens at the carrier account level, so the format of the credential at the end of the chain is irrelevant. A number on an eSIM can be moved by a successful social engineer exactly as a number on plastic can.

There is one narrow thing the format changes: there is no physical card for somebody to remove from a handset they have briefly borrowed. That is a real but much rarer attack than the one this article is about.

Where a second line genuinely helps is structural rather than technical. If the number you hand to strangers, list on marketplaces and use for throwaway signups is not the number your bank texts, then the public one is useless to an attacker and the private one is hard to find. That is separation, not protection, and it is worth having for the same reason you do not print your home address on a classified ad.

→ Curious what your operator can see regardless of any of this? Read what your carrier knows

Where Cypher eSIM stands

Plainly: our product is not a defence against SIM swapping, and we would rather say that than imply otherwise. What we sell is a separate line, which is useful for keeping your everyday number out of public view: a local number from $14.84, a European regional number at $37.38 for 30 days with calls, 200 SMS and 20 GB, and a global number across 66 countries at $56.07, with European plans carrying a French +33 shown on the plan card. No KYC, no account, no email, 180+ countries, paid in USDT on TRC-20, BEP-20, Arbitrum or Solana, plus BTC, ETH, SOL, USDC, DAI, XMR and TON. Our numbers also end with the plan, which makes them wrong for anchoring the accounts this article is about. If you take one action after reading this, make it moving your email off SMS, and that costs nothing and involves us not at all.

FAQ

What is a SIM swap attack?

Someone persuades your mobile operator to move your number onto a SIM they control, usually by impersonating you with personal details gathered from breaches or public sources. Your phone loses service and their device starts receiving your calls and texts, including one-time codes.

How do I know if I have been SIM swapped?

The giveaway is sudden, unexplained loss of mobile service while Wi-Fi still works. If that happens without a known outage, assume the worst, verify with your carrier from another phone, and start securing your email immediately rather than waiting to see if signal returns.

How do I prevent a SIM swap?

Move your important accounts off SMS onto an authenticator app or a passkey, which makes the attack pointless. Then set a port freeze or number lock with your carrier, keep your number off public profiles, and avoid using one number for both public contact and account recovery.

Does using an eSIM protect me from SIM swapping?

No. The attack targets your carrier account rather than the SIM itself, so the credential format makes no difference. The only thing an eSIM removes is the much rarer case of someone physically taking a card out of your phone.

Is a second phone number useful against this?

Indirectly. Keeping a separate line for public listings, marketplaces and throwaway signups means the number attackers can find is not the number your bank uses. That shrinks the target without changing how the attack itself works.