Most crypto security content is about what happens on-chain: malicious approvals, drainer signatures, phishing domains. But a large share of real-world losses start somewhere much more boring — at a mobile carrier’s customer service desk, where an attacker convinces an agent to move your phone number onto their SIM card.

From that moment, your phone number is theirs. And if your email, exchange, or banking accounts still treat SMS as a trusted channel, the takeover cascade starts. This article walks the full chain: how attackers pick targets, how the port actually happens, what they do in the first hour after the swap, real cases with real numbers, and the short list of defenses that actually break the attack.

BLUF: SIM swap is an account-takeover primitive, not an SMS problem. It defeats any account that can be reset or verified through your phone number. The fix is to remove SMS from your trust chain entirely (authenticator app or hardware key for 2FA, carrier port-out PIN), and to structure holdings so that even a total account takeover hits a small number: trading float on exchange, everything else in a hardware wallet.

What a SIM Swap Actually Is

Your phone number is not physically attached to your SIM card. It’s a record at your carrier that says “route calls and texts for +1-555-… to SIM serial X.” A SIM swap (also called a port-out scam when the number moves to a different carrier) is an attack on that record: the attacker convinces your carrier — or pays someone inside it — to repoint your number to a SIM they control.

Three flavors exist, and they all end the same way for you:

  1. Retail social engineering. The attacker calls the carrier, poses as you with leaked personal data (name, address, birth date, last four of SSN, account PIN if they’ve phished it), and “reports a lost phone.” A helpful agent activates a new SIM “for” you.
  2. Insider fraud. Carrier store employees or support contractors are recruited and paid per successful swap. Several US prosecutions have included telco insiders as accomplices.
  3. Port-out. The attacker initiates a transfer of your number to a different prepaid carrier, exploiting lax verification on port requests.

Your phone silently loses service. Theirs starts receiving your texts — including every password reset code and 2FA prompt sent to your number.

Why Crypto Holders Are the Target

An exchange account is a bank account with a market attached. Once an attacker is inside, they don’t need to beat on-chain security at all — they use the exchange’s own withdrawal function to send your balances to their wallet, and the withdrawal looks like any other customer transfer.

That’s the uncomfortable part: no smart contract audit, hardware wallet, or seed phrase hygiene helps if the assets sit in a custodial wallet and the account can be recovered via SMS. The attack specifically selects for people who:

  • Still use SMS 2FA on their exchange or email accounts
  • Publicly associate their identity with crypto (founders, traders with public personas, anyone who has tweeted their holdings or been interviewed about them)
  • Have personal data floating in breach dumps (which is nearly everyone)

Recon is cheap. The data brokers and breach corpora that supply carrier social engineering are the same ones that supply crypto phishing campaigns — often the same crews run both.

The Attack Chain, Step by Step

Step 1: Target selection and data gathering. The attacker assembles enough of your identity to pass carrier verification. Sources: breach databases, social media, your own posts, earlier phishing pages you may have entered data into, and sometimes insiders at the carrier who skip this step entirely.

Step 2: Pre-staging. Before touching your number, the attacker learns which exchanges you use and tries your email. Some password-reset the email first (if it can be recovered via SMS to the same number, one swap covers both); others swap first and reset everything after.

Step 3: The swap. A call to the carrier, a story about a broken phone, maybe a walk-in to a retail store. Your number moves. Your handset shows “No Service.”

Step 4: Account takeover. Password reset flows are the point of the whole exercise. “Forgot password” → SMS code → new password → change the recovery email and phone → disable TOTP if they can. Within minutes they own the account, and you are locked out.

Step 5: The drain. Exchange balances are withdrawn to attacker-controlled addresses. If a withdrawal allowlist with a time lock was enabled, this step gets harder — that’s why allowlists matter (see below). Otherwise, funds leave in batches, then split through hops and sometimes a mixer, following the same laundering pattern as drainer proceeds. From there, victim-side tracing looks identical to any other theft case: evidence, freeze requests, law enforcement — the pipeline described in how stolen crypto is actually recovered.

The on-chain part is almost an afterthought. That’s what makes SIM swap distinct from every other attack in this library: it’s the only major crypto theft vector that starts completely off-chain.

Real Cases, Real Numbers

  • Joel Ortiz (2018–2019). The first widely reported SIM-swap criminal conviction: Ortiz and associates took over roughly 40 phone numbers and stole more than $5 million, much of it in crypto, including about $1.5M in one day from a startup founder who was flying and unreachable during the takeover. He pleaded guilty and received 10 years in a California court in 2019.
  • Michael Terpin v. AT&T (2019). Investor Michael Terpin lost roughly $24 million in crypto after two SIM swaps on his AT&T number in 2017 and 2018; in 2019 a federal jury awarded him $135 million in damages against the carrier. The case put carriers’ port-out verification practices on the public record.
  • “The Community” (DOJ indictment, 2019). The US Department of Justice indicted eight members of a crew that stole millions by SIM-swapping targets and draining exchange accounts, working with accomplices who handled the number ports. Prosecutors described it as a conspiratorial structure: hackers, money movers, and telco-side enablers.

The pattern across cases: young crews, high-value crypto targets, carriers as the weak link, and sentences that finally caught up with the crime. The techniques have not gone away — they’ve industrialized alongside the rest of the scam economy.

The Part Everyone Misses: Your Phone Number Is a Master Key

SMS is not just “one factor among many.” In most account systems, the phone number is also the recovery path — the channel that lets you back in when everything else fails. That means a number takeover can defeat even a strong password plus authenticator app, if the “account recovery” flow is willing to text a reset link.

So the honest framing is:

  • SMS 2FA is worse than nothing for high-value accounts — not because SMS is easy to phish (it is), but because it gives attackers a reset path that bypasses everything else you set up.
  • Email is the other master key. If your email can be recovered via SMS, then SMS compromise → email compromise → every account that sends “we’ve reset your password” emails.

This is why the defense stack below is ordered the way it is. It’s not a checklist of equal items; it’s a dependency chain.

The Defense Stack

1. Remove SMS 2FA from every account that matters. Replace it with an authenticator app (TOTP) or, better, a hardware security key (FIDO2/WebAuthn) for email and exchange logins. Hardware keys are phishing-resistant in a way codes are not — see blind signing and hardware wallet security for how the device-side piece fits.

2. Decouple recovery from your number. In every account’s security settings, check the recovery options: remove the phone number where an email or second key can serve instead. If a service requires a phone number for recovery, treat that service as unsafe for meaningful balances.

3. Lock the port. US carriers offer account-level protections — AT&T’s Extra Security / Number Lock, Verizon’s Number Lock, T-Mobile’s port validation with a separate passcode. Set it today; it costs nothing. It won’t stop an insider fraud, but it defeats the casual call-center attack that makes up the bulk of volume.

4. Enable withdrawal allowlists + delay locks on exchanges. A 24-hour withdrawal-address lock means a fresh takeover can’t move funds immediately, and the delay gives you a window to catch the “new address added” notification (routed to email they don’t control, if you did step 1 right).

5. Structure holdings so a takeover hits a small number. Exchange accounts hold trading float. Everything else lives in self-custody — a hardware wallet, ideally with multi-sig for large amounts. A SIM swap cannot touch self-custodied funds: there is no phone number, no password reset, no customer service desk to social-engineer. This is the structural answer, and it matters more than any carrier setting.

If It Happens: The First 30 Minutes

Your phone dropping to “No Service” with no explanation is the tell. Act on the assumption of an active takeover:

  1. Call your carrier from another phone (their fraud line, not general support) and ask them to suspend the port and freeze the account. Speed here constrains everything downstream.
  2. Secure email first, from a clean device — change the password, revoke active sessions, re-enable 2FA. Email is the recovery path to everything else.
  3. Freeze exchange accounts: change passwords, revoke sessions, disable withdrawals if the platform allows a temporary lock. Use the app over a borrowed device if needed; attackers move within minutes.
  4. Document as you go: timestamps, who you spoke to at the carrier, confirmation numbers. If funds moved, capture transaction hashes and addresses — that becomes the evidence package for tracking stolen crypto and any freeze request to the receiving exchange.
  5. File a police report and IC3 complaint (US) or your local cybercrime unit. SIM swap is a well-understood crime category now; the report also helps with the carrier’s liability process.

One more thing: after any SIM swap, expect follow-on targeting. The same data that enabled the swap enables phishing and “recovery agent” fraud — read the recovery scam anatomy before strangers offer help.

Limitations

  • Carrier protections vary by country. Port-out PINs and number locks are common in the US and uneven elsewhere; the local reality may be weaker than this checklist assumes.
  • Nothing stops a corrupt insider completely. A paid store employee with system access can bypass most customer-side controls. That’s why the structural defense (self-custody) outranks every carrier setting.
  • Operational friction is real. Hardware keys and allowlist delays make trading marginally slower. That trade is correct for long-term holdings and a personal decision for active traders.
  • This is general education, not advice for your specific carrier or platform. Check your carrier’s current protection options directly — the products and their names change.

Frequently Asked Questions

Can a SIM swap steal crypto from a hardware wallet?

No. A hardware wallet signs transactions offline and is controlled by your seed phrase, not your phone number or any account. SIM swap attacks only work against custodial accounts — exchanges, email, banking apps — where a password reset can be routed through SMS. This is the strongest argument for keeping long-term holdings in self-custody and leaving only active trading funds on an exchange.

How do I stop SIM swapping on my phone number?

Three layers: (1) Contact your carrier and set a port-out PIN or enable Number Lock (AT&T, Verizon, and T-Mobile in the US all offer this) so a port request requires the extra credential, (2) remove SMS 2FA from your email and exchange accounts and replace it with an authenticator app or hardware security key, and (3) never use your phone number as an account recovery method where an alternative exists.

What are the first signs that a SIM swap is happening?

The classic sign is sudden loss of cell service — 'No Service' or 'SIM not provisioned' — because your number now lives on the attacker's SIM. If your phone drops off the network without explanation while you still have battery and signal elsewhere, treat it as an active account takeover: call your carrier from another phone immediately, then secure your email and exchange accounts from a device you trust.