SIM swap
Taking over a victim's phone number by persuading or bribing a mobile carrier to move it to a SIM the attacker controls.
A phone number is a master key: it receives password resets and one-time passcodes for email, banking and crypto exchanges. Move the number and you move the keys.
The attack is usually social engineering against the carrier’s retail or support staff, sometimes with an insider. The first sign for a victim is often that their phone abruptly loses service for no reason — which is a moment to act on immediately rather than assume a network fault. Where a carrier offers a port-out PIN or a number-lock setting, turning it on is one of the highest-value security measures available to an ordinary person.
Where it shows up
- SIM swap — Someone convinces your mobile carrier to move your number to their SIM, and every code you rely on starts arriving on their phone.
- Phishing and smishing — A small, cheap problem and a link that fixes it — on a screen where you cannot see where the link goes.