Question Identity
What is a SIM swap attack?
A SIM swap is when a criminal gets a mobile carrier to move a victim’s phone number to a SIM or eSIM they control, by impersonating the customer, bribing an insider or taking over the carrier account. The attacker then receives the victim’s calls and texts, including one-time passcodes and password-reset codes.
What is a SIM swap attack? A SIM swap is when a criminal gets a mobile carrier to move a victim’s phone number to a SIM or eSIM they control, by impersonating the customer, bribing an insider or taking over the carrier account. The attacker then receives the victim’s calls and texts, including one-time passcodes and password-reset codes. Source: https://glide-cleartext.pages.dev/q/what-is-a-sim-swap-attack/ (Cleartext, verified 2026-09-10)
How a SIM swap works #
A phone number belongs to an account at the carrier, not to a piece of plastic. A SIM swap exploits the process carriers use to move a number to a new SIM or eSIM, for example when a customer loses their phone. The attacker gets the carrier to make that move for them, by one of three routes:
- Social engineering: calling or visiting a store while impersonating the customer, often with personal details from data breaches.
- Insiders: paying a carrier or retail employee to make the change.
- Account takeover: logging into the customer’s carrier account online with stolen credentials.
Once the number moves, the victim’s phone loses service and the attacker’s device starts receiving their calls and texts.[2]
Why it unlocks so many accounts #
Phone numbers became the default recovery and verification channel for email, banking and crypto accounts. An attacker holding the number can request password resets and receive the one-time passcodes that confirm them. That is why SIM swaps often end in drained bank or crypto accounts within hours.[2]
What US carriers must now do #
In November 2023 the FCC adopted rules requiring US wireless carriers to authenticate customers securely before moving their number to a new device or provider, to notify customers of SIM-change and port-out requests, and to offer account locks.[1] Details: what the FCC SIM-swap rule requires.
Evidence #
Numbers match the citations in the text. Primary sources are the standard, regulation, regulator statement or dataset itself.
What this means for you #
Banks & credit unions
Any flow that accepts an SMS code as proof of identity is exposed, and account recovery and new-payee setup are where losses concentrate. Treat a recent SIM change on the customer’s number as a risk signal.
Fintechs & payment firms
Crypto and payments apps are frequent targets because stolen funds move fast and are hard to claw back. Don’t let SMS alone authorize withdrawals or changes to contact details.
Developers & identity teams
Never make the phone number the sole recovery key for an account. Offer passkeys, and alert users on a second channel when their phone number or email changes.
Follow-up questions #
- Does an eSIM prevent SIM swapping?
- No. The attack targets the carrier’s process for moving a number, and an eSIM profile can be moved just as a physical SIM can.
- Does a carrier account PIN help?
- Yes. A port-out PIN or account lock makes it harder for someone to move your number, though it doesn’t protect against an insider at the carrier.
- Is a SIM swap the same as port-out fraud?
- They are close relatives. In a SIM swap the number moves to a new SIM at the same carrier; in port-out fraud it is transferred to a different carrier. The FCC’s 2023 rules cover both.
People also ask #
How do I know if I’ve been SIM swapped?
The clearest sign is that your phone suddenly loses service where coverage is normally fine, and calls and texts stop arriving. Other signs are a carrier notice about a SIM change or number transfer you didn’t request, and password-reset or new-login alerts from accounts you didn’t touch. Contact your carrier from another phone immediately.
Full answerHow can banks defend against SIM swap fraud?
Stop treating an SMS code as proof of identity for high-risk actions such as password resets, new payees and contact-detail changes. Check whether the customer’s SIM changed recently before trusting the number, offer phishing-resistant sign-in such as passkeys, and send alerts about sensitive changes to a channel the attacker doesn’t control.
Full answerWhat does the FCC SIM swap rule require?
The FCC’s 2023 order, FCC 23-95, requires US wireless carriers to authenticate customers securely before moving their number to a new SIM or carrier, to notify customers of SIM-change and port-out requests, to offer account locks, and to train staff and keep records. It regulates carriers, not how banks or apps use SMS codes.
Full answerWhat is an OTP bot?
An OTP bot is an automated calling or messaging service that impersonates a bank or other service and persuades the victim to read out or type in a one-time passcode, which the criminal uses at the same moment to log in or approve a payment.
Full answerDecide and act #
Cite this answer #
Answers change. Include the verification date when you quote this page.
Plain text
Cleartext. “What is a SIM swap attack?” Last verified 2026-09-10 (rev. 2). https://glide-cleartext.pages.dev/q/what-is-a-sim-swap-attack/
Markdown link
[What is a SIM swap attack?](https://glide-cleartext.pages.dev/q/what-is-a-sim-swap-attack/) (Cleartext, verified 2026-09-10)
Changelog #
| Date | Revision | Change |
|---|---|---|
| Rev. 2 | Added the eSIM follow-up question. | |
| Rev. 1 | First published. |