# What is a SIM swap attack?

> **Short answer:** A SIM swap is when a criminal gets a mobile carrier to move a victim’s phone number to a SIM or eSIM they control, by impersonating the customer, bribing an insider or taking over the carrier account. The attacker then receives the victim’s calls and texts, including one-time passcodes and password-reset codes.

- URL: https://glide-cleartext.pages.dev/q/what-is-a-sim-swap-attack/
- Last verified: 2026-09-10 by [VERIFIER NAME] (revision 2)
- Publisher: Cleartext, owned by [OWNER ENTITY] (see https://glide-cleartext.pages.dev/about/ownership-and-funding/)

## How a SIM swap works

A phone number belongs to an account at the carrier, not to a piece of plastic. A SIM swap exploits the process carriers use to move a number to a new SIM or eSIM, for example when a customer loses their phone. The attacker gets the carrier to make that move for them, by one of three routes:

- **Social engineering:** calling or visiting a store while impersonating the customer, often with personal details from data breaches.
- **Insiders:** paying a carrier or retail employee to make the change.
- **Account takeover:** logging into the customer’s carrier account online with stolen credentials.

Once the number moves, the victim’s phone loses service and the attacker’s device starts receiving their calls and texts.[^2]

## Why it unlocks so many accounts

Phone numbers became the default recovery and verification channel for email, banking and crypto accounts. An attacker holding the number can request password resets and receive the one-time passcodes that confirm them. That is why SIM swaps often end in drained bank or crypto accounts within hours.[^2]

## What US carriers must now do

In November 2023 the FCC adopted rules requiring US wireless carriers to authenticate customers securely before moving their number to a new device or provider, to notify customers of SIM-change and port-out requests, and to offer account locks.[^1] Details: [what the FCC SIM-swap rule requires](https://glide-cleartext.pages.dev/q/what-does-the-fcc-sim-swap-rule-require/).

## What this means for you

### Banks & credit unions

Any flow that accepts an SMS code as proof of identity is exposed, and account recovery and new-payee setup are where losses concentrate. Treat a recent SIM change on the customer’s number as a risk signal.

### Fintechs & payment firms

Crypto and payments apps are frequent targets because stolen funds move fast and are hard to claw back. Don’t let SMS alone authorize withdrawals or changes to contact details.

### Developers & identity teams

Never make the phone number the sole recovery key for an account. Offer passkeys, and alert users on a second channel when their phone number or email changes.

## Follow-up questions

**Does an eSIM prevent SIM swapping?**

No. The attack targets the carrier’s process for moving a number, and an eSIM profile can be moved just as a physical SIM can.

**Does a carrier account PIN help?**

Yes. A port-out PIN or account lock makes it harder for someone to move your number, though it doesn’t protect against an insider at the carrier.

**Is a SIM swap the same as port-out fraud?**

They are close relatives. In a SIM swap the number moves to a new SIM at the same carrier; in port-out fraud it is transferred to a different carrier. The FCC’s 2023 rules cover both.


## Sources

[^1]: Protecting Consumers from SIM Swap and Port-Out Fraud. Federal Register, 2023-12-08. https://www.federalregister.gov/documents/2023/12/08/2023-26338/protecting-consumers-from-sim-swap-and-port-out-fraud
[^2]: SIM Swapping (reporting archive). KrebsOnSecurity. https://krebsonsecurity.com/category/sim-swapping/ (secondary)

## Related questions

- [How do I know if I’ve been SIM swapped?](https://glide-cleartext.pages.dev/q/how-do-i-know-if-i-have-been-sim-swapped/)
- [How can banks defend against SIM swap fraud?](https://glide-cleartext.pages.dev/q/how-can-banks-defend-against-sim-swap-fraud/)
- [What does the FCC SIM swap rule require?](https://glide-cleartext.pages.dev/q/what-does-the-fcc-sim-swap-rule-require/)
- [What is an OTP bot?](https://glide-cleartext.pages.dev/q/what-is-an-otp-bot/)

## Cite

Cleartext. “What is a SIM swap attack?” Last verified 2026-09-10 (rev. 2). https://glide-cleartext.pages.dev/q/what-is-a-sim-swap-attack/

## Changelog

- 2026-09-10: Added the eSIM follow-up question.
- 2026-08-18: First published.