What is a SIM-swap attack and how can it affect crypto users?

By / October 9, 2025

What is a SIM-swap attack and how can it affect crypto users?

TL;DR

A SIM-swap (or SIM-hijacking/port-out) attack is when a criminal convinces your mobile carrier to move your phone number onto a SIM card they control. Once they control your number, they can intercept SMS verification codes, reset passwords, and take over email, exchanges, and wallets—often draining crypto in minutes. Use app-based or hardware-based MFA, lock your mobile account with a port-out PIN/number lock, minimize phone-number use for logins, and set up rapid-response recovery if anything feels off. (Federal Communications Commission Docs)

What is a SIM-swap attack?

A SIM-swap attack is a form of identity fraud where a threat actor gets a carrier to reassign your phone number to a new SIM under their control (sometimes by “porting out” to a different carrier). With your number, they can receive all calls and texts intended for you—including SMS 2FA codes—and then reset passwords to seize accounts. U.S. regulators collectively describe these as “SIM fraud” (SIM swaps + port-out fraud). (Federal Communications Commission Docs)

Why crypto users are a prime target

Because many exchanges and financial services still allow password resets or sign-ins with SMS one-time codes, taking over your phone number gives attackers a fast path into accounts that hold liquid assets. Coinbase’s security team notes SIM swapping as a common entry point for crypto theft. (Coinbase)

How SIM-swapping works (step by step)

  1. Recon & social engineering: Attackers gather your personal details (name, number, last 4 SSN, address) from breaches, phishing, or open web. They may also spoof texts/calls to trick you into sharing verification codes. The FTC warns: never give verification codes to anyone who asks. (Consumer Advice)
  2. Carrier impersonation: The attacker calls/chat-supports your carrier, posing as you, and requests a SIM replacement or number port-out. Weak identity checks or bribed insiders can make this succeed. (Federal Communications Commission Docs)
  3. Number takeover: Your phone suddenly loses service (no bars), while the attacker’s device starts getting your SMS and calls. (Federal Communications Commission Docs)
  4. Account resets & 2FA interception: They reset passwords on email, exchange, and wallet services that still use SMS codes—then drain funds or lock you out. CISA and the FIDO Alliance highlight SIM-swap as a key reason to avoid SMS-based MFA. (CISA)
  5. Cover tracks: Attackers may enable 2FA with their own device, change recovery emails, or start phishing your contacts from your hijacked accounts. (CISA)

Real-world signal: this isn’t theoretical

  • SEC’s official X (Twitter) account was compromised in January 2024 due to a SIM-swap, enabling a false, market-moving post. If it can happen to the SEC, it can happen to anyone. (Axios)
  • The FCC issued an Enforcement Advisory emphasizing the rise of SIM-swap and port-out fraud across carriers. (Federal Communications Commission Docs)

The impact on crypto users

Once attackers control your number, they can:

  • Bypass SMS 2FA on exchanges, custodial wallets, and email accounts that control recovery flows. (Coinbase)
  • Reset passwords and lock you out of email and cloud drives (which are often the keys to resetting everything else). (CISA)
  • Drain exchange balances or initiate off-platform transfers to attacker-controlled addresses, often within minutes. (Recovery of stolen crypto is notoriously difficult once it’s moved on-chain.) (trustdale.com)
  • Pivot deeper: with your email and SMS, they can also target banks, brokerage accounts, password managers, and social media. (CISA)

Scale of the problem: The FBI Internet Crime Complaint Center (IC3) tracks mounting cybercrime losses (over $12.5B reported in 2023 across categories). While SIM-swap is one vector among many, law-enforcement, carriers, and security agencies continue to flag it as a serious and growing threat. (Internet Crime Complaint Center)

Warning signs you’re being SIM-swapped

  • Your phone suddenly loses service (no signal) while others nearby have coverage.
  • You receive a flood of password reset emails or new-login alerts.
  • Your carrier notifies you about a SIM change or port-out you didn’t request.
  • Friends say they got weird texts from your number.
  • MFA prompts you didn’t initiate keep appearing.

Act immediately if any of these happen—see the emergency checklist below. (The FTC and CTIA both advise contacting your carrier right away.) (Consumer Advice)

18 prevention moves for crypto users (ranked by impact)

A. Kill your dependence on SMS codes

  1. Use phishing-resistant MFA on exchanges and email: FIDO2 security keys (e.g., passkeys) or TOTP authenticator apps (not SMS). CISA explicitly recommends phishing-resistant MFA; FIDO/NIST have long discouraged SMS for authentication. (CISA)
  2. App-based codes over SMS wherever hardware keys aren’t supported—store backup codes securely offline. (CISA)
  3. Unique, long passwords + a reputable password manager to avoid password reuse (which reduces pressure on SMS 2FA entirely). (CISA)

B. Harden your mobile account

  1. Set a carrier account PIN/port-out PIN and ask for a port freeze/number lock if your carrier supports it. (U.S. guidance and industry bodies stress these controls.) (Federal Communications Commission Docs)
  2. Add extra passphrase/in-store photo ID requirements where possible. Ask your carrier what high-security flags exist and enable them all. (Federal Communications Commission Docs)
  3. Avoid sharing your phone number publicly; don’t reuse it as a universal recovery factor.

C. Clean up your account recovery

  1. Change your primary recovery email to one protected by hardware-key MFA; avoid SMS as a fallback. (CISA)
  2. Remove phone numbers from login and password reset flows whenever services allow alternative factors. (CISA)
  3. Keep offline copies of seed phrases and emergency codes; never store seeds in email, notes apps, or cloud drives tied to your phone number.

D. Reduce your attack surface

  1. Treat unsolicited texts/calls as hostile—never share verification codes or click login links on text messages. The FTC is crystal clear: anyone asking for a verification code is a scammer. (Consumer Advice)
  2. Use separate emails for exchange logins, DeFi activity, and public profiles, so a single inbox compromise doesn’t cascade.
  3. Enable withdrawal allow-lists and cool-down windows on exchanges so attackers can’t instantly send funds to new addresses. (Most major exchanges support these risk-controls.) (Coinbase)
  4. Prefer hardware wallets or cold storage for long-term holdings. Exchange accounts are still useful, but don’t keep more hot funds than necessary. (Coinbase)
  5. Keep your device OS and apps updated; phishing plus device malware can combine with SIM-swap for deeper compromise. (CISA)

E. Prepare a rapid-response plan

  1. Save carrier fraud hotlines in a separate place (not just in your phone).
  2. Pre-write a security script you can paste to your carrier and exchange support to freeze changes and lock withdrawals.
  3. Turn on login alerts and transaction alerts on exchanges, banks, and email. (Coinbase)
  4. Consider credit freezes and identity monitoring after any suspicious activity. (FTC/CTIA recommend rapid contact and ID-theft steps.) (Consumer Advice)

Emergency checklist: what to do if you suspect a SIM-swap

  1. Call your carrier immediately from another phone. Report a suspected SIM-swap/port-out, request emergency deactivation, and reset your account PIN. Ask to reverse the swap and place a port freeze. (CTIA)
  2. Lock down your email (the hub of resets): change password, force-logout sessions, and switch MFA to an authenticator app or hardware key—remove phone number as a factor. (CISA)
  3. Exchange & wallet triage:
    • Change passwords and rotate API keys.
    • Freeze withdrawals/enable cool-downs and allow-lists.
    • Contact support, open urgent fraud tickets, and request temporary account holds. (Coinbase)
  4. Bank & brokerage: alert fraud teams, consider a temporary card freeze, and watch for new payees.
  5. Report to authorities: file at IC3.gov (FBI) and your national cybercrime channel. Document timestamps, carrier reps, and any case numbers. (IC3 data guides investigations and trend analysis.) (Internet Crime Complaint Center)
  6. Friends & work: announce that your phone number may be compromised; warn about potential phishing texts/calls.
  7. Post-incident: rotate recovery emails, regenerate backup codes, and review every account that listed your phone number as a login or reset factor.

Frequently asked questions

Is SMS-based 2FA “bad” now?

SMS 2FA is better than no 2FA, but it’s vulnerable to SIM-swap and phishing. Security agencies recommend phishing-resistant MFA (FIDO2/security keys or passkeys) where available, and app-based authenticators otherwise. (CISA)

Does eSIM solve SIM-swapping?

Not by itself. Carriers can still reassign your number remotely. What matters is carrier authentication strength (your account PIN/port-out lock) and avoiding SMS for logins and resets. (Federal Communications Commission Docs)

Can this happen without breaching my phone?

Yes. Attackers often never touch your handset—they convince the carrier to move your number. That’s what makes SIM-swap so dangerous. (NCLC)

Are there recent examples?

Yes. In January 2024, the SEC’s X account was taken over via SIM-swap, enabling a false ETF tweet. The incident underscores how phone-number controls can be a single point of failure even for high-profile accounts. (Axios)

How big are the losses?

IC3 reported $12.5B in overall cybercrime losses in 2023 across all categories; SIM-swap is one of several high-impact techniques feeding that number. Loss figures for SIM-swap specifically vary by source and year, but regulators (FCC/CISA) and industry repeatedly flag rising activity and urge stronger MFA. (Internet Crime Complaint Center)

Content strategy sidebar (for site owners)

If you run a crypto education site or exchange-adjacent blog, consider building an evergreen safety hub:

  • Pillar guide (this article) + short checklists (“What to do in the first 30 minutes”).
  • Carrier hardening explainer (PINs, number locks, port freezes by carrier). (CTIA)
  • MFA migration walkthroughs (swap SMS → TOTP → passkeys) and hardware key setup guides. (CISA)
  • Recovery templates (copy-paste scripts for carrier and exchange support).
  • Case studies (e.g., SEC X account incident) to drive home urgency. (Axios)

Internal-link this content from every “account security” or “how to buy” page to reduce risk for new users.

On-chain isn’t “on-undo”: mindset and culture

Crypto’s finality means once funds are transferred, recovery is rare. Coinbase’s security posts emphasize layered defenses (alerts, allow-lists, MFA upgrades) because prevention beats any after-the-fact chase. Educate your team and family—SIM-swap isn’t purely a “tech” problem, it’s an identity and process problem at carriers and help desks. (Coinbase)

Quick reference: do’s and don’ts

Do:

  • Use hardware keys or passkeys (preferred) or TOTP apps for MFA; keep backup codes offline. (CISA)
  • Set a carrier PIN and ask for a port-out lock. (CTIA)
  • Enable withdrawal allow-lists and cool-downs on exchanges. (Coinbase)
  • Keep exchange email separate, locked with hardware-key MFA. (CISA)
  • Treat unsolicited “verification” requests as scams; report to the FTC in the U.S. (Consumer Advice)

Don’t:

  • Don’t rely on SMS as your only MFA factor if safer options exist. (FIDO Alliance)
  • Don’t keep large balances in hot wallets for longer than necessary. (Coinbase)
  • Don’t store seed phrases in email/cloud or on devices tied to your phone number.
  • Don’t ignore service-loss warnings (no bars) or unfamiliar reset emails.

References & further reading

  • FCC Enforcement Advisory on SIM-swap and port-out fraud (Dec 11, 2023). (Federal Communications Commission Docs)
  • CISA: Implementing phishing-resistant MFA (fact sheet) and mobile best-practice guidance. (CISA)
  • FBI IC3 2023 Internet Crime Report (losses, reporting channel). (Internet Crime Complaint Center)
  • FTC consumer alerts on verification codes and SIM-swap-style scams. (Consumer Advice)
  • Coinbase Security: SIM-swap note and crypto safety tips (exchanges’ perspective). (Coinbase)
  • CTIA: Protecting your wireless account against SIM-swap fraud. (CTIA)
  • FIDO Alliance/NIST: rationale for moving away from SMS-based authentication. (FIDO Alliance)
  • Case study: SEC’s X account compromised via SIM-swap (Jan 2024). (Axios)

Related Posts

Scroll to Top