SIM swapping (fraudulent SIM duplicate)
SIM swapping is a fraud where someone poses as you to your carrier, gets a duplicate of your SIM, and takes over your number: from then on, your calls and texts, including verification codes, go to them.
- What it is
- They steal your number, not your phone
- Since
- Tied to SMS as 2FA
- Verdict
- Yes
What it is
In SIM swapping, the attacker doesn't steal your phone: they convince your carrier that they're the owner of your line, usually with data about you they already obtained beforehand (phishing, data leaks), and request a SIM duplicate or a port. Once they get it, your own phone loses coverage, and its calls and texts, including verification ones, go to their card instead.
It's different from having your phone stolen: here you still have the device in your hand, but your number is no longer only yours. That's why the first sign is often losing coverage for no reason.
Since when
It's not a product with a launch date, but a social engineering technique that grows alongside the use of SMS verification as a second factor: the more accounts depend on SMS to log in or recover access, the more an attacker benefits from controlling your number. INCIBE and Spain's Internet Security Office (OSI) document it as one of the most active identity-fraud scams against banking and cryptocurrency users.
Why it's used
An attacker wants your number because many accounts use SMS to verify who you are or to recover access. If they control your number, they can request "forgot my password" on your email or your bank and receive the code that was supposed to reach you.
The flip side is why this site insists so much on not relying only on SMS: the more your recovery depends on something as easy to impersonate as your phone number, the more valuable that number becomes to whoever wants into your accounts.
Does it affect you?
Yes, if your email, your bank or your 2FA depend on SMS as the only route. If all of those use another method besides SMS, the risk drops a lot.
Check this
- Does any of your critical accounts use SMS as the only second factor?
- Would you notice right away if you lost coverage for no reason?
- Do you have your carrier's lock-out phone number saved outside your phone?
If it's already happened to you
If you lose coverage without explanation and suspect a fraudulent duplicate, call your carrier immediately from another phone to cancel the duplicate and lock the line, and also contact your bank to block cards and review transactions. INCIBE also recommends reporting it to the police. If you use online banking, change the passwords for accounts that depended on that number afterward, from a secure device.
Official sources: SIM swapping: how to avoid this scam (INCIBE)