SIM swapping: how they steal your accounts with your number

Imagine the following situation: you are browsing on your phone when, from one second to the next, coverage disappears completely and the screen shows the message «No service» or «Emergency calls only». You think it is a temporary network failure, but minutes later, when you connect to a Wi-Fi network, alarming notifications begin arriving in your email: password change requests, logins from unknown devices and verification codes you never requested. Without moving from your spot, they have just hijacked your phone number and, with it, the access key to your digital life.

Indeed, this scene is the starting point of SIM swapping (or fraudulent SIM duplication), one of the most dangerous and invisible cyberattack techniques today. In this article you will discover exactly what this threat is, how attackers operate step by step to deceive carriers, why your cryptocurrency funds and bank accounts are in the crosshairs, and what concrete measures you should take to shield your line or react in time if it happens to you.

What SIM swapping is

In simple terms, SIM swapping is a cyberattack technique based on identity theft where a criminal deceives your telephone company into issuing a duplicate of your SIM card in their name.

As a consequence of this process, by transferring your number to a chip under their control, your phone loses the line completely, while the attacker begins receiving all your calls and text messages. This allows them to intercept verification SMS (2FA codes) and invade most of your digital accounts, banks and social networks.

In fact, the National Cybersecurity Institute (INCIBE) and its citizen assistance channel classify SIM swapping as a critical form of impersonation. The attack does not exploit a software flaw in your phone, but rather a breach in the verification controls of the carriers, combined with the use of prior phishing or social engineering to obtain the victim’s personal data.

How the attack works step by step

Unlike other frauds, SIM swapping does not require exploiting your phone’s operating system or decrypting complex algorithms. Its effectiveness lies in social engineering and in taking advantage of the gaps in the identity verification processes of telephone companies. The attack follows a coordinated sequence in three main phases:

Collection of personal data

First, before contacting the carrier, the cybercriminal gathers the information necessary to impersonate you. To obtain this data, they resort to:

• Phishing and smishing: Fraudulent emails or SMS that pretend to be from your bank or carrier so that you enter your credentials.
• Dark web leaks: Databases stolen from compromised platforms or e-commerce sites.
• Social engineering and social networks: Public profiles where personal data is exposed, or impersonation calls to request the remaining data.

Request for the duplicate

Later, with your data in hand, the attacker contacts the telephone company to request the transfer of the line to a new chip under their control:

• Telephone or web support: They impersonate the account holder, answer security questions with the stolen information and request the activation of an eSIM or the sending of a new chip.
• Physical stores: They go to a physical point of sale presenting a falsified identity document.
• Internal complicity: In more elaborate cases, they resort to the collaboration of employees of the company itself who process the procedure omitting the verification protocols.

Account hijacking through SMS

Finally, once the line is active on their device, the attacker executes the decisive phase of the fraud:

• Password resets: They start the «Forgot my password» process on your email accounts, social networks and financial platforms.
• Interception of 2FA codes: They directly receive the one-time verification SMS sent by the services to validate the changes.
• Access to funds and services: They log in, change access credentials, authorize bank transfers or request quick loans before you can react.

Why it also affects your crypto

Likewise, the cryptoasset ecosystem has become one of the priority targets of cybercriminals who carry out SIM swapping. Unlike traditional bank transfers, transactions on the blockchain are irreversible by nature.

The vulnerability in centralized exchanges

On the one hand, centralized exchanges (CEX) habitually depend on the email address and two-step verification by SMS to confirm logins, password changes and fund withdrawals.

Therefore, when an attacker takes control of your phone number:

1. They request access reset on the platform via SMS or email.
2. They intercept the verification codes sent to your hijacked line.
3. They log in, change the security credentials and liquidate or transfer your cryptocurrencies to external wallets within minutes.

Because of this excessive dependence on SMS as a recovery method, both high-profile investors and private users have lost millions of euros in lightning attacks.

The key difference with self-custody

However, it is essential to distinguish between keeping funds on a centralized platform and safeguarding them through a non-custodial wallet (self-custody):

• On centralized platforms: Access to your funds is linked to web credentials, emails and SMS verifications. If the attacker breaches your mobile line, they breach your account.
• In self-custody wallets: Control of the assets resides exclusively in your private keys and in your seed phrase. It does not depend on the telephone network, nor on the mobile number, nor on any central server.

For this reason, even if a criminal duplicates your SIM card, they will not be able to access the cryptocurrencies stored in a self-custody wallet, unless you have made the mistake of saving a digital copy of your recovery phrase in an email, cloud note or screenshot inside the exposed device.

Signs that you are being a victim

In these situations, reaction speed is the determining factor in lessening the consequences of SIM swapping. Identifying the initial anomalies before attackers consolidate control over your platforms will allow you to act in time:

Sudden loss of mobile coverage

Without a doubt, it is the first technical symptom and the most obvious. If your phone screen abruptly shows messages such as «No service», «Emergency calls only» or the total absence of network in a place where you normally have good signal, do not assume it is a general outage. If the people around you maintain coverage with the same company as you, it is very likely that your SIM has been deactivated by the issuance of a duplicate.

Unrequested notifications and notices from the carrier

Often, the telephone company sends an automatic confirmation SMS or an email when processing a request («We have received your SIM duplicate request» or «Your eSIM has been activated on a new device»). If you receive a message of this type without having carried out any procedure, the impersonation is underway.

Security alerts and inactivity in SMS/calls

On the other hand, even if you remain connected to the Internet through a Wi-Fi network, you will stop receiving conventional phone calls and SMS. A few minutes later, you will begin receiving security notifications in your email:

• Unrequested password reset notices.
• Login alerts from unknown locations or devices.
• Automatic logouts and inability to access your email, banking applications or cryptocurrency exchange platforms.

How to protect yourself from SIM swapping

Although telecommunications companies continue to reinforce their protocols, combined prevention between your digital habits and your line settings is decisive. Organizations such as the Internet User Security Office (INCIBE Ciudadanía) advise applying the following containment measures:

Replace SMS authentication with apps or passkeys

Since SMS is the weakest link in the two-factor authentication because it depends on the telephone network. Migrate your banking, email and exchange access to:

• Authentication apps (TOTP): Google Authenticator, Authy or Microsoft Authenticator generate local codes on your physical device that do not travel over the telephone network.
• Physical keys or Passkeys: Tools based on hardware or local biometrics that prevent access even if the attacker controls your phone number.

Reinforce security with your carrier

Likewise, it is advisable to contact your mobile provider to raise the administrative restrictions on your line through:

• Activated SIM PIN: Prevents use of the chip in case of physical theft of the phone.
• Verbal password or security PIN: Ask the company to require a unique non-transferable password or mandatory in-person verification to authorize any card duplicate or migration to eSIM.

Maintain strict personal data hygiene

In this sense, the National Police warns that information publicly exposed facilitates impersonation before call centers:

• Limit exposure on networks: Hide sensitive data such as date of birth, ID number, address or telephone number.
• Distrust phishing: Do not enter credentials in links received by SMS, nor provide codes through unverified calls.

Offline safekeeping of crypto keys

In the field of cryptocurrencies, remember that your seed phrase must never be stored on the phone, photos or cloud notes. If you keep your assets in self-custody solutions and your private keys remain stored on physical media, a fraudulent SIM duplicate will not be able to compromise your funds.

What to do if it has already happened to you

If your phone loses signal suddenly and you suspect an unauthorized duplicate, the first minutes are critical. The official urgent action protocol recommended by INCIBE and the Security Forces and Corps consists of four essential steps:

1. Immediate contact with the carrier: Call your telephone company from another terminal, report the fraud to the security department and request the urgent preventive blocking of the SIM card and the cancellation of any active duplicate.
2. Notice to financial entities and exchanges: Immediately notify your banks and exchanges to freeze operations, revoke open sessions and block outgoing transfers.
3. Password change from a secure device: Access your main email accounts and linked services to change access passwords and log out on all connected devices.
4. Formal report and technical assistance: File a report with the National Police or the Civil Guard providing the bank statements and the proof of the duplicate issued by the carrier. To receive free and confidential support during the process, you can contact the INCIBE Cybersecurity Help Line 017

Frequently asked questions about SIM swapping

• Can they make a SIM duplicate without my ID? Although the law requires ID, attackers use stolen data, fake photocopies or deceive operators by phone and in physical stores.
• Does an eSIM protect me? The administrative procedure is the same; if they impersonate your identity, the criminal can request the QR code and install your line on their mobile.
• Is SMS 2FA secure? It is the most vulnerable two-factor method. If they duplicate your SIM, they intercept all your codes.
• What do I do if I suddenly lose coverage? Check if others have signal. If only yours fails, immediately call your carrier from another phone to verify if there is a duplicate in progress and block the line.

Staying alert to sudden failures in your line and acting quickly will make the difference in neutralizing the impact of this scam.