What is a SIM swap attack in crypto?

A SIM swap attack, also called SIM swapping, is a takeover of your mobile phone number. The attacker does not need your phone. Instead, they get your carrier to transfer your number to a SIM card or device they control. From then on, calls and texts meant for you go to them, including the one-time codes many crypto exchanges send by text.

How does a SIM swap attack work?

The FBI describes three main methods. In social engineering, the criminal pretends to be the victim and talks the carrier into switching the number. With an insider, the criminal pays a carrier employee to do it. With phishing, the criminal tricks employees into installing malware that gives access to the carrier's systems.

Once the swap is done, the attacker uses "forgot password" and account recovery options on the victim's email and other accounts. If those accounts use text message codes for two-factor login, the codes arrive on the attacker's device. A closely related scheme, port-out fraud, moves the number to a different carrier without the owner's permission.

How common are SIM swap scams?

In a February 2022 alert, the FBI said its Internet Crime Complaint Center received 320 SIM swap complaints with about $12 million in losses from January 2018 to December 2020. In 2021 alone it received 1,611 complaints with more than $68 million in losses, covering both bank and crypto accounts.

In November 2023 the Federal Communications Commission adopted rules aimed at the problem, BleepingComputer reported. US wireless carriers must use secure methods to authenticate customers before moving a number to a new device or carrier, and must promptly tell customers when a SIM change or port-out request is made on their account.

How do you protect yourself from a SIM swap?

The FBI's suggestions include not advertising crypto holdings on social media, not posting your phone number or address publicly, and verifying any call claiming to be from your carrier by dialing the carrier yourself. It also suggests unique passwords, watching for sudden loss of text message service, and stronger login methods such as standalone authenticator apps, physical security tokens or biometrics. If you suspect a swap, it says to contact your carrier immediately and then change your account passwords.

Because a stolen number defeats text message codes, many exchanges offer those stronger options too. The settings are covered in how to secure a crypto exchange account. Coins held in a wallet you control are not unlocked by a phone number, though the seed phrase must stay offline, as explained in what a seed phrase is. If an attack does happen, what to do if you are scammed lists where to report it.