SIM Swap Attack: How Criminals Hijack Your Phone Number and How to Stop Them

Your phone suddenly shows "No Service." No calls, no texts — just dead air. You assume it's a network issue. Hours later, you discover thousands of dollars have been drained from your bank account. Welcome to SIM swap fraud — one of the fastest-growing cybercrimes worldwide.

In India, SIM swap complaints surged 320% in 2025 according to CERT-In. In the US, the FBI reported over $68 million in SIM swap losses in a single year. This attack bypasses SMS-based two-factor authentication entirely.

How SIM Swap Attacks Work

Method 1: Social Engineering

1. The attacker gathers your personal information from social media, data breaches, or phishing
2. They call your carrier impersonating you
3. They claim your phone was "lost" or "damaged" and request a new SIM
4. Your original SIM is deactivated
5. All OTPs, calls, and texts now go to the attacker's phone

Method 2: eSIM Hijacking

Method 3: Insider Fraud

Corrupt carrier store employees issue replacement SIMs without proper verification in exchange for payment.

Warning Signs

• Phone suddenly shows "No Service" or "Emergency Calls Only"
• Unexpected network drops without explanation
• Unknown transactions in your bank account
• Password reset emails you didn't request
• SIM change confirmation text from your carrier

Immediate Response Plan

1. Call your carrier immediately — report unauthorized SIM change
2. Contact your bank — freeze accounts, cards, UPI
3. File a cybercrime report — IC3.gov (US), Action Fraud (UK), cybercrime.gov.in (India)
4. Change all passwords — email, banking, social media
5. Switch 2FA from SMS to authenticator apps — Google Authenticator, Authy

Prevention Strategies

Sharing Sensitive Information Safely

Never send bank details, passwords, or PINs through iMessage or Messenger — if your SIM is compromised, attackers can see your message history on some platforms. Use LOCK.PUB to create password-protected links that expire after viewing. Even if your phone number is hijacked, the encrypted link remains inaccessible without the separate password.

The Carrier's Role

Major carriers have introduced additional protections:

• T-Mobile (US): Account Takeover Protection, SIM Protection
• AT&T: Extra Security PIN
• Verizon: Number Lock feature
• Jio/Airtel (India): Aadhaar-based biometric verification for SIM changes

Contact your carrier to enable all available security features.

Conclusion

SIM swap attacks succeed because SMS was never designed as a security mechanism. The best defense is reducing your dependence on SMS-based OTPs entirely. Switch to authenticator apps, set SIM PINs, and share sensitive information through encrypted, expiring channels like LOCK.PUB rather than text messages.

Report: FBI IC3 (US) | Action Fraud (UK) | Cybercrime.gov.in (India) | Your carrier's fraud hotline