The Outlier Lab

SIM Swap and Port-Out Fraud

Hijacking a customer's phone number through a fraudulent SIM change or carrier port, to intercept SMS codes and recovery messages, usually just before a high-value withdrawal.

What it is

A phone number is an identifier you don't control. Your customer rents it from a carrier, and the carrier's retail stores, call centers and dealer channels can reassign it. When a fintech uses that number for sign-in codes, password reset or "is this really you?" confirmations, the carrier's account-security process becomes part of the fintech's authentication.

  • SIM swap. The number is moved to a new SIM or eSIM at the same carrier.
  • Port-out. The number is transferred to a different carrier.

Both cut off the victim's service (often the first sign) and send SMS and voice to the attacker. They are typically one step in a targeted Account Takeover (ATO): the attacker already has the password or recovery email, and the phone number is the missing factor. Compare MFA Bypass and OTP Interception, which covers other ways to get the code.

How it works

Diagram: Target selection (known holdings, leaked data), Number reassigned (social engineering, insider, compromised carrier account), Victim loses service, SMS reset and OTPs go to attacker, Password, email and device changes, Withdrawal: crypto, wire, ACH, ACATS

The FBI described the main routes to reassignment in 2022:

  • Social engineering of carrier staff, with the attacker posing as the customer.
  • Insiders: carrier employees paid to perform the swap.
  • Phishing of carrier employees to get access to systems that process swaps.

After the swap, the attacker uses SMS for password reset and recovery, and intercepts SMS one-time codes, to take over accounts. Targets are chosen for value. Public crypto holders, executives and people in leaked customer databases are overrepresented.

Transaction footprint

Look for a fast sequence of events: phone change at the carrier, then SMS-based reset, then contact changes, then the biggest withdrawal the account allows.

StageWhat you see in the dataDecision point
Swap or portNot visible to you directly. Only a carrier signal shows a recent SIM change or port.Check phone-change recency before trusting SMS
ResetPassword reset or recovery via SMS from a new device; sometimes a recovery-email takeover firstSecure Account Recovery Design; don't let SMS alone authorize recovery
ControlEmail change, new device enrolled, 2FA method changed, notifications redirectedContact Change Cooling-Off Periods
StagingNew withdrawal address, bank link or receiving broker; whitelist changesHold new destinations; Bank Account Ownership Verification
Cash-outLarge crypto send, wire or ACH; ACATS out; liquidation then transferWithdrawal and Payout Controls; step-up with a non-SMS factor
AftermathVictim reports no service, then calls from a borrowed phone; the carrier confirms the portFast freeze; preserve evidence for law enforcement

Common variants

VariantWhat's differentWhere it shows up
In-store or call-center swapSocial engineering with fake ID or stolen account detailsAll carriers
Insider-assisted swapBribed employee or contractorCarrier retail and support
eSIM transferCarrier account compromised online, then eSIM moved to the attacker's deviceCarriers with self-service eSIM
Port-outNumber moved to another carrier using stolen account PIN or dataPrepaid and postpaid
Phone theft plus SIM usePhysical theft of an unlocked device; SIM used for codesOpportunistic; often paired with passcode observation
Executive or high-net-worth targetingVictims pre-selected from public or leaked dataCrypto, brokerage, wealth

Where it shows up

  • Crypto and brokerage. High balances, irreversible or slow-to-recover exits, and a history of SMS-based 2FA. See Brokerage and Investing and ACATS Transfer Fraud.
  • Neobanks and P2P. The phone number is often the primary identifier, so reassigning it reassigns the account. See Neobanks and Consumer Fintech and Payments and P2P.
  • Rewards and marketplaces. Phone-number login and SMS recovery let attackers take over accounts and redirect payouts. See Payout Redirection.

Impact

FBI IC3 SIM-swap reports have been falling while losses per incident stay high:

YearComplaintsReported losses
2018–2020 (combined)320~$12 million
20211,611~$68 million
20222,026~$72.7 million
20231,075~$48.8 million
2024982~$26.0 million
  • Complaints to the FCC about the crime doubled from 275 in 2020 to 550 in 2023 (AP reporting).
  • In absolute terms it is rare. Microsoft's 2024 Digital Defense Report put SIM swapping at under a third of one percent of identity attacks (as cited secondarily). But it concentrates on high-value targets.
  • In the largest alleged case, federal prosecutors charged three people in early 2024 over a SIM-swap scheme that allegedly enabled the theft of more than $400 million in crypto from one company, which Bloomberg and others identified as FTX. See Case Study - FTX Theft via SIM Swap (2022).

Red flags

Prevention and detection at a glance

LayerControl or signalWhat it does here
PreventPasskeys and Phishing-Resistant AuthenticationRemoves the phone number from the authentication path
PreventSecure Account Recovery DesignSMS alone can't recover an account holding value
PreventMulti-Factor Authentication (MFA)Push customers from SMS to app-based or hardware factors
DetectPhone Risk Signals (SIM-change and port recency)Downgrades trust in SMS when the number recently moved
DetectRisk-Based Authentication and Step-UpSteps up with a non-SMS factor for high-value actions
RespondContact Change Cooling-Off Periods, Withdrawal and Payout ControlsHolds money movement after phone, email or 2FA changes
RespondCustomer Support Verification ProtocolsYour own support isn't the next weak link

Emerging variants and adversary adaptation

  • Carrier-side rules. The FCC adopted its SIM Swap and Port-Out Fraud Order on November 15, 2023. It requires wireless providers (including resellers) to use secure customer authentication before SIM changes and ports, notify customers immediately of requests, offer free account locks, train staff, bar inbound-contact employees from customer data until the customer is authenticated, and keep records for three years. The rules took effect January 8, 2024, except the information-collection provisions. On July 5, 2024, the Wireline Competition Bureau tied all compliance deadlines to completion of OMB's Paperwork Reduction Act review and a later Federal Register notice. At the time it estimated OMB approval would come no earlier than late November 2024. OMB approved on January 15, 2025, but as of October 2026 the codified SIM-change rule (47 CFR 64.2010(h)(9)) still says compliance isn't required until a compliance date is added, and we found no Federal Register notice setting one. Treat the rules as adopted but not yet enforceable, and carrier-side protection as uneven.

  • The attack moves online. As in-store checks tighten, attackers move toward carrier online accounts (self-service eSIM transfer) and toward carrier insiders. The carrier's own account-takeover problem becomes yours.

  • Falling complaint counts. IC3 complaints fell from the 2022 peak, consistent with the shift from SMS to app-based factors at crypto platforms. The remaining incidents are targeted and high-value, so a lower count doesn't mean lower risk.

  • Phone number as identity. Products that use the phone number as the account identifier or the passwordless login method stay exposed. Carriers also reassign numbers in the normal course of business, so plan for recycled numbers as well as hijacked ones.

  • What's next. Expect attackers to combine number takeover with recovery-flow abuse at email providers and with voice cloning against your support line (Generative AI and Deepfake Fraud).

Real-world examples

  • Case Study - FTX Theft via SIM Swap (2022): alleged $400M+ crypto theft enabled by a SIM swap; DOJ prosecution.
  • AP reporting in July 2024 described a journalist whose number was ported out. Within days, $19,000 was wired out of her bank account, and it took ten days to recover the number.

Sources and further reading