SIM Swap Attacks: Why a Phone Number Is Not a Factor
The attack is against the carrier, not the phone. Port-out locks, moving off SMS, and the email account that sits behind every recovery flow.
A SIM swap does not involve your phone. Nothing on the device is compromised, no software is installed, and the handset in your pocket is untouched. The attack happens entirely at the carrier, and the first sign is usually that your phone stops having service.
The Mechanism
Mobile numbers can be moved between SIMs and between carriers. That is a necessary feature: people lose phones, change providers and upgrade devices.
An attacker exploits the process rather than breaking anything. They contact the carrier posing as the account holder, supply whatever information the support process asks for, and request the number be moved to a SIM they control. Where the process is weak, or where an insider is complicit, the transfer goes through.
From that moment, calls and text messages intended for you arrive at them.
Why It Targets Crypto Holders
The value of a phone number to an attacker is what it unlocks, and that is determined by how many accounts use it for verification or recovery.
Exchange accounts frequently use SMS for login verification and for resetting credentials. The email address behind those accounts often uses SMS for its own recovery. Once the number is theirs, an attacker can work through that chain: reset the email, use the email to reset the exchange account, and move funds.
The target selection is not random. Public association with crypto, whether through social media or a leaked customer list, is what puts a number on a list.
What Is and Is Not Exposed
| Asset | Exposed by a SIM swap? | Why |
|---|---|---|
| Exchange account with SMS verification | Yes | The code arrives at the attacker |
| Email account with SMS recovery | Yes, and it unlocks everything else | Recovery flows depend on the number |
| Self-custodied wallet | No, not directly | A private key is not reachable by phone |
| Hardware wallet | No | The key never leaves the device |
| Accounts using a hardware security key | No | The factor is physical and not transferable |
| Accounts using an authenticator app | Largely no | The secret lives on the device, not the number |
Self-custody is the structural answer to this attack. Funds held in a wallet whose keys you control are not reachable through a carrier’s support desk. See custodial against non-custodial.
The Defences, In Order
Add a port-out lock or transfer PIN with your carrier. This is the most direct protection, it addresses the mechanism rather than the consequences, and carriers generally provide it at no cost. Ask specifically for a restriction on transferring the number, not just an account password.
Remove SMS as a second factor wherever a better option exists. A hardware security key is the strongest and is supported by more services every year. An authenticator application is the practical alternative, and it keeps the secret on a device rather than attached to a number.
Remove SMS recovery from your email account. This is the step most often missed, and it is the most important one. An email account that can be reset by phone is a master key regardless of how well the accounts behind it are protected.
Do not use a phone number as a public identifier in contexts that associate it with crypto holdings.
Keep valuable holdings in self-custody, where a carrier’s process is irrelevant.
When It Happens
Loss of mobile service with no explanation is the signal. A phone showing no service while others in the same place work normally, especially without warning, is worth treating as an emergency rather than a network fault.
Move immediately: contact the carrier from another line, and from a different device secure the email account first, then exchange accounts. The order matters because email is the recovery path for everything else.
Report it to the carrier and to the services affected. Speed matters more than completeness at this stage.
What People Get Wrong About This
The first mistake is believing the phone was hacked. Nothing on the device is involved, which is why nothing on the device helps.
The second is treating SMS as meaningful two-factor authentication. It is better than nothing and it is the weakest option available, because it protects a number rather than a device.
A third is protecting exchange accounts carefully while leaving the email account behind them on SMS recovery. The chain is only as strong as its recovery path.
A fourth is assuming a strong carrier account password is sufficient. The attack frequently bypasses the online account entirely by going through support staff.
And the last is dismissing this as something that happens to prominent people. Customer lists leak, and a number associated with an exchange signup is enough to land on one.
Related
The same reasoning applies to any recovery flow: it is only as strong as its weakest path. Crypto phishing covers the social engineering directed at you rather than at your carrier, and two-factor authentication for crypto covers choosing between the factor types.
Common questions
What is a SIM swap?
An attacker persuades a mobile carrier to move a phone number onto a SIM they control, usually through social engineering of support staff or a corrupt insider. From that moment, calls and messages to the number reach the attacker, including any verification codes sent by SMS.
Why is SMS a weak second factor?
Because it authenticates a phone number rather than a person or a device, and the number can be moved by the carrier without any action from you. Everything protecting it is a customer service process at a company whose primary business is not securing your accounts.
Does a SIM swap put self-custodied crypto at risk?
Not directly. A private key held in your own wallet is not reachable through a phone number. The exposure is to accounts that use SMS for login or recovery, which typically means exchanges and the email account behind them.
What is a port-out lock?
A restriction added to a mobile account that blocks transferring the number to another carrier or SIM without additional verification, often a PIN or an in-person check. Carriers offer this under various names. It is the single most direct protection available and it is usually free.
What should replace SMS?
A hardware security key where the service supports one, and an authenticator application where it does not. Both bind the second factor to something you physically hold rather than to a number that a carrier can reassign.
Read next
- Two-Factor Authentication for Crypto: Ranking Factors Rank factors by what defeats an attacker: hardware key, then authenticator app, then SMS a long way behind. And where 2FA does nothing at all.
- How Crypto Phishing Works: Attack Vectors and Defenses Learn how crypto phishing attacks operate, from fake wallet sites to malicious airdrops, and how to protect your keys and signatures.
- Dusting Attacks: Unsolicited Funds and Tokens Dusting attacks send tiny amounts or tokens to your address. Learn how they work, why receiving is not theft, and how to respond safely.
- Liquidity Pools: How They Work Learn how liquidity pools power decentralized exchanges, how fees are earned, and the risks like impermanent loss.
- Gas Limit vs Gas Price: What Each Number Does Understand the difference between gas limit and gas price, what happens when the limit is too low, and why high estimates may signal contract issues.