A SIM-Swap (also called SIM swapping, SIM hijacking, or a port-out scam) is an account takeover attack where a criminal fraudulently moves a victim’s phone number onto a SIM card they control. Once the number is redirected, the attacker can receive calls and text messages intended for the victim, including one-time passwords and two-factor authentication (2FA) codes.
How a SIM-Swap attack works
In many cases, attackers gather personal information through phishing, data breaches, or social engineering, then contact a mobile carrier and pose as the victim. They may claim they lost their phone, need a replacement SIM, or want to “port” the number to a new device. If the carrier’s identity checks are bypassed, the victim’s service often goes dead or shows “no signal” while the attacker’s device starts receiving SMS messages.
This matters because phone numbers are widely used as a recovery channel. Even if an attacker does not know your password at first, control of your number can help them reset passwords, approve logins, and pass SMS-based 2FA prompts.
Why SIM-Swaps are dangerous for crypto
Crypto users are frequent targets because access can be irreversible once funds are moved. If an exchange account uses SMS for 2FA or password resets, an attacker who controls the phone number may be able to log in, reset credentials, and withdraw assets. Similarly, email accounts protected by SMS codes can become a stepping stone to crypto account recovery flows.
Common defenses
Reducing reliance on SMS-based security is key. App-based authenticators and hardware security keys are generally stronger than SMS. Many carriers also offer account PINs, port-out locks, or extra verification steps that make unauthorized SIM changes harder.
SIM-Swaps matter in the crypto ecosystem because they exploit a weak link between traditional telecom infrastructure and digital asset security, turning a phone number into a pathway for high-impact theft.