How SIM swap fraud works
The criminal first collects the victim's personal details from phishing, data breaches or social media. Posing as the victim, the criminal then tells the operator that the phone was lost and asks for the number on a new SIM, or ports it to another operator. Some swaps are done by a bribed employee.
The victim's phone loses service. The criminal resets passwords by text message, receives the passcodes, enrols a new device and empties the accounts, often within the hour.
How a payment or crypto product defends against it
- Authentication in the app, bound to the device's secure hardware, in place of codes by text message
- Passkeys or an authenticator app where a second factor is needed
- A SIM swap check: operators can say how recently a number changed SIM
- A waiting period after a change of phone number or device, with no new payees or withdrawals
- No account recovery by text message alone: the identity is verified again
- Alerts by email and push when contact details or devices change
Why SIM swap fraud matters to a provider
Wherever a phone number alone can recover an account or approve a payment, the operator's help desk is part of the product's security, and outside the provider's control. A text message proves control of a number, not of a device or a person.
Crypto platforms are favoured targets because a withdrawal cannot be reversed. Banks and wallets meet the same attack as account takeover, with the refund duties that follow an unauthorised payment.
SIM swap fraud or account takeover?
- Account takeover
- The result: a criminal in control of someone's account. A SIM swap is one of the routes to it.
- Port-out fraud
- The number is moved to a different operator instead of a new SIM. The effect is the same.
Where SIM swap fraud shows up in a platform
Modules that do the work
- AuthenticationSign-in, passkeys and second factors for customers and staff, on your identity provider or ours.
- Fraud & riskReal-time fraud scoring, limits and case management, with the risk engines you already trust.
- NotificationsEmail, SMS, push and in-app messages in your brand, through the providers you choose.
- Custody & walletsWallets on every major chain, with MPC custody from leading providers or your own keys.