# SIM swapping

> A scam where someone takes over your phone number to receive your security codes.

- Level: Basic
- Topics: Security, Networks
- URL: https://tidbit.legios.com.ar/sim-swapping/
- In Spanish: [SIM swapping](https://tidbit.legios.com.ar/es/sim-swapping/)

In **SIM swapping**, a criminal convinces your mobile carrier to move your phone number to a SIM card or eSIM they control. They call or visit a store pretending to be you, with personal data gathered from a data breach, social media or social engineering, and say they lost their phone. Sometimes they simply bribe an employee.

The moment the swap goes through, your phone loses signal and their phone starts receiving your calls and text messages. That includes the codes banks, email and crypto exchanges send by SMS to reset a password or confirm a login. With your number in hand, they can lock you out of your accounts within minutes.

The warning sign is sudden: no service where you normally have it. Call your carrier from another phone right away. To protect yourself, ask your carrier for a PIN or extra check before any SIM change, and where possible use an authenticator app or passkeys instead of SMS codes for 2FA.

## An analogy

Like someone persuading the post office that they are you and getting all your mail forwarded to their address. Your letters keep arriving, just not to you, and among them are the keys to everything.

## Keep in mind

- The attacker moves your number to their SIM by fooling or bribing the carrier.
- They then receive your SMS codes and can reset your passwords.
- Sudden loss of signal is the main warning sign.
- Prefer authenticator apps or passkeys to SMS for 2FA, and add a carrier PIN.

## Go deeper

- [SIM swap scam on Wikipedia](https://en.wikipedia.org/wiki/SIM_swap_scam)

## Related terms

- [SIM card](https://tidbit.legios.com.ar/sim-card/): The small chip card that tells the mobile network which line is yours.
- [eSIM](https://tidbit.legios.com.ar/esim/): A SIM card built into the phone, which you load by download instead of by hand.
- [Personal data and GDPR](https://tidbit.legios.com.ar/personal-data-and-gdpr/): Information about you, and the laws that say who can use it and how.
- [Data breach](https://tidbit.legios.com.ar/data-breach/): When private data an organization holds ends up with people who should not have it.
- [Social engineering](https://tidbit.legios.com.ar/social-engineering/): Manipulating people, instead of machines, into giving away access or information.
- [Passkeys](https://tidbit.legios.com.ar/passkeys/): A way to sign in without a password, using your phone's or computer's lock instead.
- [Two-factor authentication](https://tidbit.legios.com.ar/two-factor-authentication/): A second proof that you are you, so a stolen password alone is not enough.