A SIM swap attack is one of the most frightening threats in crypto, because it does not require hacking your wallet at all: the attacker convinces your mobile carrier to transfer your phone number to a SIM card they control, and then uses that number to reset passwords and receive SMS verification codes. Within minutes, they can be inside your email, your exchange account and any service that uses SMS for two-factor authentication. Victims often discover the attack only when their own phone suddenly loses signal. The good news is that SIM swaps are largely preventable, if you remove SMS from your security chain and harden your carrier account.

A SIM swap usually starts with social engineering: the attacker gathers personal details about you from data breaches, social media or phishing, then calls your carrier pretending to be you, claims to have lost a phone, and asks to activate a new SIM. Some attackers bribe carrier employees, while others exploit weak identity checks, such as answering security questions with information that is publicly available. Once the swap succeeds, your phone loses service, the attacker's phone receives your calls and texts, and they can request password resets for email and exchange accounts that send codes by SMS. The attack is fast because carriers are designed to help customers who lose phones quickly, which is exactly the process attackers abuse.

SMS was never designed as a secure authentication method: texts can be intercepted, redirected by a SIM swap, or read if a phone is compromised, and they offer no protection against an attacker who controls your number. That is why security experts recommend moving away from SMS 2FA for any account that holds money or can reset other accounts, especially email and crypto exchanges. App-based authenticators, which generate codes on your device without using your phone number, are not affected by a SIM swap, and hardware security keys, which require a physical device to log in, are stronger still. SMS 2FA is better than no 2FA at all, but for crypto accounts, it should be treated as a temporary step, not a final solution.

Start with your email account, because email is the master key to password resets for almost everything else: switch it to an authenticator app or a hardware key, and remove SMS as a recovery method if the service allows it. Next, do the same for every exchange, wallet service and financial account, choosing authenticator app or hardware key in the settings, and store backup codes offline in a safe place. Then contact your mobile carrier and ask for every protection they offer: a port-out PIN or transfer PIN, a SIM-change lock, a verbal password for account changes, and a note requiring in-store photo ID for SIM changes. Finally, consider using a separate phone number or a Google Voice-style number for non-critical accounts, so your main number is less exposed.

Carrier protections vary by country and provider, so call your carrier and ask specifically what SIM-swap protections exist, rather than assuming they are on by default. Set a strong, unique PIN for your carrier account, do not reuse your email password for it, and remove personal details such as your birthday, hometown and pet names from public social media, because those are common security-question answers. Plan for recovery before you need it: write down backup codes, keep a hardware key in a safe place, and know how to contact your carrier and exchanges quickly if your phone loses signal unexpectedly. If you suspect a SIM swap, contact your carrier immediately from another phone, and then secure your email and exchange accounts before the attacker can move funds.

If your phone suddenly shows no service and you did not change SIMs, treat it as an emergency: use another phone or computer to contact your carrier and reverse the swap, change your email password, and check exchange accounts for unauthorised withdrawals or new withdrawal addresses. If funds were moved, contact the exchange's security team immediately, freeze the account if possible, and preserve transaction hashes and timestamps for law enforcement. After an attack, switch all accounts to hardware keys or authenticator apps, change passwords, and consider changing your phone number if the carrier cannot guarantee protection. A SIM swap is distressing, but quick action can limit damage, especially if most of your funds are in a hardware wallet that does not rely on SMS at all.

This is educational content, not financial advice, and you should never share a seed phrase with anyone, for any reason.