SIM Swapping and How to Protect Yourself

In a SIM swap, a scammer talks your mobile carrier into moving your phone number to a SIM card or eSIM in their possession. From then on, your text messages and calls go to them. With the SMS codes they reset the passwords of your email and exchange account and send your bitcoin away. You protect yourself by making sure your accounts no longer depend on your phone number and your savings don't sit on an exchange in the first place.

How a SIM swap works

Your phone number doesn't belong to your SIM card, it belongs to your contract. The carrier can move it to a new card at any time. That is handy when you lose your phone. It is exactly this feature the attacker uses.

A typical attack has four steps:

1. Collecting data. The attacker looks up your name, address, date of birth and number. Much of this is in data leaks, on social networks or in a website's legal notice. If the customer list of an exchange or wallet maker has leaked, they also know you own bitcoin.
2. Fooling the carrier. They call the hotline, write in the chat or walk into a shop. They pose as you: phone lost, please activate a new SIM or eSIM. Sometimes they bribe an employee instead. Or they request to port your number to another carrier.
3. Taking over the number. Your card loses its signal. Their card gets your number, your texts and your calls.
4. Resetting accounts. They click "Forgot password" at your email provider and have the code sent by SMS. With the email they reset your exchange account, which often also asks only for an SMS code as the second factor. Then they withdraw the bitcoin to their own address.

Steps 3 and 4 are often only minutes apart. The attackers work at night or at weekends, when you are asleep and the hotline is hard to reach.

SIM swapping is not a theory. The FBI reported 1’611 complaints in the US for 2021, with losses of more than 68 million US dollars, far more than in the three years before combined. Well-known cases hit the Twitter account of Twitter founder Jack Dorsey in 2019 and the X account of the US Securities and Exchange Commission (SEC) in January 2024, which was used to post a false message about bitcoin ETFs. Police and authorities in Germany, Austria and Switzerland warn about the scheme as well.

Why bitcoin holders are popular targets

A SIM swap costs the attacker time and risk. It only pays off if there is something to take afterwards. Bitcoin holders are ideal for that:

• Final. A bank transfer can sometimes be stopped. A bitcoin transaction cannot.
• Fast. A withdrawal from an exchange takes minutes, not days.
• Easy to find. Anyone who talks about bitcoin on social media or appears in a leaked customer list gives themselves away.
• Everything on one number. Many people tie email, exchange, bank and messenger to the same phone number, often with SMS as the only second factor.

SIM swapping is a form of social engineering: what gets fooled is not the technology but a person at the hotline. How these deceptions work in general and how to spot them on yourself is explained in Social engineering: the biggest danger for holders.

Warning signs: how you notice a SIM swap

The most important sign is easy to miss: your phone suddenly has no signal or shows "Emergency calls only", even though you are somewhere with good reception and other phones work.

Other warning signs:

• You get a text or email from your carrier saying a new SIM, an eSIM or a number port has been requested.
• You can no longer get into your email inbox, although you haven't changed the password.
• You receive emails about password resets, new logins or new withdrawal addresses that you didn't trigger.
• Someone calls and asks for a code "you just received by text". That is an attacker who needs your code before the takeover is complete.

Protection step 1: get rid of SMS as a second factor

Two-factor authentication means: on top of your password comes a second proof that it is you. Which second factor that is makes all the difference. SMS is the weakest, because it depends on your number and not on a device you hold in your hand.

An authenticator app such as Google Authenticator, Microsoft Authenticator, Aegis or 2FAS creates a new six-digit code every 30 seconds. The secret behind it is stored on your device, not with your carrier. A SIM swap changes nothing about it.

A security key is a small USB or NFC stick, such as a YubiKey. A passkey works on the same standard (FIDO2) but lives on your phone or computer. Both are also bound to the real website. On a fake login page they simply don't work. That is the best protection available for accounts today.

Here is how to go about it:

1. List your accounts. Email first, then exchanges, bank, password manager, Apple or Google account, messengers.
2. Set up an authenticator app or security key everywhere. For important accounts, ideally two security keys, one of them as a spare in a different place.
3. Remove your phone number as a recovery route. Many services keep SMS active as a "backup" even after you set up the app. Then the gap stays open. Delete the number wherever you can.
4. Back up the recovery codes. Almost every service gives you a few one-time codes during setup. Write them on paper and keep them with your important documents.

Protection step 2: your email is your master key

Almost every account can be reset by email. Whoever has your inbox has all your other accounts. So it deserves the strongest protection:

• A long, unique password from a password manager.
• A security key or passkey as the second factor, otherwise an authenticator app.
• No phone number for recovery. Check in your account settings which phone number and which backup address are on file.
• A separate address for money accounts. An email address used only for exchange and bank, published nowhere, is harder to guess and shows up less often in data leaks.

Protection step 3: secure your mobile carrier account

You can't control how carefully your carrier's hotline checks callers. But you can make it harder for the attacker.

• Set a customer password or service PIN. Many carriers in Germany, Austria and Switzerland offer a password that is asked for on calls, in the shop or for a SIM change. What it is called and where you set it differs by carrier. Ask directly, in the customer portal or at the hotline, whether there is one and whether it also applies to SIM replacement.
• Secure your online customer account. Your carrier's customer portal needs its own strong password and, if possible, an authenticator app. With some carriers, an eSIM can be ordered directly through this portal.
• Don't give out your number. Your main number is probably already on many lists. Don't add it in bitcoin groups, forums or prize draws.

A second, unlisted number for money accounts

Some services insist on a phone number. A second number works well for that, for example a cheap prepaid card that you use only for exchange and bank. Nobody knows it, it is in no profile and no email signature. An attacker can't take over a number they don't know exists.

Note: in Germany, Austria and Switzerland, prepaid cards must be registered with an ID, and they can expire if you don't use or top them up for a long time. Keep it active. The second number doesn't replace an authenticator app; it is an extra hurdle.

Protection step 4: put your bitcoin where no SIM swap can reach

All the steps so far protect accounts. The strongest protection is that nothing valuable sits in those accounts at all.

Bitcoin on an exchange belong, legally and technically, to the exchange for the time being. You only have a claim, and anyone who logs into your account can exercise it. Bitcoin in your own wallet, on the other hand, can only be moved by whoever has your private key. It lives on your hardware wallet and your seed backup, not on your phone number.

In practice, this means:

• Withdraw regularly. If you buy through a savings plan, send the bitcoin to your own wallet at fixed intervals. Only what you just bought sits on the exchange.
• Lock the withdrawal address. Many exchanges let you keep a list of allowed withdrawal addresses. New addresses only become active after a waiting period. If only your own wallet is on the list, an attacker loses time that you can use to freeze the account.
• Use automatic withdrawal. Some savings plan providers send every purchase straight to your own address. Then the money never sits on the exchange at all.

How to set up your first own wallet is shown in Setting up a bitcoin wallet. Why an exchange is a risk not only because of hackers but also because of insolvency is explained in Crypto exchange bankrupt: what Mt. Gox to FTX teach you.

What to do if it happens

In a SIM swap, every minute counts. Work through this list in order:

1. Call your carrier. From another phone or over Wi-Fi. Say clearly: "My number was moved to another SIM without my consent. Please block it immediately and return it to me." Ask for a customer password for the future.
2. Get your email back. From a clean device: change the password, sign out unknown devices, check the phone number and backup address, check forwarding rules. Attackers like to set up forwarding so they can keep reading along.
3. Have your exchanges frozen. Contact the support of every exchange where you have an account, via the official website. Ask them to freeze withdrawals. Many exchanges have an emergency lock you can trigger yourself.
4. Renew passwords and second factors. On every account that depended on the number or the email. Replace SMS with an app or a security key.
5. Move your bitcoin to safety. If anything is still on an exchange, withdraw it to your own wallet as soon as you have access again.
6. Report it to the police. In Germany you can also use your federal state's online police station. Write down times, transaction IDs and destination addresses. You will also need the report when dealing with your carrier and exchange.

Be suspicious of anyone who then offers to recover your bitcoin for a fee. That is almost always the next scam. More on this in Recognising bitcoin scams.