SIM swapping, also called SIM hijacking, is an attack where a criminal convinces a mobile carrier, through impersonation or insider help, to transfer a victim's phone number to a SIM card the criminal holds. Calls and text messages then go to the attacker.
Why it matters
Many services use SMS for password resets or one-time codes. Once the attacker controls the number, they can receive those codes and take over email, financial or social accounts. The victim often notices only when their phone suddenly loses service. This is why security guidance rates SMS codes as weaker than app-based codes or hardware security keys.
Example
A user enables a carrier account PIN, moves important accounts from SMS codes to an authenticator app or passkey, and removes the phone number as a recovery option where possible. If a swap is attempted, the attacker receives the texts but still cannot pass the stronger second factor.
Common mistakes
- Using a phone number as the only recovery method for important accounts.
- Sharing personal details publicly that help impersonation, such as birth dates.
- Ignoring a sudden loss of signal; contact the carrier immediately.
- Assuming SMS two-factor is as strong as other methods.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.