SIM swapping attack, cellular hijacking, and unauthorized port-out recovery¶
A SIM swap attack (also known as SIM hijacking or Subscriber Identity Module reassignment) is an urgent cyberattack in which an adversary fraudulently convinces a telecommunications carrier to transfer your mobile phone number to a SIM card or embedded SIM (eSIM) in their possession. The moment cellular routing transfers to the attacker's hardware, your phone drops completely off the carrier network, entering a dead "No Service" or "SOS Only" state.
Because millions of online services, email providers, and financial institutions rely on SMS text messages for password resets and two-factor authentication (2FA), controlling your mobile phone number gives criminals the master key to your digital identity. Within minutes of a successful SIM swap, attackers systematically compromise primary email accounts, drain cryptocurrency exchanges, initiate wire transfers, and hijack social media channels.
Regaining control of your cellular line, severing attacker access to linked services, and preserving telecommunications forensic evidence requires an immediate, high-priority emergency response.
The attacker's 60-minute exfiltration timeline¶
Understanding the automated sequence executed by cybercriminals highlights why every minute of delay multiplies financial losses.
+---------------------------------------------------------------------------------+
| ATTACKER 60-MINUTE EXFILTRATION TIMELINE |
+---------------------------------------------------------------------------------+
| MINUTES 0 TO 5: CELLULAR LINE REASSIGNMENT |
| - Attacker activates the stolen phone number on a burner handset. |
| - Victim's legitimate smartphone displays "No Service" or "SOS Only". |
| - Attacker verifies receipt of incoming SMS text messages and voice calls. |
+---------------------------------------------------------------------------------+
| MINUTES 5 TO 15: PRIMARY EMAIL ACCOUNT TAKEOVER |
| - Attacker triggers "Forgot Password" on victim's primary email (e.g., Gmail, |
| Microsoft Outlook, Yahoo Mail, or Apple iCloud). |
| - Verification codes sent via SMS are intercepted directly by the attacker. |
| - Attacker changes email passwords, revokes logged-in sessions, and updates |
| recovery email addresses to lock the victim out permanently. |
+---------------------------------------------------------------------------------+
| MINUTES 15 TO 30: CRYPTOCURRENCY EXCHANGES DRAINED |
| - Cryptocurrency platforms (Coinbase, Kraken, Binance, Gemini) are prioritized |
| because blockchain transactions are mathematically irreversible once mined. |
| - Attacker resets account passwords via SMS, bypasses SMS 2FA, and transfers |
| all Bitcoin, Ethereum, and digital assets to anonymous external wallets. |
+---------------------------------------------------------------------------------+
| MINUTES 30 TO 45: FINANCIAL AND BANKING COMPROMISE |
| - Attacker accesses retail banking apps and brokerage accounts. |
| - Instant payment rails (Zelle, Venmo, Cash App) are drained to maximum daily |
| transfer limits. Fraudulent domestic and international wires are initiated. |
+---------------------------------------------------------------------------------+
| MINUTES 45 TO 60: MESSAGING AND SOCIAL MEDIA HIJACKING |
| - WhatsApp and Telegram accounts are registered on the attacker's handset, |
| enabling impersonation scams against friends, family, and colleagues. |
| - Social media handles (X, Instagram) are seized, defaced, or held for ransom. |
+---------------------------------------------------------------------------------+
Immediate emergency containment protocol: minutes 0 to 30¶
The instant your phone displays "No Service" unexpectedly, initiate this emergency triage checklist immediately.
+---------------------------------------------------------------------------------+
| IMMEDIATE CONTAINMENT PROTOCOL |
+---------------------------------------------------------------------------------+
| 1. VERIFY NETWORK STATUS VERSUS HARDWARE FAILURE |
| - Check adjacent mobile devices on the same carrier network. If other phones |
| have full signal bars and yours displays "No Service" or "SOS Only", |
| assume an active SIM swap is in progress. |
| - Connect your phone to a trusted Wi-Fi network immediately. If Wi-Fi works |
| while cellular is dead, you have been hijacked. |
+---------------------------------------------------------------------------------+
| 2. SECURE YOUR PRIMARY EMAIL ACCOUNT FROM A TRUSTED COMPUTER |
| - Open a clean desktop or laptop computer connected to Wi-Fi. |
| - Log into your primary email accounts immediately. |
| - Remove your cellular phone number from recovery options instantly. |
| - Change account passwords and terminate all active sessions and app tokens. |
| - Switch 2FA from SMS to a hardware security key (FIDO2/WebAuthn) or an |
| authenticator application (TOTP). |
+---------------------------------------------------------------------------------+
| 3. CONTACT YOUR MOBILE CARRIER'S EMERGENCY FRAUD DISPATCH |
| - Borrow a family member's phone, use a landline, or visit an official |
| corporate retail store immediately. |
| - Call your carrier's direct fraud desk: |
| - AT&T Fraud Bureau: 877-844-5584 (or 800-331-0500) |
| - Verizon Wireless Fraud: 888-483-7200 (or 800-922-0204) |
| - T-Mobile Fraud / Port Validation: 800-937-8997 |
| - EE UK Fraud: 0800 956 6000 (or dial 150) |
| - Vodafone UK: 0333 3040 191 (or dial 191) |
| - O2 UK: 0344 809 0202 (or dial 202) |
+---------------------------------------------------------------------------------+
| 4. DEMAND AN IMMEDIATE CARRIER LINE SUSPENSION |
| - Instruct the representative: "I am a victim of an unauthorized SIM swap. |
| Immediately place a total network hold on my MSISDN phone number, blacklist|
| the unauthorized SIM ICCID, and revoke all active network registrations." |
| - Demand that a verbal challenge passphrase and account lock be applied. |
+---------------------------------------------------------------------------------+
| 5. NOTIFY FINANCIAL INSTITUTIONS AND EXCHANGES |
| - Contact your primary banks, credit card providers, and investment brokers. |
| - Request an administrative security lock on online banking portals and |
| block outgoing wire transfers, ACH debits, and peer-to-peer payments. |
+---------------------------------------------------------------------------------+
Telecommunications architecture: SIM swaps versus unauthorized port-outs¶
Understanding how telecommunications networks route telephone numbers clarifies the vectors used by attackers.
+-------------------+-----------------------------+-------------------------------+
| VECTOR | INTERNAL SIM SWAP | UNAUTHORIZED PORT-OUT |
+-------------------+-----------------------------+-------------------------------+
| Scope | Same carrier network | Different carrier network |
| | (e.g., Verizon to Verizon) | (e.g., Verizon to T-Mobile) |
+-------------------+-----------------------------+-------------------------------+
| Mechanism | Re-mapping IMSI to ICCID in | Re-routing MSISDN via the |
| | carrier HLR/HSS database | NPAC (Number Portability |
| | | Administration Center) |
+-------------------+-----------------------------+-------------------------------+
| Method of Attack | Social engineering support; | Leaked account number and |
| | Bribed rogue store clerk; | Carrier Transfer PIN stolen |
| | Leaked employee credentials | via phishing or data breaches |
+-------------------+-----------------------------+-------------------------------+
| Recovery Path | In-person store visit or | Carrier Port Validation Desk |
| | phone fraud team rollback | must issue a formal port slam |
| | to new physical SIM or eSIM | reversal via NPAC inter-op |
+-------------------+-----------------------------+-------------------------------+
Telecommunication identifiers explained¶
Every mobile subscriber line relies on three fundamental identifiers:
1. MSISDN (Mobile Station International Subscriber Directory Number): Your public telephone number (e.g., +1-555-0199). It is simply an address pointer in telecommunication switching databases.
2. IMSI (International Mobile Subscriber Identity): A unique 15-digit internal number provisioned by the carrier that identifies your cellular subscription on mobile towers.
3. ICCID (Integrated Circuit Card Identifier): The unique 19- or 20-digit serial number physically engraved on the plastic SIM chip or embedded in the eSIM hardware.
In a legitimate network environment, your MSISDN points to your unique IMSI. During an unauthorized SIM swap, a retail employee or customer service representative updates the carrier's Home Location Register (HLR) or Home Subscriber Server (HSS), binding your MSISDN to the attacker's physical SIM card ICCID. The carrier's base station controllers immediately revoke cryptographic authentication with your phone, transferring all radio traffic to the attacker.
Retail store recovery protocol: in-person restoration¶
Resolving a SIM swap over the telephone can be hindered if the attacker has already changed your account PIN, security questions, and billing contact email. Visiting a brick-and-mortar retail location is often the fastest recovery path.
Retail Store Recovery Procedure:
=============================================================================
1. LOCATE AN OFFICIAL CORPORATE STORE:
- Identify an official corporate-owned retail branch rather than an
authorized third-party dealer or franchisee. Corporate store employees
possess higher internal permissions and direct escalation channels to
tier-3 network fraud specialists.
2. PRESENT GOVERNMENT-ISSUED IDENTIFICATION:
- Bring at least two forms of government identification:
- Primary: State driver's license, military ID, or national passport.
- Secondary: Physical debit card, utility bill matching billing address,
or vehicle registration document.
- Request to speak immediately with the Store Manager: "I am experiencing
an active SIM swap attack. My number was illegally ported or swapped
within the last hour. I need an emergency identity verification and a
new SIM card provisioned to my physical handset."
3. VERIFY ICCID AND DEVICE IMEI:
- Have the manager scan your phone's unique hardware IMEI number.
- Insert a brand-new physical SIM card or scan an official eSIM QR code.
- Confirm that cellular voice, SMS text, and mobile data function on your
device before stepping away from the service counter.
4. AUDIT EMPLOYEE ACTIVITY LOGS:
- Ask the store manager to inspect internal audit logs:
- What employee ID or retail store terminal executed the SIM swap?
- What timestamp did the transfer take place?
- What authentication method was accepted (e.g., bypass PIN, fake ID,
or remote web portal request)?
- Request that these details be formally added to an internal carrier
fraud investigation ticket.
=============================================================================
Prioritized digital account reclamation checklist¶
Once physical control of your telephone number is restored, systematically eliminate attacker persistence across your digital accounts in order of financial and identity criticality.
Account Reclamation Sequence:
=============================================================================
[ ] 1. PRIMARY EMAIL ACCOUNTS (GMAIL, OUTLOOK, PROTON, APPLE ICLOUD):
- Log into webmail portals from an uncompromised computer.
- Navigate to Security > Active Sessions. Click "Sign Out of All Devices".
- Check forwarding rules: Attackers frequently configure hidden email
forwarding filters that quietly forward all incoming messages to an
external email address, allowing them to monitor future password resets.
- Check deleted and trash folders for intercepted banking alerts.
- Update passwords to a 20+ character random passphrase.
- Enforce hardware security keys (FIDO2/WebAuthn).
[ ] 2. FINANCIAL INSTITUTIONS AND INVESTMENT BROKERAGES:
- Log into banking and investment portals.
- Review transaction history for pending wire transfers, ACH drafts, or
newly linked external accounts.
- Verify that the contact telephone number, mailing address, and notification
settings have not been altered.
- Revoke third-party financial aggregation access (such as Plaid or Yodlee).
[ ] 3. CRYPTOCURRENCY PLATFORMS:
- Log in and immediately check API keys: Attackers frequently generate new
API keys with withdrawal permissions to drain funds programmatically.
- Revoke all API keys immediately.
- Contact customer support to request an emergency security freeze on
withdrawals while account auditing is completed.
[ ] 4. MESSAGING PLATFORMS (WHATSAPP, TELEGRAM, SIGNAL):
- Open WhatsApp: Re-register your phone number on your device. The attacker
will be automatically logged out. Enable Two-Step Verification with a
six-digit PIN.
- Open Telegram: Navigate to Settings > Devices. Terminate all other sessions.
Enable 2-Step Verification password.
- Open Signal: Verify your account and ensure Registration Lock is active.
[ ] 5. SOCIAL MEDIA AND PROFESSIONAL PLATFORMS:
- Reclaim Apple ID, Google Account, LinkedIn, X, and Instagram.
- Revoke OAuth application permissions granted during the breach.
=============================================================================
Long-term carrier hardening protocols¶
Preventing repeat SIM swapping requires establishing multiple defense layers at the telecommunications carrier level.
+---------------------------------------------------------------------------------+
| CARRIER HARDENING SPECIFICATIONS |
+---------------------------------------------------------------------------------+
| 1. CARRIER PORT FREEZE / TRANSFER LOCK |
| - Request that your carrier apply an explicit "Port Out Freeze" or |
| "Number Transfer Lock" to every line on your account. |
| - Once locked, no carrier employee or automated system can transfer your |
| number to another telecommunications provider without you logging into |
| the carrier app using biometrics to explicitly unlock the line. |
+---------------------------------------------------------------------------------+
| 2. VERBAL ACCOUNT PASSPHRASE |
| - Establish a custom verbal passphrase (distinct from your numeric PIN) |
| that customer service representatives must request before opening your |
| account file. |
| - Avoid common passphrases, pet names, or mothers maiden names that appear |
| in commercial data breach leaks or public genealogical records. |
+---------------------------------------------------------------------------------+
| 3. REMOVE SMS AS A TWO-FACTOR AUTHENTICATION METHOD |
| - Eliminate SMS text message verification on all critical online platforms. |
| - Upgrade to hardware security keys (YubiKey 5 Series, Google Titan) for |
| unphishable FIDO2 / WebAuthn cryptographic protection. |
| - Utilize software authenticator applications (2FAS, Aegis, Google |
| Authenticator, or Microsoft Authenticator) for secondary accounts. |
+---------------------------------------------------------------------------------+
| 4. DECOUPLE PUBLIC CONTACT NUMBERS FROM FINANCIAL ACCOUNTS |
| - Never publish the mobile number linked to your financial institutions on |
| social media, business cards, domain registration records, or public sites.|
| - Consider using a dedicated VoIP number (e.g., Google Voice secured with a |
| hardware key) for public communication while keeping your carrier line |
| strictly private. |
+---------------------------------------------------------------------------------+
Regulatory frameworks, criminal statutes, and evidence preservation¶
SIM swapping is a federal crime in the United States and heavily prosecuted internationally. Telecommunications carriers operate under strict statutory obligations to protect customer data.
Legal and Regulatory Remedies:
=============================================================================
1. FEDERAL COMMUNICATIONS COMMISSION (FCC) SIM SWAP RULES:
- Under FCC Docket No. 21-341, mobile carriers are legally required to:
- Implement secure methods of authenticating customers before
redirecting a phone number to a new device or carrier.
- Immediately notify customers via text, email, or push notification
whenever a SIM change or port-out request is initiated.
- Maintain strict Customer Proprietary Network Information (CPNI)
security safeguards.
- If a carrier allowed an unauthorized SIM swap by failing to follow its
own security protocols, file a formal complaint with the FCC at
consumercomplaints.fcc.gov.
2. CRIMINAL STATUTES AND LAW ENFORCEMENT REPORTING:
- Federal Violations: SIM swapping is prosecuted under 18 U.S.C. Section 1028
(Fraud in Connection with Identification Documents), 18 U.S.C. Section 1030
(Computer Fraud and Abuse Act), and 18 U.S.C. Section 1343 (Wire Fraud).
- Report the incident to the FBI Internet Crime Complaint Center at ic3.gov.
Specify: "SIM Swap / Unauthorized Port-Out / Wire Fraud".
- File a police report with your local municipal police department. Provide:
- Carrier ticket and case numbers.
- Timestamp of cellular line termination.
- Details of intercepted bank transactions, wire transfers, and losses.
- Physical evidence of compromised devices.
3. CARRIER DATA RETENTION SUBPOENA PRESERVATION:
- Telecommunications carriers preserve Call Detail Records (CDR), Cell
Site Location Information (CSLI), and internal agent employee logs for
limited time windows (often 30 to 90 days).
- Request that the investigating police detective or FBI agent issue an
emergency 18 U.S.C. Section 2703(f) Preservation Letter to the carrier.
This legally mandates that the carrier freeze and preserve:
- The IMEI and IMSI of the unauthorized recipient handset.
- IP addresses used to submit web-based transfer requests.
- Retail store surveillance video and employee ID badges associated
with the unauthorized transaction.
=============================================================================