SIM swapping attack, cellular hijacking, and unauthorized port-out recovery

A SIM swap attack (also known as SIM hijacking or Subscriber Identity Module reassignment) is an urgent cyberattack in which an adversary fraudulently convinces a telecommunications carrier to transfer your mobile phone number to a SIM card or embedded SIM (eSIM) in their possession. The moment cellular routing transfers to the attacker's hardware, your phone drops completely off the carrier network, entering a dead "No Service" or "SOS Only" state.

Because millions of online services, email providers, and financial institutions rely on SMS text messages for password resets and two-factor authentication (2FA), controlling your mobile phone number gives criminals the master key to your digital identity. Within minutes of a successful SIM swap, attackers systematically compromise primary email accounts, drain cryptocurrency exchanges, initiate wire transfers, and hijack social media channels.

Regaining control of your cellular line, severing attacker access to linked services, and preserving telecommunications forensic evidence requires an immediate, high-priority emergency response.

The attacker's 60-minute exfiltration timeline

Understanding the automated sequence executed by cybercriminals highlights why every minute of delay multiplies financial losses.

flowchart TD
    Step1["<b>| - Attacker triggers &quot;Forgot Password&quot; on victim's primary email (e.g., Gmail, |</b>"]
    Step2["<b>| Microsoft Outlook, Yahoo Mail, or Apple iCloud). |</b>"]
    Step3["<b>| - Cryptocurrency platforms (Coinbase, Kraken, Binance, Gemini) are prioritized |</b>"]
    Step4["<b>| - Instant payment rails (Zelle, Venmo, Cash App) are drained to maximum daily |</b>"]
    Step5["<b>| - Social media handles (X, Instagram) are seized, defaced, or held for ransom. |</b>"]
    Step1 --> Step2
    Step2 --> Step3
    Step3 --> Step4
    Step4 --> Step5

Immediate emergency containment protocol: minutes 0 to 30

The instant your phone displays "No Service" unexpectedly, initiate this emergency triage checklist immediately.

flowchart TD
    Step1["<b>| - Switch 2FA from SMS to a hardware security key (FIDO2/WebAuthn) or an |</b>"]
    Step2["<b>| authenticator application (TOTP). |</b>"]
    Step3["<b>| - AT&T Fraud Bureau</b><br/>877-844-5584 (or 800-331-0500) |"]
    Step4["<b>| - Verizon Wireless Fraud</b><br/>888-483-7200 (or 800-922-0204) |"]
    Step5["<b>| - EE UK Fraud</b><br/>0800 956 6000 (or dial 150) |"]
    Step6["<b>| - Vodafone UK</b><br/>0333 3040 191 (or dial 191) |"]
    Step7["<b>| - O2 UK</b><br/>0344 809 0202 (or dial 202) |"]
    Step1 --> Step2
    Step2 --> Step3
    Step3 --> Step4
    Step4 --> Step5
    Step5 --> Step6
    Step6 --> Step7

Telecommunications architecture: SIM swaps versus unauthorized port-outs

Understanding how telecommunications networks route telephone numbers clarifies the vectors used by attackers.

Telecommunication identifiers explained

Every mobile subscriber line relies on three fundamental identifiers: 1. MSISDN (Mobile Station International Subscriber Directory Number): Your public telephone number (e.g., +1-555-0199). It is simply an address pointer in telecommunication switching databases. 2. IMSI (International Mobile Subscriber Identity): A unique 15-digit internal number provisioned by the carrier that identifies your cellular subscription on mobile towers. 3. ICCID (Integrated Circuit Card Identifier): The unique 19- or 20-digit serial number physically engraved on the plastic SIM chip or embedded in the eSIM hardware.

In a legitimate network environment, your MSISDN points to your unique IMSI. During an unauthorized SIM swap, a retail employee or customer service representative updates the carrier's Home Location Register (HLR) or Home Subscriber Server (HSS), binding your MSISDN to the attacker's physical SIM card ICCID. The carrier's base station controllers immediately revoke cryptographic authentication with your phone, transferring all radio traffic to the attacker.

Retail store recovery protocol: in-person restoration

Resolving a SIM swap over the telephone can be hindered if the attacker has already changed your account PIN, security questions, and billing contact email. Visiting a brick-and-mortar retail location is often the fastest recovery path.

Retail Store Recovery Procedure

1. Locate An Official Corporate Store:

2. Identify an official corporate-owned retail branch rather than an authorized third-party dealer or franchisee. Corporate store employees possess higher internal permissions and direct escalation channels to tier-3 network fraud specialists.

3. Present Government-Issued Identification:

- Bring at least two forms of government identification

 - Primary: State driver's license, military ID, or national passport.
 - Secondary: Physical debit card, utility bill matching billing address,
   or vehicle registration document.

• Request to speak immediately with the Store Manager: "I am experiencing an active SIM swap attack. My number was illegally ported or swapped within the last hour. I need an emergency identity verification and a new SIM card provisioned to my physical handset."

• Verify Iccid And Device Imei:

• Have the manager scan your phone's unique hardware IMEI number.
• Insert a brand-new physical SIM card or scan an official eSIM QR code.

• Confirm that cellular voice, SMS text, and mobile data function on your device before stepping away from the service counter.

• Audit Employee Activity Logs:

- Ask the store manager to inspect internal audit logs

 - What employee ID or retail store terminal executed the SIM swap?
 - What timestamp did the transfer take place?
 - What authentication method was accepted (e.g., bypass PIN, fake ID,
   or remote web portal request)?

• Request that these details be formally added to an internal carrier fraud investigation ticket.

Prioritized digital account reclamation checklist

Once physical control of your telephone number is restored, systematically eliminate attacker persistence across your digital accounts in order of financial and identity criticality.

• [ ] 1. PRIMARY EMAIL ACCOUNTS (GMAIL, OUTLOOK, PROTON, APPLE ICLOUD):
  • Log into webmail portals from an uncompromised computer.
  • Navigate to Security > Active Sessions. Click "Sign Out of All Devices".
  • Check forwarding rules: Attackers frequently configure hidden email
  • forwarding filters that quietly forward all incoming messages to an
  • external email address, allowing them to monitor future password resets.
  • Check deleted and trash folders for intercepted banking alerts.
  • Update passwords to a 20+ character random passphrase.
  • Enforce hardware security keys (FIDO2/WebAuthn).
• [ ] 2. FINANCIAL INSTITUTIONS AND INVESTMENT BROKERAGES:
  • Log into banking and investment portals.
  • Review transaction history for pending wire transfers, ACH drafts, or
  • newly linked external accounts.
  • Verify that the contact telephone number, mailing address, and notification
  • settings have not been altered.
  • Revoke third-party financial aggregation access (such as Plaid or Yodlee).
• [ ] 3. CRYPTOCURRENCY PLATFORMS:
  • Log in and immediately check API keys: Attackers frequently generate new
  • API keys with withdrawal permissions to drain funds programmatically.
  • Revoke all API keys immediately.
  • Contact customer support to request an emergency security freeze on
  • withdrawals while account auditing is completed.
• [ ] 4. MESSAGING PLATFORMS (WHATSAPP, TELEGRAM, SIGNAL):
  • Open WhatsApp: Re-register your phone number on your device. The attacker
  • will be automatically logged out. Enable Two-Step Verification with a
  • six-digit PIN.
  • Open Telegram: Navigate to Settings > Devices. Terminate all other sessions.
  • Enable 2-Step Verification password.
  • Open Signal: Verify your account and ensure Registration Lock is active.
• [ ] 5. SOCIAL MEDIA AND PROFESSIONAL PLATFORMS:
  • Reclaim Apple ID, Google Account, LinkedIn, X, and Instagram.
  • Revoke OAuth application permissions granted during the breach.

Long-term carrier hardening protocols

Preventing repeat SIM swapping requires establishing multiple defense layers at the telecommunications carrier level.

flowchart TD
    Step1["<b>| - Establish a custom verbal passphrase (distinct from your numeric PIN) |</b>"]
    Step2["<b>| - Upgrade to hardware security keys (YubiKey 5 Series, Google Titan) for |</b>"]
    Step3["<b>| - Utilize software authenticator applications (2FAS, Aegis, Google |</b>"]
    Step4["<b>| Authenticator, or Microsoft Authenticator) for secondary accounts. |</b>"]
    Step5["<b>| - Consider using a dedicated VoIP number (e.g., Google Voice secured with a |</b>"]
    Step6["<b>| hardware key) for public communication while keeping your carrier line |</b>"]
    Step1 --> Step2
    Step2 --> Step3
    Step3 --> Step4
    Step4 --> Step5
    Step5 --> Step6

Regulatory frameworks, criminal statutes, and evidence preservation

SIM swapping is a federal crime in the United States and heavily prosecuted internationally. Telecommunications carriers operate under strict statutory obligations to protect customer data.

Legal and Regulatory Remedies

1. Federal Communications Commission (Fcc) Sim Swap Rules:
2. Under FCC Docket No. 21-341, mobile carriers are legally required to:
   • Implement secure methods of authenticating customers before redirecting a phone number to a new device or carrier.
   • Immediately notify customers via text, email, or push notification whenever a SIM change or port-out request is initiated.
   • Maintain strict Customer Proprietary Network Information (CPNI) security safeguards.

3. If a carrier allowed an unauthorized SIM swap by failing to follow its own security protocols, file a formal complaint with the FCC at consumercomplaints.fcc.gov.

4. Criminal Statutes And Law Enforcement Reporting:

5. Federal Violations: SIM swapping is prosecuted under 18 U.S.C. Section 1028 (Fraud in Connection with Identification Documents), 18 U.S.C. Section 1030 (Computer Fraud and Abuse Act), and 18 U.S.C. Section 1343 (Wire Fraud).
6. Report the incident to the FBI Internet Crime Complaint Center at ic3.gov. Specify: "SIM Swap / Unauthorized Port-Out / Wire Fraud".

7. File a police report with your local municipal police department. Provide:

   • Carrier ticket and case numbers.
   • Timestamp of cellular line termination.
   • Details of intercepted bank transactions, wire transfers, and losses.
   • Physical evidence of compromised devices.

8. Carrier Data Retention Subpoena Preservation:

9. Telecommunications carriers preserve Call Detail Records (CDR), Cell Site Location Information (CSLI), and internal agent employee logs for limited time windows (often 30 to 90 days).
10. Request that the investigating police detective or FBI agent issue an emergency 18 U.S.C. Section 2703(f) Preservation Letter to the carrier.

This legally mandates that the carrier freeze and preserve

 - The IMEI and IMSI of the unauthorized recipient handset.
 - IP addresses used to submit web-based transfer requests.
 - Retail store surveillance video and employee ID badges associated
   with the unauthorized transaction.

Related guides

• Bank account breach recovery
• Data breach response and password leaks
• MFA Phishing and Adversary-in-the-Middle bypass
• Unknown AirTag or GPS tracker detected
• Emergency identity theft recovery
• Emergency numbers by country