Your Phone Number Is a Master Key: The Rise of SIM Swap Fraud in America

In August 2019, a 20-year-old college student named Joel Ortiz was sentenced to ten years in federal prison — the longest sentence ever handed down for a SIM swapping offense at the time. Ortiz and his associates had hijacked the phone numbers of more than 40 victims, stealing approximately $7.5 million in cryptocurrency in the process. The mechanics of his attacks were not technically sophisticated. They were, in many respects, shockingly simple.

Ortiz called mobile carriers, impersonated his victims using personal information harvested from social media and data broker websites, and persuaded customer service representatives to transfer the target's phone number to a SIM card he controlled. Once that transfer was complete, every text message sent to the victim's number — including the one-time passcodes generated by SMS-based two-factor authentication — arrived on Ortiz's device instead. Account after account fell within minutes.

SIM swapping has since grown from a niche threat targeting cryptocurrency holders into a broad-based fraud technique affecting ordinary Americans. The FBI's Internet Crime Complaint Center received 2,026 SIM swapping complaints in 2023, reporting losses of more than $48 million — a figure that almost certainly understates actual losses due to chronic underreporting.

How Carriers Become Accomplices — Without Knowing It

Understanding SIM swap fraud requires understanding how mobile carriers handle the legitimate version of the same process. When a customer loses their phone, upgrades their device, or switches carriers, they need their existing phone number transferred to a new SIM card. This is a routine transaction that carriers complete thousands of times each day.

To verify a customer's identity before completing the transfer, carriers rely on authentication methods that vary by company and have historically been inconsistent. Common verification approaches include asking for the last four digits of a Social Security number, a billing address, an account PIN, or the answer to a security question. Each of these data points is individually vulnerable — SSN fragments appear in data breaches, billing addresses are semi-public, and security question answers are frequently guessable from social media profiles.

Attackers invest time in what security researchers call "pre-texting" — constructing a believable narrative before placing the call. They may claim to be traveling internationally with a damaged phone, creating urgency that pressures customer service representatives to expedite the transfer. They may call multiple times, hanging up when a skeptical representative answers, until they reach someone more accommodating. In documented cases, attackers have also bribed carrier employees directly; a 2022 T-Mobile data breach investigation revealed that internal access had been exploited to facilitate SIM swaps.

The FCC took formal action in 2023, adopting new rules requiring carriers to implement more robust authentication before processing SIM transfers and number ports, and mandating that customers be notified immediately when such a change is initiated. While meaningful, these rules represent a floor, not a ceiling, and implementation has been uneven across the industry.

Why SMS Two-Factor Authentication Creates a False Sense of Security

Two-factor authentication — the practice of requiring both a password and a second verification step to log into an account — is one of the most important security habits a user can develop. But not all second factors are equal, and the most widely used form, the SMS text message code, is structurally compromised by SIM swapping.

When you enable SMS-based 2FA on a bank account, email inbox, or social media profile, you are effectively designating your phone number as a master key to that account. Any attacker who gains control of your phone number gains control of every account secured with it. The password you spent months memorizing becomes irrelevant.

This is not a theoretical vulnerability. In 2020, Twitter's own internal systems were compromised in a high-profile attack that targeted celebrity and corporate accounts. While that particular breach involved insider access rather than SIM swapping, the incident underscored how thoroughly phone numbers had become embedded in the authentication infrastructure of the modern internet. Numerous victims of SIM swap attacks have reported losing access to email, banking, investment, and cryptocurrency accounts in rapid succession — a cascade that unfolds in the time it takes an attacker to work through a list.

The security community has advocated for years for a transition away from SMS-based 2FA toward more robust alternatives. Authenticator applications — such as Google Authenticator, Authy, or Microsoft Authenticator — generate time-based one-time passcodes locally on a device, without any carrier involvement. They are immune to SIM swapping because they do not rely on your phone number. Hardware security keys, such as those manufactured by Yubico, provide an even stronger guarantee by requiring physical possession of the key to authenticate.

High-Profile Cases That Shaped the Threat Landscape

The victims of SIM swapping span a remarkable range of profiles, which illustrates the indiscriminate nature of the attack.

Michael Terpin, a cryptocurrency investor and entrepreneur, lost approximately $24 million in a 2018 SIM swap attack and subsequently filed a $224 million lawsuit against AT&T, alleging that the carrier's negligence enabled the theft. The case drew significant attention to carrier liability and resulted in a partial judgment in Terpin's favor on certain claims.

In 2021, the Department of Justice charged members of a group known as "The Community" with SIM swapping attacks targeting more than 50 victims across the United States, resulting in the theft of millions of dollars in cryptocurrency. The investigation involved coordination between the FBI, Secret Service, and Homeland Security Investigations — a sign of how seriously federal law enforcement has come to regard the threat.

Even security professionals are not immune. Several prominent researchers and executives in the cybersecurity industry have publicly disclosed being targeted by SIM swap attempts, reinforcing the point that technical knowledge alone is insufficient protection if the underlying carrier infrastructure remains exploitable.

Concrete Steps to Protect Yourself Right Now

The good news is that SIM swapping is a highly preventable attack. The following measures, taken together, substantially reduce your exposure.

Contact your mobile carrier and set a port freeze or SIM lock. Most major US carriers — AT&T, Verizon, T-Mobile — offer some form of additional account security that requires in-store verification with a government-issued ID before a SIM transfer can be processed. This is sometimes called a "number lock" or "port protection." Call your carrier's customer service line and ask specifically what options are available.

Set a unique, strong account PIN with your carrier — one that is not derived from your birthday, address, or any other publicly available information. Do not reuse this PIN anywhere else.

Migrate away from SMS-based 2FA wherever possible. Audit every account that uses text message verification and switch to an authenticator app or hardware key. Prioritize your email account, financial accounts, and any platform that holds cryptocurrency or payment information.

Minimize your digital footprint. The personal information attackers use to impersonate you — your SSN fragment, address history, family members' names — is often available through data broker websites. Services such as DeleteMe or Privacy Bee can assist in removing this information from major broker databases.

Monitor your phone service for unexpected outages. If your phone abruptly loses service and cannot make or receive calls, contact your carrier immediately from a different device. A sudden loss of signal can be an early indicator that a SIM swap is in progress.

Your phone number was never designed to serve as a universal identity credential. Treating it as one — without additional safeguards — is an invitation to exactly the kind of attack that has cost Americans tens of millions of dollars and counting.