Quick answer: what is a SIM-swap attack?
SIM swap attacks happen when a criminal tricks or compromises a mobile provider into transferring your phone number to a SIM they control. Once they receive your calls and SMS messages, they may be able to intercept verification codes and target email, exchange and other high-value accounts.
A SIM-swap attack is a form of account takeover where a criminal manages to move your mobile number onto a SIM or eSIM they control. Once the number is transferred, calls and text messages intended for you can reach the attacker instead.
That matters because many online accounts still use SMS codes for password resets or two-factor authentication. If a crypto exchange, email account or other important service relies heavily on your phone number, control of that number can help an attacker bypass part of the account-recovery process.
A SIM swap does not automatically reveal a self-custody wallet’s private key or seed phrase. The danger is strongest around accounts that use your mobile number for authentication, recovery or identity checks.
On this page
How Do SIM Swap Attacks Work?
The UK’s National Cyber Security Centre explains that SIM-swap attacks commonly involve social engineering: an attacker convinces a mobile provider to transfer a genuine customer’s number to another SIM. The attacker can then receive SMS messages and calls sent to that number.
To make the impersonation convincing, criminals may collect personal information from data breaches, phishing, social media, previous scams or stolen documents. They may already know your name, address, date of birth or account details before contacting the network provider.
The goal is often not the phone number itself. The number is a stepping stone to higher-value accounts.
Why crypto users can be attractive targets
Crypto users sometimes discuss holdings, successful trades or exchange activity publicly. That can tell an attacker that an account may be worth targeting.
A phone number takeover can be useful to a criminal if it helps them access:
- centralised crypto exchanges;
- email accounts used for password resets;
- social-media accounts used for impersonation;
- cloud storage containing sensitive information;
- banking or payment accounts;
- messaging accounts used to contact friends or colleagues.
This is why protecting the email account attached to an exchange is just as important as protecting the exchange login itself.
One reason SIM swap attacks are particularly dangerous in crypto is that many exchange accounts still use SMS-based verification.
SIM swapping and self-custody wallets
A standard self-custody wallet does not normally depend on your mobile carrier to approve blockchain transactions. If your recovery phrase and private keys remain secret, a SIM swap alone should not give the attacker direct control of those keys.
However, indirect risks remain. If you stored a recovery phrase in a cloud account that can be reset through SMS, or if the attacker takes over an email account containing sensitive wallet information, the phone-number attack can become part of a larger compromise.
For this reason, never use SMS authentication as the only protection around information that can restore a high-value wallet.
Why SMS two-factor authentication is weaker
Two-factor authentication is much better than using only a password, but not every second factor offers the same protection.
The NCSC’s 2-step verification guidance says text-message codes still provide a major advantage over having no 2SV, but also notes that SMS is not the most secure type of second factor. Authenticator apps do not rely on the mobile network to deliver the code.
Where a high-value account offers stronger choices such as passkeys, hardware security keys or app-based authentication, consider using those instead of SMS.
You can reduce your exposure to SIM swap attacks by moving important accounts away from SMS authentication where stronger alternatives are available.
Use passkeys where available
The NCSC currently recommends passkeys over passwords where services support them. Passkeys are resistant to phishing because the credential is tied to the legitimate website or application rather than being a reusable code that can be typed into a fake page.
Not every crypto exchange or platform supports passkeys yet, so you still need a layered approach. If passkeys are unavailable, use a strong unique password and the strongest non-SMS second factor the service reasonably supports.
Protect the email account first
Your email address is often the recovery hub for everything else. An attacker who controls your email may be able to reset passwords, approve new-device logins and hide security alerts.
For the email attached to crypto accounts:
- use a unique password that is not reused elsewhere;
- enable app-based 2FA, a security key or passkey where available;
- store backup codes securely;
- review recovery phone numbers and backup email addresses;
- remove old devices and sessions you no longer recognise.
If you suspect you are being targeted by SIM swap attacks, contact your mobile provider and secure your email and exchange accounts immediately.
Ask your mobile provider about account protection
Mobile networks offer different security controls. Depending on the provider, you may be able to add an account PIN, password, porting protection or extra verification before a replacement SIM or number transfer is authorised.
Do not rely on a particular feature name because carrier systems differ. Contact your provider through its official support channel and ask what protection is available against unauthorised SIM replacement or number porting.
Keep personal information private
SIM-swap attacks often depend on impersonation. The more personal information an attacker can collect, the easier it may be to answer security questions or sound convincing to a support agent.
Consider how much you publicly reveal about:
- your phone number;
- date of birth;
- home address;
- mobile provider;
- crypto holdings;
- exchange accounts;
- screenshots containing email addresses or balances.
You do not need to disappear from the internet, but avoid publishing information that serves no purpose and can help identity-based attacks.
Warning signs of a possible SIM swap
A sudden loss of mobile service can have innocent causes, but it deserves attention if it happens unexpectedly.
Possible warning signs include:
- your phone suddenly shows no service while other people nearby have signal;
- calls and texts stop working without explanation;
- you receive an unexpected message about a SIM replacement, eSIM activation or number transfer;
- password-reset emails arrive that you did not request;
- you are logged out of email, exchange or social accounts;
- security settings change without your action.
What to do if your phone suddenly loses service
- Contact the mobile provider immediately using a trusted number or official app/site and ask whether a SIM change or port has occurred.
- Secure your primary email account from a trusted device. Change the password if necessary and review active sessions.
- Check crypto exchanges and financial accounts for login alerts, withdrawals or changed security settings.
- Remove SMS as the recovery factor from important services where a stronger alternative is available.
- Freeze or restrict withdrawals using the service’s official emergency controls if suspicious activity appears.
- Document what happened so you can report the incident and provide a timeline to providers.
If funds or accounts have already been compromised, follow the incident-response steps in our compromised-wallet guide and contact the relevant exchange or financial provider directly.
Do not approve unexpected login requests
An attacker may combine a SIM swap with password-reset attempts, phishing calls or push-notification spam. Do not approve an authenticator prompt simply because it keeps appearing.
Unexpected MFA requests are themselves a warning sign. Open the service from a trusted bookmark and review the account rather than following a link in the message.
Separate trading accounts from public identity
People who create crypto content or trade publicly may benefit from keeping high-value account details separate from the phone number and email addresses they share publicly.
This does not make an account anonymous or impossible to target, but it reduces the amount of direct information available to opportunistic attackers.
SIM-swap protection checklist
- I use unique passwords for email and exchange accounts.
- I use passkeys, security keys or authenticator apps where available.
- I do not rely on SMS as the only protection for high-value accounts.
- I have secure backup codes for important 2FA systems.
- I have asked my mobile provider about account PINs or porting protection.
- I keep unnecessary personal and crypto-account information off public profiles.
- I would treat unexplained loss of mobile service as a security event.
- I know how to contact my exchange and email provider from official channels.
Frequently asked questions
Can a SIM swap steal a hardware wallet?
Not directly. A hardware wallet’s private keys are not stored on the mobile network. The risk comes if the attacker gains access to related online accounts or recovery information stored elsewhere.
Is SMS 2FA useless?
No. The NCSC says SMS 2SV is still much better than using no second factor. It is simply weaker than options that do not depend on control of your phone number.
What is the best 2FA for crypto exchanges?
Use the strongest option the exchange supports. Passkeys and hardware security keys offer strong phishing resistance; authenticator apps are generally preferable to SMS when those stronger methods are unavailable.
Will a carrier PIN stop every SIM swap?
No single control guarantees protection, and carrier procedures vary. A PIN or porting lock can add friction, but account security should also cover your email, passwords and authentication methods.
Should I change my phone number after an attack?
That depends on the circumstances and your provider’s advice. The immediate priority is regaining control, securing linked accounts and removing the weakness that allowed the takeover.
Official resources
- NCSC — SIM-swap and SMS security guidance
- NCSC — Setting up 2-step verification
- NCSC — Passkeys: what you need to know
Final thoughts
SIM swapping is not a blockchain exploit. It is an identity and account-recovery attack that becomes dangerous when high-value services trust the phone number too much.
Use layered account security: strong unique passwords, phishing-resistant authentication where available, a protected email account and mobile-provider safeguards. For the rest of your crypto security setup, see our Crypto Security Guide and crypto scam and phishing guide.
This article is educational. Authentication options and carrier protections vary by provider, so check the latest official instructions for your accounts.
Related Crypto Security Guides
Continue through the Simply Blockchain security library with the guides most relevant to this topic.
