SIM Swapping.

A fraud technique in which an attacker tricks or bribes a mobile carrier into transferring a victim's phone number to a SIM the attacker controls. It belongs to the Attacks & Threats category of cybersecurity.

A fraud technique in which an attacker tricks or bribes a mobile carrier into transferring a victim's phone number to a SIM the attacker controls.

SIM swapping (also called SIM-jacking or port-out fraud) abuses carrier account-recovery and number-portability processes. Using stolen personal data and social engineering of customer-service staff, or insider help, the attacker has the victim's number ported to a new SIM. Once the number is theirs, the criminal intercepts SMS codes, voice calls, and password-reset links and rapidly takes over email, banking, and crypto-wallet accounts. Mitigations include moving off SMS-based MFA toward FIDO2 keys, passkeys, or authenticator apps; setting a carrier PIN or port-out lock; using non-public recovery emails; and monitoring for sudden loss of cellular service, which is often the first sign of an attack.

Defences for SIM Swapping typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: SIM-jacking, Port-out fraud, SIM hijacking.