SIM Swap Attacks: How They Work and Why a PIN Won't Save You

A SIM swap attack is when someone convinces your carrier to transfer your phone number to a SIM card they control. Once they have your number, they get your calls, your texts, and every SMS-based two-factor authentication code sent to that number. Your phone goes dead. Their phone becomes yours.

The attack doesn’t require any technical skill. It requires either a convincing story or a bribed employee. Both are shockingly easy to come by.

How it actually works

The attacker calls your carrier’s customer service line, or walks into a store, and claims to be you. They say they lost their phone, got a new one, and need to activate their number on a new SIM. The customer service rep asks some verification questions. The attacker has your name, address, and maybe the last four digits of your social, all of which are readily available from data breaches or social media.

If social engineering doesn’t work, money does. In 2024, T-Mobile and Verizon employees were caught accepting bribes to process SIM swaps. The going rate was around $300 per swap. For an attacker targeting someone with a crypto wallet tied to SMS-based 2FA, spending $300 to steal access to six or seven figures is an obvious trade.

Once the swap goes through, the attacker receives the password reset codes and 2FA tokens that get sent to your number. They log into your email. From your email, they reset passwords on your bank accounts, crypto exchanges, and anything else tied to that address. The whole chain from SIM swap to drained accounts can happen in under an hour.

Why account PINs don’t solve it

After SIM swap attacks became a public problem, the carriers responded with account PINs. You set a PIN on your account, and the rep is supposed to ask for it before making changes. This sounds reasonable but fails in practice for a few reasons.

Customer service reps are trained to help people. When someone calls upset, claiming they’re locked out and can’t remember their PIN, reps have override procedures. Social engineers know exactly how to trigger those overrides. They escalate, they get emotional, they threaten to switch carriers. Eventually someone bypasses the PIN to close the ticket.

Bribed employees don’t care about the PIN. If a store employee is already willing to process a fraudulent SIM swap for $300, the PIN is just another field they skip.

And then there are the data breaches. PINs get stored in carrier databases alongside everything else about your account. When those databases get compromised, which happens regularly, the PIN goes with them.

The fundamental problem is that PIN-based protection depends on humans making correct judgment calls every single time. One mistake by one rep at one store undoes the entire security measure. That’s not a system. That’s a hope.

Who gets targeted

Crypto holders are the most common high-value targets. The FBI reported that SIM swap-related crypto theft exceeded $68 million in 2023 alone, and that figure only counts reported cases. The actual number is certainly higher. If you hold significant crypto and your exchange accounts use SMS 2FA, you’re carrying a target that’s visible to anyone who can look up your phone number.

But crypto isn’t the only angle. Anyone who uses SMS-based two-factor authentication is vulnerable, and that includes most people. Bank accounts, email providers, social media platforms, and healthcare portals all offer or default to SMS 2FA. One successful SIM swap can cascade through your entire digital life.

Public figures, executives, and journalists are also frequent targets. If your phone number is known or discoverable, and you have something worth stealing or exposing, you’re on someone’s list.

How Cape handles SIM swaps differently

Cape’s SIM swap protection doesn’t rely on customer service reps or account PINs. It’s implemented at the network level using digital signatures. A SIM swap request has to be cryptographically authenticated, which means it can’t be approved by a person making a judgment call. The system either verifies the digital signature or it doesn’t. There’s no override, no escalation path, no bribable employee in the loop.

This is a fundamentally different approach. Traditional carriers treat SIM swaps as a customer service problem and solve it with customer service tools like PINs and security questions. Cape treats it as a cryptographic problem and solves it with cryptography. One of these approaches has been failing for years. The other removes the human element that attackers have been exploiting.

Cape’s private payment also helps here indirectly. Social engineering works best when the attacker has personal information about the target. If your carrier account isn’t tied to your real name, address, or credit card, the attacker has less ammunition for the social engineering attempt in the first place.

What you should do regardless of your carrier

Switch every account you can from SMS 2FA to app-based 2FA (like Authy or Google Authenticator) or hardware keys (like YubiKey). SMS 2FA is better than no 2FA, but it’s the weakest form available and the one most vulnerable to SIM swaps.

If your carrier offers a port-out PIN or account lock, set one. It’s not bulletproof, but it adds friction. On T-Mobile, look for “SIM protection” in the app settings. On Verizon, set up a “Number Lock.” AT&T has “Extra Security.” These are imperfect solutions but they’re free and take two minutes.

If you hold significant crypto, move it to a hardware wallet and use app-based or hardware 2FA exclusively for exchange accounts. Do not rely on SMS for anything that protects real money.

And if you want to actually solve the problem rather than mitigate it, consider a carrier that doesn’t leave SIM swap decisions to humans in the first place.

Save $20/month with a referral code

If you want to try Cape, grab a free referral code at cape.rip before you sign up. It takes $20 off your monthly bill for as long as you stay subscribed, and the person who shared the code saves $20 too. No signup needed, no tracking. Just pick a code and use it at cape.co.