SIM Swapping Explained

What Is SIM Swapping?

From a communications, consumer protection, and cybersecurity regulatory standpoint (e.g., Federal Communications Commission [FCC], Federal Trade Commission [FTC], and Department of Justice [DOJ]), SIM swapping—also known as SIM swapping fraud or SIM jacking—is classified as a form of identity theft, wire fraud, and unauthorized access to Customer Proprietary Network Information (CPNI). Perpetrators exploit weak customer authentication controls at mobile network operators (MNOs) to intercept short message service (SMS) communications and bypass two-factor authentication (2FA) protocols on sensitive accounts.

How Fraud Manifests

• Social Engineering & Impersonation: Scammers gather personally identifiable information (PII)—such as Social Security numbers, dates of birth, or answers to security questions—via phishing, dark web data breaches, or social media profiling, then pose as the customer when contacting mobile carriers.

• Insider Threats & Bribes: Fraudsters bribe, blackmail, or recruit mobile carrier customer service representatives or third-party retail store staff to execute unauthorized SIM swaps without verifying customer credentials.

• Interception of MFA & One-Time Passwords (OTPs): Once the phone number is transferred to the new SIM, the victim’s physical phone loses network service. The attacker receives all incoming calls and SMS login codes (OTPs) sent by financial institutions, crypto exchanges, email providers, and social media platforms.

• Account Takeover & Drain: Armed with intercepted OTPs and stolen credentials, the fraudster resets passwords, accesses bank and cryptocurrency accounts, steals funds, and lock victims out of their digital accounts.

Who Is Impacted

• Consumers & Retail Investors: Individuals suffer severe financial loss, identity theft, unauthorized access to private personal data, and lockouts from crucial email, storage, and banking accounts.

• Telecommunications Carriers (MNOs/MVNOs): Mobile service providers face regulatory enforcement actions, costly data breach notifications, civil litigation from victims, and reputational damage due to security lapses.

• Financial Institutions & Tech Companies: Banks, crypto exchanges, and online platforms bear operational costs, increased customer disputes, potential liability, and fraud losses caused by reliance on SMS-based two-factor authentication.

Regulatory & Legal Consequences

Regulators and law enforcement agencies maintain strict enforcement frameworks targeting both the individual perpetrators of SIM swapping and the telecommunications carriers that fail to safeguard customer accounts:

• FCC Rules & Enforcement Actions: Under FCC rules governing CPNI and Local Number Portability (LNP), wireless carriers are required to use secure customer authentication methods, provide immediate account notification prior to SIM changes, offer account locks, and maintain records of SIM change requests. Failure to comply can result in substantial administrative fines, monetary forfeitures, and strict compliance monitoring.

• Criminal Charges (DOJ): Federal prosecutors charge perpetrators under federal statutes, including wire fraud, aggravated identity theft, access device fraud, and violations of the Computer Fraud and Abuse Act (CFAA), which carry severe mandatory prison sentences (e.g., consecutive mandatory minimums for identity theft).

• Asset Seizure and Forfeiture: Law enforcement utilizes tracing tools to seize, forfeit, and recover funds, digital assets (cryptocurrency), luxury goods, and real estate acquired using proceeds from SIM swapping schemes.

• FTC Action against Unfair Data Practices: The FTC enforces privacy and security standards against companies that fail to maintain reasonable security measures to protect consumer data against unauthorized SIM swaps, which can result in long-term federal consent decrees and financial penalties.