SIM Swap Attacks: How Criminals Steal Your Number and How to Stop It
Basics4 minInnovialabs editorial team
In short
In a SIM swap, a criminal gets your number re-issued to their SIM and starts receiving your SMS codes. Protect yourself with passwords and cloud passwords where possible, non-SMS second factors and an operator ban on remote re-issue.
The short answer
A SIM swap happens when your phone number starts working on someone else's SIM card. The attacker persuades the mobile operator to re-issue the SIM, bribes a store employee or uses a forged power of attorney. Your phone suddenly loses signal, and every call and SMS goes to the criminal.
The danger is that a phone number has become the key to everything: SMS codes restore access to banking apps, payment services such as Payme and Click, Telegram and email. Whoever controls the number can often reset your passwords.
How the attack unfolds
- Gathering data. The attacker learns your full name, number and sometimes passport details from leaks, social media or a fake "bank" call.
- Re-issuing the number. A request at a mobile store, a corrupt employee or social engineering through the operator's call centre.
- Intercepting codes. One-time codes now arrive on the new SIM. The attacker logs into Telegram, a banking or payment app and triggers account recovery.
- Cashing out and taking over. Transfers, linking new devices, changing contact details, messaging your friends to "borrow money until tomorrow".
This can happen quickly, so reaction speed matters.
Warning signs
- Your phone suddenly shows "No service" or "Emergency calls only" while people around you have signal.
- An SMS from the operator about a SIM replacement or plan change you did not request.
- Alerts about a login from a new device in Telegram, your bank or email.
- Friends tell you that "you" are asking them for money.
- SMS codes you request stop arriving.
What to do if it happens
- From another phone, call your operator and block the number. If possible, go to the operator's office with your passport right away.
- Call your bank using the number on your card and block cards and mobile banking.
- From a trusted device, end all sessions in Telegram, email and payment services and change passwords.
- Warn people close to you that scammers may write in your name.
- Report it to law enforcement with a statement of suspicious transactions.
Operator-level protection
Options vary by operator, so ask yours:
- Can you forbid SIM re-issue without the owner appearing in person with a passport?
- Is there an extra passcode for operations on the number?
- Will you get notifications about SIM replacement or ownership changes?
Keep your passport details and contract number away from strangers — they are the attacker's main tool for a re-issue.
Moving key accounts off SMS
| Service | What to do |
|---|---|
| Telegram | Turn on the cloud password (two-step verification) and add a recovery email. Then an SMS code alone is not enough to log in |
| Use an authenticator app or a security key, and remove the phone number as a recovery method if you have an alternative | |
| Bank, Payme, Click | Set a PIN or biometrics for login, enable notifications for every transaction, review trusted devices |
| Social and work accounts | Authenticator instead of SMS, stored backup codes |
The key idea: an SMS code should never be the only key. If a service offers a second factor that does not depend on your number, use it.
Common mistakes
- Keeping backup codes in notes on the same phone or in Telegram's Saved Messages.
- Using one email with SMS recovery as the fallback for every service.
- Dismissing a sudden loss of signal as "an operator glitch".
- Publishing your number and date of birth on public profiles.