Crypto 101 Daily

A SIM-swap attack is one of the more alarming ways people lose crypto, because it can defeat the very security step you set up to protect yourself. The good news is that understanding it lets you close the door it tries to open. Here’s the plain-language explanation.

What a SIM-swap attack is

A SIM-swap attack is when a criminal tricks your mobile phone provider into transferring your phone number to a SIM card they control. Once they’ve hijacked your number, calls and texts meant for you — including security codes — go to them instead. They essentially become “you” as far as your phone number is concerned.

Why it’s dangerous for crypto

Here’s the painful part. Many people protect their accounts with two-factor authentication (2FA) that sends a code by text message. If an attacker controls your phone number, they receive those codes — and can then get into your email and exchange accounts, reset passwords, and drain your crypto. The security step you trusted becomes the very thing that’s turned against you. This is exactly why we keep recommending app-based 2FA over SMS.

How attackers pull it off

They typically gather personal details about you — often from data breaches, social media, or phishing — then contact your phone company pretending to be you, claiming a lost or damaged phone, and request the number be moved to a new SIM. Sometimes they bribe or trick a staff member. Crypto holders are specifically targeted because the payoff is large and irreversible.

How to protect yourself

The defences are very effective once you know them. The biggest one: use an authenticator app (or a hardware security key) for 2FA instead of SMS text codes wherever possible, so your security isn’t tied to your phone number at all. Beyond that, ask your mobile provider to add a PIN or port-out protection to your account, be sparing with the personal information you share publicly, and stay alert to phishing that harvests the details attackers need. If your phone suddenly loses all signal for no reason, treat it as a possible warning sign and act quickly.

Key takeaways

A SIM-swap attack hijacks your phone number by tricking your mobile provider, letting criminals intercept your text-message security codes and break into your email and crypto accounts. It’s a major reason SMS-based 2FA is risky. Protect yourself by using an authenticator app or hardware key instead of SMS, adding a port-out PIN with your carrier, guarding your personal info, and reacting fast if your phone unexpectedly loses signal. This is education, not financial advice.

New here? This is the key reason to set up 2FA with an app rather than SMS. It connects to phishing attacks and the wider safety checklist.