Overview

A SIM swap attack (also known as port-out scam, SIM splitting, simjacking, and SIM swapping) is a type of account takeover fraud that generally targets a weakness in two-factor authentication and two-step verification in which the second factor or step is a text message (SMS) or call placed to a mobile telephone.

Method

The fraud exploits a mobile phone service provider's ability to seamlessly port a phone number to a device containing a different subscriber identity module (SIM). This mobile number portability feature is normally used when a phone is lost or stolen, or a customer is switching service to a new phone.

The scam begins with a fraudster gathering personal details about the victim, either by use of phishing emails, by buying them from organised criminals, directly socially engineering the victim, or by retrieval from online data breaches.

Armed with these details, the fraudster contacts the victim's mobile telephone provider. The fraudster uses social engineering techniques to convince the telephone company employee to port the victim's phone number to the fraudster's SIM. This is done, for example, by impersonating the victim using personal details to appear authentic and claiming that they have lost their phone. Alternatively, fraudsters bribe telecom employees to port the victim's phone number to a new SIM.

In some countries, notably India and Nigeria, the fraudster will have to convince the victim to approve the SIM swap by pressing 1.

Incidents

A number of high-profile hacks have occurred using SIM swapping, including some on the social media sites Instagram and Twitter. In 2019, Twitter CEO Jack Dorsey's Twitter account was hacked via this method.

In December 2018, digital currency investor Michael Terpin – the founder and chief executive officer of Transform Group – filed a lawsuit against Nicholas Truglia, and in May 2020 filed a second lawsuit against 18-year-old Irvington High School senior in Irvington, New York, Ellis Pinsky, accusing them and 20 co-conspirators of swindling $23.8 million in 2018 through the use of account information stolen from smartphones by SIM swaps. At the time, Truglia was 18 years old and Ellis was 15.

Truglia was sentenced to 18 months in prison and ordered to pay back $20 million, and Pinsky was ordered to pay back $22M but, as a minor, avoided prison.

The Microsoft Digital Defense Report 2024 stated that less than one-third of one percent of identity attacks use SIM swapping (compared to 99 percent for breach replay, password spray, and phishing).