Sim Swap Attack

A Sim Swap Attack is a scam where an attacker tricks a mobile carrier into transferring a victim's phone number to a new SIM card under the attacker's control. Also called SIM swapping or phone takeover, it lets attackers intercept calls and text messages. Attackers target this to bypass SMS-based two-factor authentication (2FA).

Attackers start with social engineering. They gather personal details about the victim, such as name, address, or partial Social Security number, from data breaches or phishing. They call the carrier's support, pretend to be the victim who lost their phone, and request a SIM transfer. If successful, the victim's phone loses signal. The attacker receives all SMS codes and calls on their device. They use these to reset passwords on email, banks, or crypto exchanges.

This attack matters greatly in cryptocurrency security. Many exchanges and wallets use SMS 2FA, making accounts vulnerable. Once in, attackers drain funds, transfer crypto to their wallets, or sell access. For example, in 2020, attackers stole millions from crypto users via SIM swaps on major exchanges like Binance.

Key characteristics include reliance on carrier vulnerabilities and victim data. Types vary: pure social engineering, insider bribes at carriers, or malware-assisted info gathering. Prevent it by switching to app-based 2FA (like Google Authenticator), hardware security keys (YubiKey), or email/biometric auth. Never share personal details with unsolicited callers.