What Is a SIM Swap Attack? How Crypto Holders Get Hacked

A SIM swap attack is when a criminal gets your phone number moved to a SIM card they control, and people filed 982 SIM swap complaints with the FBI's Internet Crime Complaint Center (IC3) in 2024. Once the number moves, your calls and texts go to the attacker, along with every SMS login code and password-reset link.

The FCC adopted rules in November 2023 requiring US wireless carriers to verify a customer before moving a number to a new SIM or carrier. In mid-October 2026, 1,065 days later, carriers still didn't have to comply. No compliance date had appeared in the Federal Register, and the eCFR text of both rules still said compliance would wait for one.

How Does a SIM Swap Attack Work?

A SIM swap attack works by fooling or paying someone at your carrier. The FBI's February 2022 public service announcement names the routes. Criminals impersonate the victim to get the number switched, bribe a carrier employee to do it, or phish carrier staff into installing malware that runs the swaps.

Once the swap goes through, the victim's calls and texts land on the criminal's phone. The criminal then requests "Forgot Password" resets on email and financial accounts, and the one-time codes arrive by text at a number the victim no longer controls.

Port-out fraud reaches the same place through a different door. The attacker opens an account at another carrier in the victim's name and has the number transferred there, so no SIM change ever happens at the victim's own carrier.

The SIM swap scam starts well before the call to the carrier, with the personal details an attacker needs to pass as you. FINRA's example is information you post on social media, gathered to convince your provider that the caller is you.

Traders get the same phishing that carrier staff do, through fake emails and copied login sites, and Phemex Academy covers what phishing in crypto is and how to prevent it.

Why Do SIM Swappers Target Crypto Holders?

The FBI's alert framed SIM swapping as a way to steal from "fiat and virtual currency accounts". FINRA explains why the phone number is the way in, since mobile numbers "have become a key to establishing customer identity" for financial logins. A text code can open an account, and a reset link by text opens the email inbox where every other reset lands.

A blockchain transfer also has no chargeback, so coins an attacker withdraws are gone once the transaction confirms.

A SIM swap can't reach the private key in a self-custody wallet, because the key lives in the wallet and never on the SIM. Bitcoin public vs private keys explains why that key is the one that moves coins. The danger is a copy of a key or seed phrase kept in email or cloud notes, which a hijacked number can reach through a password reset.

How Common Is SIM Swapping?

IC3 began counting SIM-swaps as their own crime type in 2022, and its annual reports give this series.

On the three-year table in the 2024 IC3 annual report, complaints fell 51.53% from their 2,026 base in 2022 and reported losses fell 64.24% from $72.65 million.

These are complaints people chose to file, which makes them a floor. An attack that never reaches IC3 isn't in the count.

The FBI's 2022 alert gave earlier figures from before the category existed. It counted 320 complaints from 2018 to 2020 with about $12 million in adjusted losses, then 1,611 complaints in 2021 with more than $68 million. Those come from a separate count and don't join the annual series.

People aged 60 and over filed 205 of the 982 complaints in 2024 and reported $6.342 million in losses, 24.41% of that year's $25.98 million total.

Do US Carriers Have to Stop SIM Swaps?

No, not as of mid-October 2026, though the FCC adopted SIM swap and port-out rules for US wireless carriers on 15 November 2023. On paper, the Federal Register rule requires carriers to use secure methods to confirm a customer's identity before a SIM change or a port-out and to notify customers immediately when either is requested.

The waiver explains the gap. On 5 July 2024 the FCC's Wireline Competition Bureau waived compliance "with the rules in their entirety" until OMB finished its review and "the Commission publishes a notice in the Federal Register announcing the compliance date". OMB approved the SIM change information collection and its port-out counterpart on 15 January 2025, which left the notice as the missing step.

By mid-October 2026, 638 days had passed since that approval, about 21 months. The eCFR text of the SIM change rule still said compliance "will not be required until this paragraph is removed or contains a compliance date", and the port-out rule carries the same line. Six SIM change protections and four port-out protections remain "[Reserved]" placeholders.

No FCC document published in the Federal Register from 2024 onward sets that date, and the waiver order names the Federal Register as the place it must appear. The FCC's entry in the government's Unified Agenda, published in August 2026, lists its next action as undetermined.

Until a compliance date appears, the protection that works is the one you set up yourself.

Is SIM Swapping Illegal?

Yes, and a federal case from 2025 shows how prosecutors charge it. On 9 January 2024, someone took over the SEC's account on X and posted that the agency had approved spot bitcoin ETFs, which it hadn't.

The SEC said on 22 January 2024 that the unauthorized party "obtained control of the SEC cell phone number associated with the account in an apparent 'SIM swap' attack". Multi-factor authentication had been off "at the staff's request, in July 2023", so control of the number let the attacker reset the account's password.

The Justice Department said in May 2025 that an Alabama man received 14 months in prison for his part. He pleaded guilty to conspiracy to commit aggravated identity theft and access device fraud.

To get the number, he used an ID card printer to make a fake ID in a victim's name and posed as that victim. According to the department, bitcoin rose more than $1,000 right after the false post and fell more than $2,000 after the correction.

How Can You Tell If You Have Been SIM Swapped?

Your phone losing service is usually the first clue. The FCC's 2023 order says the phone "going dark or only allowing 911 calls" is typically the first sign that SIM swap or port-out fraud has occurred.

FINRA lists more red flags, starting with an alert that a new device or number was activated on your account when you added neither. Logins that suddenly fail and a burst of unexpected calls or texts belong on the same list.

A message asking you to read back a code or a seed phrase is a warning sign of its own. The Phemex Safety Hub roundup of four account checks says Phemex staff will never ask for your 2FA code or your seed phrase.

How to Prevent a SIM Swap Attack

Four steps prevent SIM swapping from turning a stolen number into an emptied account.

1. Take SMS out of your logins by switching two-factor authentication to an authenticator app or a hardware security key wherever an account allows it. The FBI's alert recommends "biometrics, physical security tokens, or standalone authentication applications". NIST's July 2025 digital identity guidelines list codes sent over the phone network as their "one restricted authenticator", usable only when an organization accepts the added risk.

2. Lock the number at your carrier with a PIN or passcode on your wireless account, as FINRA advises, and ask for a SIM change or port-out lock if your carrier offers one. The FCC's rules would make carriers offer that lock, but until a compliance date arrives, asking is all you can do.

3. Keep your holdings off social media, the first tip in the FBI's alert, because a public boast tells an attacker whose number to target.

4. Keep the seed phrase offline on paper or metal, away from the email and cloud notes a hijacked number can reset. The academy page on seed phrases and how to back up a wallet covers safe ways to store one.

Phemex requires 2FA for critical account actions, and the code comes from an authenticator app on your device, as its post on how Phemex implements advanced account protection sets out. The same login check covers Phemex futures, where the BTCUSDT perpetual runs up to 150x leverage. Futures use leverage, and a leveraged position is closed automatically if losses reach its margin.

What Should You Do After a SIM Swap?

Move fast, because the attacker is racing through your password resets while the number is theirs. The FBI's alert and FINRA's guidance point to the same steps.

5. Call your carrier from another phone and get the number back.

6. Change your passwords, starting with email, then the exchange and bank accounts tied to the number.

7. Ask your banks and exchanges to flag your accounts for suspicious logins and withdrawals.

8. Report the attack to IC3 and to local law enforcement, and file with the FTC as FINRA suggests.

A wallet whose seed phrase sat in your email or cloud storage should be treated as exposed, so move its coins to a new wallet with a fresh phrase. Every report you file to IC3 also lands in the annual count that tracks the problem.

Frequently Asked Questions

What is sim swapping?

SIM swapping is another name for a SIM swap attack. A criminal talks or pays a carrier into moving your phone number to a SIM card they hold, then uses your incoming texts to reset passwords and pass SMS login checks.

Is sim swapping still a thing?

Yes. IC3 received 982 SIM swap complaints in 2024 with $25.98 million in reported losses. Those figures cover only victims who filed a complaint, so they're a floor on the number of attacks.

Is sim swapping illegal?

Yes. The man who carried out the SIM swap behind the SEC's hijacked X account in January 2024 received 14 months in federal prison in May 2025, after pleading guilty to conspiracy to commit aggravated identity theft and access device fraud.

Can sim swapping happen with esim?

Yes. The FCC's rules define a SIM as "a physical or virtual card", and FINRA warns that an attacker who convinces your provider they're you can have your eSIM moved to their device.

Bottom Line

Every defense against a SIM swap attack either makes the swap harder or makes it worthless. Making it harder is the carriers' job, and the calendar above shows how long that job has waited. Making it worthless is yours. It takes one afternoon of moving logins off text messages. After that, a stolen number gets the attacker a phone line and little else.

Disclaimer: This article is for informational purposes only and is not financial advice. Cryptocurrency trading involves substantial risk. Always do your own research before making investment decisions.