SIM Swaps and Port-Out Fraud: What Businesses Should Know

SIM swap fraud is when a criminal gets a mobile carrier to move someone’s phone number onto a SIM card the criminal controls. Port-out fraud is the same idea, except the number is moved to a different carrier entirely. Either way, the victim’s phone goes dead and every call and text, including one-time passcodes, starts landing on the attacker’s device. For a business, that means your verification texts, your “call the number on file” checks and your password resets can all be working perfectly and still be talking to the wrong person.

That’s the part that catches companies off guard. Nothing in your system was hacked. The phone number was.

How a SIM swap actually happens

The mechanics are low-tech, which is why they work.

An attacker starts with the target’s phone number and enough personal details to pass as them: name, address, the last four of a Social Security number, maybe an account PIN pulled from a data breach or a phishing text. Then they contact the carrier, by phone, through a retail store or via an insider, and ask for the number to be moved to a new SIM. “I lost my phone.” “My SIM is damaged.” “I’m switching to an eSIM.”

Port-out fraud goes one step further. The attacker opens an account at a different carrier and requests to port the victim’s number in. Porting is designed to be easy, because consumers have a legal right to keep their numbers when they switch, and the old carrier mostly checks that the account number and transfer PIN match.

Once the number moves, the clock starts. The victim might notice “No Service” in ten minutes or in three hours. Meanwhile the attacker is going down a list: email password reset by text, then bank, then crypto exchange, then the payroll portal.

A fictional but very typical timeline:

• 2:14 p.m. Carrier support moves Dana’s number to a new SIM after a caller answers her security questions.
• 2:19 p.m. Dana’s phone shows no signal. She assumes it’s a network blip.
• 2:23 p.m. Attacker resets Dana’s email password using a code sent by text.
• 2:31 p.m. Attacker uses email access plus another text code to log into her bank and add a new payee.
• 2:40 p.m. A $9,400 transfer goes out.
• 4:05 p.m. Dana borrows a co-worker’s phone and calls her carrier.

Every step after 2:14 relied on businesses trusting that a text to Dana’s number reached Dana.

How big is the SIM swap fraud problem?

Big enough that the FBI issued a dedicated warning. In a February 2022 public service announcement, the FBI’s Internet Crime Complaint Center reported 1,611 SIM swapping complaints in 2021 with adjusted losses over $68 million, compared with 320 complaints and about $12 million across the three years from 2018 to 2020. That’s reported complaints only. Many victims never file one, and losses that show up as “account takeover” or “wire fraud” don’t get tagged as SIM swaps at all.

The FBI’s advice to carriers in that notice says a lot: train staff on SIM swapping, set strict protocols for verifying customers before moving a number to a new device, and authenticate requests coming from third-party retailers. In other words, the weak point is people following a process that was built for convenience.

Regulators have moved too. In November 2023 the FCC adopted rules requiring wireless carriers to use secure methods to authenticate customers before moving a number to a new SIM or a new carrier, and to notify customers when those requests are made. Carriers asked for more time to build all that, and the FCC pushed the compliance deadline back while the rules went through federal paperwork review. Either way, the direction is clear, and it raises the bar. It doesn’t make any single carrier’s front line perfect, and it doesn’t change what your business does with a phone number once you have one.

Why businesses end up holding the loss

Phone numbers became identity documents by accident. They’re on every account, they’re easy for people to remember, and texting a code is the cheapest second factor there is. So a lot of systems quietly treat “controls this number” as “is this person.”

NIST’s digital identity guidelines have flagged this for years, and the revision published in July 2025 kept the warning. SP 800-63B classifies using the phone network for out-of-band authentication as a “restricted” authenticator, partly because of the risk of a number being ported or redirected. It’s allowed, with caveats, and the same guidance says verifiers should consider risk indicators like a device swap, SIM change or number porting before sending a code by text. It’s not meant to carry the full weight of a high-value decision.

Where we see businesses exposed:

• SMS as the only factor for logins, password resets, payout changes or new devices.
• Callback verification to a number that just changed. If a fraudster updated the phone number on the account last week, “we called the number on file and they confirmed” proves nothing.
• Phone-number-based identity matching at onboarding with no check on whether the number actually belongs to the applicant.
• Support teams with override power who can be talked into a reset by a caller with the right details.

Controls that actually help

You can’t stop a carrier from being fooled. You can make a hijacked number much less useful.

Don’t let SMS approve high-risk actions alone. Changing the payout account, raising limits, adding a new payee, resetting a password and changing the phone number itself should require something more: an authenticator app, a passkey, a security key, or a step-up check through a channel the attacker can’t control.

Add a cooling-off period after contact changes. If an email or phone number changed in the last 72 hours, hold payouts or high-value transfers and notify the old contact method. Most SIM swap attacks are a race. A delay wins it for you.

Verify the number belongs to the person, not just that it works. At onboarding and before big decisions, confirm that the name tied to the phone number matches the person in front of you. A number that’s live but belongs to someone else is a red flag that has nothing to do with SIM swapping and catches it anyway. Our post on identity verification by phone number covers how to do this well.

Watch the line itself. Know the carrier and line type when a customer first gives you their number, and notice when they change. A long-time mobile customer whose number now shows up on a VoIP carrier deserves a second look, because a hijacked number can be ported to a provider where accounts are easy to open. The basics are in mobile vs. landline vs. VoIP and carrier lookups.

Score the number. A phone fraud score combines signals about a line’s risk into one figure. It won’t tell you a SIM swap happened twenty minutes ago, but it’s a good input for deciding which requests get step-up checks. We explain how to read one in what a phone number fraud score means.

Train the people who answer the phone. Social engineering works on your support team the same way it works on a carrier’s. Give agents a script for refusing urgent requests, and back them up when they do.

Where a phone-number lookup fits

Our lookups weren’t built as a SIM swap detector, and we’d be wary of anyone selling one product as a full answer. What a lookup gives you is a quick read on whether a phone number and a person go together. You get the name and current address tied to the person’s TransUnion credit file, plus phone details: line type, carrier, caller ID name and a fraud score from 0 to 100 for the number. And their FICO® Score 4, which matters if the decision is about credit.

For fraud teams that’s useful in two places. At onboarding, a number that maps to a different name, or to nobody, is worth a closer look before you extend credit. Before a high-risk change, comparing the carrier and line type to what you saw at onboarding catches some ports outright. Lookups are soft pulls, so the person isn’t notified and their score isn’t affected, and you need a permissible purpose like the person’s application or their OK. The rules are summarized on our compliance page, and if you want to run this at scale, the API supports it.

Helping customers who’ve been hit

If a customer calls saying their phone just went dead and they’re seeing strange activity, move fast and assume it’s real.

1. Freeze outgoing transfers and payout changes on their account.
2. Tell them to contact their carrier from another phone and ask whether a SIM change or port request was made.
3. Help them reset passwords from a clean device and switch to an authenticator app or passkey.
4. Point them to IdentityTheft.gov for a recovery plan, and suggest a credit freeze if personal data was exposed. Our explainer on credit freezes vs. credit locks covers the difference.
5. Afterward, recommend they add a port-out PIN or number lock with their carrier. The major carriers all offer some version of one.

For prevention on your own team, the same advice applies. Put a PIN on your business lines, move admin accounts off SMS, and treat any unexpected “No Service” on a phone that controls money as an incident until proven otherwise.

For a wider view of phone-based fraud schemes, including fake identities built around burner numbers, see synthetic identity fraud.