# What is SIM swapping?

> Persuading a mobile carrier to transfer your phone number to an attacker's SIM, capturing your calls and SMS codes.

Last reviewed: 2026-09-01

## SIM swapping

Category: Attacks

Also called: SIM swap attack, SIM jacking

Canonical page: https://moolkey.com/glossary/sim-swapping

SIM swapping is when an attacker convinces your mobile carrier to move your phone number onto a SIM they control. Every SMS verification code then arrives on their device instead of yours. It is the single strongest argument against using SMS as a second factor for anything valuable.

### How the attack runs

It is social engineering against the carrier, not a technical exploit. The attacker gathers enough personal detail, often from previous breaches, to pass the carrier's identity check. They then report a lost phone and request a transfer. The first sign for the victim is usually a phone that suddenly loses signal.

### How to reduce the risk

Move your second factor off SMS wherever possible and use an authenticator app or security key. Add a port-out PIN or account lock with your carrier; many carriers support one. Remove your phone number as a recovery method on accounts that let you use something else.

### Sources

- [FBI: Criminals Increasing SIM Swap Schemes](https://www.ic3.gov/PSA/2022/PSA220208): How SIM swap fraud works and which account protections reduce the risk.
- [OWASP: Multifactor Authentication Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Multifactor_Authentication_Cheat_Sheet.html): A comparison of authentication factors, recovery paths, and common attack routes.
- [CISA: Secure Our World](https://www.cisa.gov/secure-our-world): Public guidance for recognizing phishing and protecting high-value accounts.
- [NIST: Computer Security Resource Center glossary](https://csrc.nist.gov/glossary): Canonical terminology used across US computer security guidance.