DeFi Market
A SIM swap crypto theft can start with nothing more than a homemade ID card. On or about January 9, 2024, a man used one at an AT&T store in Huntsville, Alabama, to take over the phone number behind the SEC's X account, according to the Justice Department. Do that to an ordinary crypto holder and every text code for their email and exchange goes to the thief, who resets the passwords and withdraws. Lock your number with your carrier and move your logins off text-message codes, starting with your email.
What is a SIM swap?
Your phone number lives on your carrier's computers, not on the little chip in your phone. A SIM swap is when someone convinces the carrier to point that number at a SIM card or eSIM they control. A port-out is the same trick with an extra step: the number gets moved to a different carrier entirely.
Either way, your phone goes quiet. No bars, or "SOS only." Meanwhile the thief's phone starts receiving your calls and texts, including the six-digit codes that so many sites still send by SMS.
The FBI has been warning about this for years. Its February 2022 public service announcement said the Internet Crime Complaint Center got 320 SIM swap complaints from January 2018 to December 2020, with about $12 million in losses. In 2021 alone it got 1,611 complaints and more than $68 million in losses. The FBI said criminals got the swaps done by tricking carrier staff or paying off an insider, which it called a "plug."
The newer numbers are smaller, at least on paper. The FBI's 2025 Internet Crime Report, released in April 2026, lists 971 SIM swap complaints and about $17.4 million in losses for 2025, down from 982 complaints and $26.0 million in 2024, and 1,075 complaints and $48.8 million in 2023. Those are reported cases only. A drop in reports isn't the same as a drop in thefts, and the report doesn't say which it is.
How a SIM swap empties a crypto account
The thief rarely goes straight for the exchange. Email comes first, because email is where every other password reset lands.
The FBI's 2022 warning describes the same order. Once the criminals control the number, they send "Forgot Password" or "Account Recovery" requests to the victim's email and other accounts, and the codes come to them. From the inbox they can reset the exchange password, approve a new device and change the withdrawal address. A thief sitting in your inbox can also delete the exchange's warning emails as they arrive, so you learn about it last.
Crypto makes the last step final. A bank wire can sometimes be recalled. A bitcoin transfer to someone else's wallet can't. That's why the FBI told people in 2022 not to post about their crypto holdings on social media or forums. Being known as a holder makes you worth the effort.
Real SIM swap cases from federal court
The SEC's own account, January 2024. Eric Council Jr. used a portable ID card printer to make a fake ID, then used it to impersonate the account holder at the AT&T store and take over the phone number linked to @SECgov, the Justice Department says. A co-conspirator then posted a fake announcement that the SEC had approved bitcoin ETFs. Council was paid in bitcoin for his part and was sentenced in May 2025 to 14 months in prison.
One theft, more than $20 million. Nicholas Truglia was sentenced to 18 months in December 2022 for his role in a SIM swap scheme that stole more than $20 million in crypto from one investor. The US Attorney in Manhattan said the court ordered $20,379,007 in restitution.
Fifty-nine victims, ten years. In August 2025, Noah Michael Urban of Palm Coast, Florida, was sentenced to 10 years in federal prison and ordered to pay $13 million in restitution. The US Attorney's Office in the Middle District of Florida said he and others used SIM swaps to break into the crypto accounts of at least 59 victims between August 2022 and March 2023.
And it isn't hard to pull off. In a study published in January 2020, Princeton researchers called five US prepaid carriers posing as customers and asked for SIM swaps. Thirty-nine of 50 attempts worked. The same team found 17 websites where a SIM swap alone was enough to take over an account.
What the FCC's SIM swap rules changed
On November 15, 2023, the Federal Communications Commission adopted rules aimed squarely at this. Wireless carriers must:
- use secure methods to confirm it's really you before a SIM change or a port-out;
- notify you when someone requests either one on your account;
- offer you the option to lock your account so SIM changes and ports are blocked;
- keep a process for reporting fraud, investigate it, and train staff.
There are limits. The FCC let each carrier choose its own methods instead of mandating one, and the compliance date was tied to a federal paperwork review, so the rules arrived in stages. A notice that your SIM is being changed also helps only if you see it in time. Treat the rules as a floor. The lock in point three is the part you have to switch on yourself.
How to lock your number with your carrier
Most large carriers now offer a setting called something like number lock, SIM protection or port-out protection. Search your carrier's help pages for "SIM swap" to find it.
- Set an account PIN or passcode. The FTC recommends a PIN or password on your cellular account to help block unauthorized changes. Don't use your birthday, your address or the last four digits of anything.
- Turn on the SIM change and port-out lock. An April 2024 FBI announcement told people to ask their carrier to disable or block SIM card changes, call forwarding and simultaneous ring.
- Check the account page now and then. The same FBI notice suggests reviewing your carrier account's login history and recent changes.
- Give your carrier login its own password and app-based 2FA. If thieves can sign in to your carrier account online, they can sometimes order the swap themselves.
Move your two-factor codes off text messages
A carrier lock lowers the odds. Getting SMS out of your logins removes the payoff. The FTC's two-factor authentication guide says codes from an authenticator app aren't exposed to SIM swapping the way texted codes are, and its SIM swap alert points to an app or a security key for anyone worried about it.
| Login method | What a SIM swap does to it | Use it for |
|---|---|---|
| Text message (SMS) code | The code goes straight to the thief | Nothing that holds money, if you have a choice |
| Email code or link | Falls too, if your email can be reset by SMS | Low-value accounts. The FBI's April 2024 notice says not to use email-based MFA |
| Authenticator app | Not tied to your number. The codes stay on your device | Email, exchange and carrier accounts at a minimum |
| Hardware security key or passkey | Not tied to your number, and won't work on a fake login page | Your email and exchange accounts, where they're supported |
Start with email, because it resets everything else, then each exchange, then the carrier account. In each one, look for a phone number listed as a recovery option and remove it once the app or key works. Many sites quietly keep SMS as a backup even after you turn on an app, and the backup is the door a thief tries. Save the recovery codes each site gives you somewhere offline, the way you'd store a seed phrase.
Coins in a wallet you control are a different story. A SIM swap can't reach a hardware wallet on its own, because there's no password reset to hijack. It can reach a seed phrase that you saved in your email or cloud notes, so don't keep one there.
⚠ Red flag
A text or call saying your carrier needs to "verify a SIM change," or that a support agent needs the code just sent to your phone, is the swap in progress. Real carriers and exchanges don't ask you to read a one-time code back to them. Our guide to crypto scam call scripts shows how these calls usually go. Hang up and call the number on your bill or the exchange's website, typed in by hand.
Prefer to watch? How a SIM swap empties a crypto account, and three settings that stop it.
Signs you've been SIM swapped, and the first hour
The tell is usually your phone dropping to no service while people around you on the same network still have bars. A text about a SIM change you didn't ask for, or emails about password resets, are the others. The steps below are the first hour; our first 24 hours plan covers the rest of the day.
- Call your carrier from another phone. The FBI's advice is to contact your mobile carrier immediately to regain control of your number. Ask them to reverse the swap and put a lock on the account.
- Secure your email next. From a computer you trust, change the password, sign out all other sessions and remove any phone number or forwarding rule you didn't add.
- Contact each exchange through its website. Ask them to freeze the account and withdrawals. Watch out for fake support: our guide to crypto wallet support scams shows how they find people at exactly this moment.
- Save the evidence. Times you lost service, carrier messages, exchange emails, transaction IDs and the wallet addresses your crypto went to.
- Report it. File at ic3.gov, then at IdentityTheft.gov, which the FTC uses for identity theft recovery. Our walk-through on how to report a crypto scam covers what each agency needs.
Rob's take
I've held Bitcoin since 2011, and the setting I nag friends about isn't a wallet setting at all. It's the PIN on their phone account. A phone number was built so a store clerk could help you get back in. Treat your number as public, because it is, and stop letting it unlock anything with money behind it.
If it already happened, the order of steps matters. Get our free Scammed? Your First 24 Hours plan when you join the Sunday Briefing.
SIM swaps often start with a text that looks like it's from your carrier or exchange. If one lands on your phone and you can't tell, run it through our is this a scam? quiz before you tap anything, or browse every guide in the Scams hub.
SIM swap crypto FAQ
What is a SIM swap in crypto?
It's when a criminal gets your mobile carrier to move your phone number to a SIM they control. They then receive your text-message codes and use them to reset your email and crypto exchange passwords. Once they're in, they withdraw your coins to their own wallet.
How do I know if I've been SIM swapped?
Your phone suddenly shows no service or "SOS only" while others nearby have signal. You may also get a message about a SIM change or emails about password resets you didn't request. Call your carrier from another phone right away.
What is a port-out PIN?
It's a code your carrier requires before your number can be moved to another carrier or a new SIM. The FTC recommends setting a PIN or password on your cellular account to help block unauthorized changes. Many carriers also offer a separate lock that blocks SIM changes and ports until you turn it off.
Is text-message 2FA enough for a crypto exchange?
No. A SIM swap sends your text codes straight to the thief. The FTC says authenticator app codes aren't exposed to SIM swapping the way texted codes are, and a hardware security key is stronger still.
Can a SIM swap steal crypto from a hardware wallet?
Not by itself, because a hardware wallet has no password reset tied to your phone number. The risk is a seed phrase saved in email or cloud notes, which a thief can reach after taking over your email. Keep the seed phrase offline.
Can I get my crypto back after a SIM swap?
Sometimes, if an exchange freezes the funds quickly or law enforcement seizes them later, but most transfers can't be reversed. Report it at ic3.gov and to your exchange right away. Federal courts have ordered SIM swappers to repay victims, including $20,379,007 in one New York case.
New to all this? Our free course Scam-Proof in 7 Days walks you through the checks one short lesson at a time.