← Fraud Database

SIM swap: how it works, warning signs and what to do

Identity theft · alto

Using personal data from leaks or phishing, the scammer convinces the carrier (or bribes an insider) to move the victim's number to a new SIM or eSIM, or ports it to another carrier.

The victim's phone suddenly loses signal. From then on, SMS verification codes go to the scammer.

They use SMS password resets to get into email, WhatsApp, social media, banks and crypto exchanges, then move funds or ask contacts for money.

Sinais / Signs

• Phone suddenly shows "no service" for no clear reason.
• Carrier notice of a SIM change or port-out you didn't request.
• Password-reset or new-login alerts on your accounts.
• Contacts say you're asking them for money.

Prevenção / Prevention

• Use an authenticator app or security key instead of SMS whenever possible.
• Set an account PIN with your carrier and enable port-out protection if available.
• Enable a SIM PIN on your phone.
• Avoid exposing your phone number and personal data publicly.
• Don't rely on one phone number as the only recovery method for every account.

O que fazer / What to do

• Call your carrier from another phone and ask to block and restore your line.
• Call your bank right away using the official number (back of the card or in the app) and ask to block cards, accounts and access.
• Change passwords for email, banking and social media, turn on two-step verification and sign out of other devices.
• File a police report (many Brazilian states accept online reports) and keep screenshots, receipts, numbers and links.
• If a company was involved (store, carrier, lender), file a complaint at Consumidor.gov.br and with Procon.
• In the US, report to the FBI IC3 (ic3.gov) and the FTC (reportfraud.ftc.gov); if your identity was misused, follow the plan at identitytheft.gov.

FAQ

My phone lost signal suddenly. Could it be a SIM swap?

It could. If the signal doesn't return after a restart while others nearby have service, call your carrier immediately from another phone.

Is SMS safe for two-factor authentication?

It's better than nothing but vulnerable to SIM swaps. Prefer authenticator apps, passkeys or hardware keys.

CERT.br — Cartilha de Segurança para Internet · ANPD — Autoridade Nacional de Proteção de Dados · Consumidor.gov.br · FBI IC3 — Internet Crime Complaint Center · IdentityTheft.gov (FTC)