A SIM swap attack is a takeover of your phone number, not your phone. An attacker calls your carrier, pretends to be you, and convinces the staff to move your number onto a SIM card they hold. From that moment, calls and texts meant for you land on their device.
That matters because your phone number is the master key to much of your digital life. Password resets go to it. One-time codes go to it. Once an attacker controls the number, they can reset the password on your email, then your bank, then your crypto exchange, in a chain that can take under an hour. The target is usually a person with something worth stealing: a founder with a company treasury, an investor, or anyone with a valuable account.
For startup people the stakes are specific. A founder's phone number is often tied to the company bank account, the payroll system, the code repository, and the domain registrar. Losing the number can mean losing the company's front door. This piece walks through how the attack actually works, what carriers still miss, and what you can do that does not depend on your carrier's competence. This connects to our earlier piece, What Is a SAFE? How Startup Convertible Equity Actually Works.
How does a SIM swap actually happen?
The attack is a confidence job aimed at a person, not a hack of a system. It usually runs in four steps.
- Recon. The attacker collects what the carrier will ask for: your name, address, the last four digits of your Social Security number or national ID, your account PIN if one exists. Much of this comes from data breaches, public records, or simple persistence on social media.
- The call. The attacker contacts the carrier's support line, retail store, or even its online chat, posing as you. The story varies: a broken phone, a recent purchase, a trip abroad. The goal is a SIM replacement or a port-out authorization.
- The swap. If the carrier complies, your number is activated on the attacker's SIM. Your own phone loses service, often without warning.
- The harvest. The attacker triggers password resets on accounts linked to the number, intercepts the one-time codes, and moves through your accounts from the inside out, usually starting with email.
Some attackers skip the carrier entirely and abuse the porting process, moving the number to a different provider. Others bribe or recruit carrier employees. The common thread is that the phone network's identity checks were built for a retail world of walk-in customers, and they fail badly against a determined stranger with your personal data.
Why is a phone number such a weak lock?
A phone number was never meant to prove identity. It is a routing label: it tells the network where to send a call. But over the past decade, apps and banks borrowed it as an identity check, because everyone has one and it is easy to type. That turned a routing label into a credential, without giving it any of the protections a real credential has.
The result is an asymmetry. For you, the number is one factor among many. For an attacker, it is the single point that unlocks the reset flow of nearly every service you use. Text-based two-factor codes are the clearest example. They were supposed to be a second lock. In a SIM swap, they arrive on the attacker's phone, so the second factor becomes a first factor for the wrong person.
There is a second weakness in the network itself. When a number is ported or re-provisioned, the change propagates through signaling systems that were designed decades ago for speed, not verification. Carriers have added checks, but the underlying plumbing still trusts whoever asks.
What do carriers still miss?
Carriers have improved. Many now offer a port-out freeze or a separate port-out PIN that must be quoted before a number can move. Some flag unusual swap activity and notify customers. Those are real gains, and you should turn them on where they exist.
But the gaps persist, and they are structural rather than technical.
- Frontline verification is inconsistent. The check that a retail clerk runs may differ from the one the call center runs, and both may differ from the chat agent's. An attacker only needs one weak door.
- Knowledge-based checks are compromised. Questions like your address or billing amount are answered by data breaches. If the attacker knows the answers, the check verifies the attacker.
- Port-out PINs are often weak or optional. A PIN the customer never set, or set to a birthday, is a formality.
- Notification is usually after the fact. Many customers learn of a swap only when their phone shows "no service," which is exactly when the attacker is already resetting passwords.
- Insider risk is hard to patch. A single bribed or tricked employee defeats every policy written on paper.
What this means is simple: treat your carrier as a weak link, not a guardian. The defenses that actually hold are the ones you control.
What actually protects you: practical steps
Nothing here requires technical skill. It requires moving your security off the phone network.
- Drop SMS codes as your second factor wherever you can. Replace them with an authenticator app, which generates codes on your device and never travels through the carrier. For the highest-value accounts, use a hardware security key, which cannot be phished or intercepted by any phone trick.
- Set a strong carrier PIN or port-out freeze. Ask your carrier directly what it takes to move your number out, then make that process as hard as they allow.
- Remove your number from password-reset flows. Where a service lets you, delete the phone number from account recovery and rely on app-based codes and backup codes stored offline.
- Harden your email first. Email is the chokepoint: whoever controls it can reset almost everything else. Give it the strongest factors you own.
- Shrink your exposed data. The attacker's raw material is your personal information. Less of it public means less for the carrier quiz.
- Act fast if service dies unexpectedly. "No service" with bars elsewhere is a warning sign. Contact your carrier from another line and check your accounts from a device the attacker cannot reach.
Our analysis, reading this as an operator problem: the single highest-leverage change is moving email and financial accounts off SMS entirely. It costs an afternoon. It removes the payoff of the entire attack, because a hijacked number no longer opens anything worth having.
Why startup teams should treat this as an ops problem
A SIM swap is usually framed as a personal security issue. For a company, it is an operational risk with a cheap fix. Founders and finance leads hold credentials that touch payroll, banking, and vendor contracts. One hijacked phone can put all three in play.
The practical version for a startup: inventory which company systems can be reset by text message, then move each one to authenticator apps or hardware keys. Do the same for any employee with spending authority. This is the same discipline as reading a term sheet closely before signing — the details are the risk. If you are new to startup mechanics, our startups coverage follows this pattern across funding and operations, and our tech news hub tracks the regulatory and infrastructure shifts that shape what founders have to defend. Readers following this should also see After the GENIUS Act: Stablecoin Startups' New Rules.
The honest limit: none of this makes you unhackable. It makes the cheapest attack unprofitable, which is enough. Attackers, like any rational actor, go where the door is open.
The bottom line
A SIM swap attack steals your phone number by talking your carrier into giving it away, then uses that number to reset your accounts. Carriers have added PINs and freezes, but their identity checks still fail against stolen personal data and insider help. The durable defense is to stop treating your phone number as a key: authenticator apps and hardware keys for email and money, a port-out freeze on your number, and less personal data in public view. Do that, and the heist has nothing left to steal.
Sources: nfl.com
