SIM swap attacks and 2FA: how to protect your crypto accounts

Your phone number has quietly become one of the keys to your money. Many services send a text message when you log in from a new device or reset a password. That’s convenient, until someone else takes control of your number.

That’s what a SIM swap is, and crypto holders are a favorite target, because stolen crypto is fast to move and hard to recover.

How a SIM swap works

1. The criminal collects information about you: your name, phone number, perhaps your address or date of birth, often from data breaches or social media.
2. They persuade your mobile carrier to move your number to a SIM card they control. The FBI describes methods including social engineering of carrier staff, insider threats (paying off an employee) and phishing.
3. Your phone suddenly loses signal. Meanwhile, your calls and texts go to their device.
4. They click “forgot password” on your email and exchange accounts. The reset codes and SMS-based two-factor codes arrive on their phone.
5. They change your passwords, turn off alerts and withdraw your crypto.

The whole thing can take minutes. Often the first sign is “No service” on your phone at an unusual moment.

How big the problem is

In a February 2022 public service announcement, the FBI said its Internet Crime Complaint Center received 1,611 SIM swapping complaints in 2021, with adjusted losses of more than $68 million. The FBI’s annual report for 2022 counted SIM swapping again, with losses above $72 million. Those are only the cases people reported.

The most important fix: stop using SMS for 2FA

Two-factor authentication (2FA) adds a second step after your password. But not all 2FA is equal:

Method	Protection against SIM swap
SMS text codes	Weak: the codes go to whoever controls your number
Email codes	Only as strong as your email account’s security
Authenticator app (time-based codes)	Strong: codes are generated on your device, not sent to your number
Hardware security key (FIDO2/passkeys)	Strongest: requires the physical key, and resists phishing

The FBI recommends using strong multi-factor authentication, such as biometrics, security tokens or authentication apps, rather than relying on your phone number.

What to do on your exchange and email accounts

1. Switch 2FA to an authenticator app or a security key. Then remove your phone number as a recovery or 2FA option, if the service allows it.
2. Secure your email first. Whoever controls your email can usually reset everything else.
3. Save your backup codes offline, in case you lose your phone or key.
4. Turn on withdrawal address allow-lists on exchanges, so crypto can only go to addresses you approved in advance, ideally with a delay for new addresses.
5. Turn on alerts for logins, password changes and withdrawals.

Lock down your phone number

Ask your mobile carrier what protections it offers, and turn them on:

• A PIN or passcode required for any change to your account, especially SIM changes and number transfers. The FBI recommends setting one.
• A SIM lock or port-out lock that blocks SIM changes and transfers until you remove it.

In the US, the FCC adopted rules on 15 November 2023 to fight SIM swap and port-out fraud. They require wireless providers to:

• Use secure methods of authenticating a customer before moving their number to a new device or provider.
• Notify customers immediately when a SIM change or port-out request is made on their account.
• Offer all customers, at no cost, the option to lock or freeze their account against SIM changes.
• Train staff, protect customer information until a customer is authenticated, and handle fraud reports promptly.

Carriers in other countries offer similar locks. Ask yours.

Habits that make you a harder target

The FBI’s advice to the public includes:

• Don’t advertise your crypto holdings or financial assets online.
• Don’t share account details over the phone. If someone calls claiming to be your carrier or bank, hang up and call the number on their official website.
• Limit personal information you post publicly.
• Use strong, unique passwords for every account.
• Watch for changes in your phone’s connectivity, such as sudden loss of service.
• Don’t store passwords in apps on your phone that would hand them to anyone who gets in.

If it happens to you

1. Contact your carrier immediately, from another phone, to get your number back. The FBI notes this may require visiting a store in person.
2. Secure your email, then your exchange accounts: change passwords, revoke sessions and switch 2FA away from SMS.
3. Contact your exchanges to freeze withdrawals and flag the account.
4. Report it: to the FBI’s IC3 in the US, and to the national reporting service in your country. See crypto scams and where to report them.
5. Move remaining crypto you still control to a wallet whose keys the attacker can’t reach. See hot vs cold wallets.

Checklist

• 2FA by authenticator app or security key, not SMS.
• Phone number removed from account recovery where possible.
• Carrier PIN and SIM/port-out lock turned on.
• Email secured first, with its own strong 2FA.
• Withdrawal allow-lists and alerts on every exchange.
• Crypto holdings kept private.