What SIM swapping is, and why crypto holders should care
SIM swapping happens when someone tricks your mobile carrier into moving your phone number onto a SIM card they control. After that, the calls and text messages meant for you arrive on their device instead of yours.
For an ordinary user, losing signal for a few hours is an inconvenience. For someone holding crypto, it can be the opening move in an account takeover. Your phone number is quietly wired into the security of almost everything you own online.
Attackers rarely target a number at random. They often gather details first, sometimes from data breaches or from information you have posted publicly, then use those details to impersonate you when they contact the carrier.
Why your phone number is the master key
Many exchanges and financial apps let you reset a password or approve a login by receiving a one-time code over SMS. If an attacker controls your number, they control those codes.
From there the sequence is often fast. They reset your exchange password, approve the login with the SMS code, and move funds out before you notice anything is wrong.
The deeper problem is that your number is frequently the recovery method for your email, and your email is often the recovery method for your crypto accounts. One weak link can unlock the whole chain.
Lock down your mobile account before anything else
The first line of defense sits with your carrier, not your phone. Most carriers let you add a passcode or PIN that anyone must provide before making changes to the account, including porting the number to a new SIM.
Because the exact names and options differ between carriers and countries, check your provider's official support pages for their specific process. Common protections you may find include:
- An account passcode or PIN required before any change is made
- A port-out freeze or number lock that blocks transfers to another carrier
- A separate verbal password for phone support calls
- Alerts that notify you whenever account settings are changed
Set these up while the account is fully under your control. Once an attacker is already inside, it becomes much harder to add protection.
Replace SMS codes with something stronger
Text-message codes are convenient, but they are also the exact thing a SIM swap is designed to defeat. Moving your most important accounts off SMS removes that single point of failure.
An authenticator app that generates time-based codes on your phone is a meaningful upgrade. The codes are produced on the device itself and never travel across the mobile network, so a swapped SIM does not hand them to an attacker.
For the strongest protection, a hardware security key or a passkey tied to your device goes further still. These methods are bound to a physical device or account rather than to a phone number, which makes them resistant to this style of attack.
Start with your exchange and your primary email, since those sit at the center of most recovery chains. When you switch methods, many services offer backup codes; store those somewhere safe and offline rather than leaving them in your inbox.
Treat your email as part of the vault
Your email is often the reset path to everything else, which makes it a priority target. If it falls, your crypto accounts can follow even when the exchange itself was properly secured.
Protect it the same way you protect an exchange: a strong unique password, app-based or hardware-key two-factor authentication, and no recovery method that depends solely on SMS.
Review the recovery options attached to that email account. An old recovery phone number or a device you no longer control can quietly reopen the door you just closed.
Shrink how exposed your number is
The less your real number appears in public, the harder it is for an attacker to build a convincing profile of you. Consider where your number genuinely needs to be listed.
- Keep exchanges and email on a number you do not post publicly
- Remove your phone number from social media profiles where it is not required
- Be cautious with online forms, contests, and services that harvest contact details
- Where practical, use a separate number dedicated to financial accounts
None of this makes you invisible, but it raises the effort and cost of targeting you specifically rather than casting a wide net.
Warning signs you are being targeted
SIM swap attempts usually give some signal before the full takeover happens. Catching them early gives you time to react.
- Your phone suddenly loses service and shows no signal, or emergency calls only
- You receive unexpected texts about password resets or codes you never requested
- You get notices that your number was moved or your account settings were changed
- Logins or password changes appear for accounts you were not using
Loss of signal on its own can have innocent causes. Combined with unusual security messages, though, it deserves immediate attention.
What to do if your SIM is swapped or phone is compromised
If you suspect a swap, act quickly and in the right order. Speed matters, because attackers try to move funds within a short window.
- Contact your carrier from another phone and ask them to reverse the transfer and secure your account.
- Secure your email first, since it is the reset hub for other services, then change its password and recovery settings.
- Change passwords and sign-in methods on your exchanges and any related accounts.
- Move funds to safety if you can still access an account, using a freshly secured device and a network you trust.
- Reach the exchange through official support details you find independently, never through links inside a suspicious message.
Be careful about who you contact during recovery. Attackers sometimes pose as support staff to reach people who are already panicking. Verify every channel before you share anything at all.
Keeping self-custody wallets safe on your phone
A SIM swap cannot directly empty a self-custody wallet, because those wallets are controlled by a seed phrase rather than a phone number. The risk to self-custody comes from a different direction.
If an attacker gains broader control of your phone or accounts, they may try to trick you into revealing that seed phrase, or a malicious app may attempt to capture it. Your recovery phrase should never be stored as a photo, a text, an email, or a note that syncs to the cloud.
Keep it written on paper or stamped on metal, stored offline, and never type it into a website or app that asks for it. No legitimate service needs your seed phrase in order to help you.
Confirm recipient addresses and networks carefully before any withdrawal, since a compromised device may try to display altered details. When a transfer is large or cannot be reversed, double-check it on a second, trusted device.
The takeaway
Protecting your crypto from phone fraud is less about one clever trick and more about removing your phone number as a weak point. Lock the mobile account with a carrier PIN, move important logins off SMS, and secure the email that everything else depends on.
Do this while everything is calm, not after something has already gone wrong. The few minutes it takes to add these protections cost far less than recovering an account after a takeover. If you are ever unsure about an account's security or a suspicious message, treat official platform support as your only trusted source.