A form of identity fraud in which a criminal deceives or bribes a mobile phone carrier into transferring a victim's phone number to a SIM card the criminal controls, typically by impersonating the victim to customer service representatives. Once the number is hijacked, the offender can intercept text message based two factor authentication codes and use them to take over the victim's email, banking and cryptocurrency accounts. It emerged as a significant offense category in the mid to late 2010s alongside the wider adoption of SMS based account verification.
Facts
Classification CodeNo SIM-swap-specific criminal statute is named in the surveyed source; the fraud instead exploits a mobile carrier's ordinary number-porting process, normally used when a phone is lost, stolen or a customer switches devices, to move a victim's number onto an attacker-controlled SIM. 1 Typical PenaltyIn the criminal prosecution of Nicholas Truglia over the 2018 SIM-swap theft of $23.8 million from investor Michael Terpin, Truglia was sentenced to 18 months in prison and ordered to pay back $20 million; his co-defendant Ellis Pinsky was ordered to repay $22 million but, as a minor, avoided prison. 1 Elements of OffenseA SIM swap attack is a type of account takeover fraud that generally targets a weakness in two-factor authentication and two-step verification in which the second factor or step is a text message or call placed to a mobile telephone; the fraud exploits a mobile phone carrier's ability to port a phone number to a device containing a different SIM, normally used when a phone is lost, stolen or a customer switches to a new phone. 1 Notable ExampleIn 2019, Twitter CEO Jack Dorsey's own Twitter account was compromised through a SIM swap attack, one of several high-profile hacks carried out this way against social media accounts on platforms including Instagram and Twitter. 1 Jurisdiction VariationReported SIM-swap volume varies sharply by country: the US FBI recorded 982 complaints in 2024 after a 2022 peak of 2,026, the UK National Fraud Database recorded 2,760 reported cases in 2024 after reports rose more than 1,000 percent from 2023, and Kenya's Safaricom recorded a 327 percent rise in SIM swapping from 2024 to 2025, from 11 cases to 47. 1 Classification
Offense GradeMinor or Summary Offense 1 Connections
Associated With
Source Wikipedia: Cybercrime
Has Offense Grade
Entity-backed identity for the offense-grade enum value this offense already carries, resolved to a crime concept by an explicit value-to-entity map (phase 3 bucket conversion, docs\design_entity_backed_browse_buckets_20260928.md). The offense-grade fact itself stays on the offense unchanged.
In the Other Atlases
- Also in Geography Atlas: Africa, found in there.
Sources
1. SIM swap attack (Wikipedia)
lead paragraph, first sentence
A SIM swap attack (also known as port-out scam, SIM splitting, simjacking, and SIM swapping) is a type of account takeover fraud that generally targets a weakness in two-factor authentication and two-step verification in which the second factor or step is a text message (SMS) or call placed to a mobile telephone.
Method section, first sentence
The fraud exploits a mobile phone service provider's ability to seamlessly port a phone number to a device containing a different subscriber identity module (SIM).
Incidents section, Truglia and Pinsky sentencing sentence
Truglia was sentenced to 18 months in prison and ordered to pay back $20 million, and Pinsky was ordered to pay back $22M but, as a minor, avoided prison.
Incidents section, Jack Dorsey sentence
In 2019, Twitter CEO Jack Dorsey's Twitter account was hacked via this method.
Incidents section, UK National Fraud Database sentence
SIM swap reports to the UK National Fraud Database rose over 1,000 percent from 2023 to 2024, but the 2,760 reported cases represented less than one percent of all fraud reports.
View the SourceWikipedia: Cybercrime
Associated With: Cybercrime, Lead and law-enforcement sectionsQuote, Associated With: Cybercrime, Lead and law-enforcement sections
Cybercrime encompasses a wide range of criminal activities that are carried out using digital devices and/or networks.
Reader Challenges (0)
No disputes yet. Spotted an error or a better source? Open the first one.
Sign in to dispute this or suggest a correction.