SIM swap: An attack in which a criminal gets a victim's phone number transferred to a SIM or eSIM they control, allowing them to receive the victim's calls and SMS verification codes.
Also known as: SIM swapping, SIM hijacking, Port-out scam
Key takeaways
- A SIM swap moves your phone number to an attacker's SIM, redirecting your SMS codes.
- It usually starts with social engineering or an insider at the carrier, not hacking your phone.
- Warning sign: your phone suddenly shows no service while others nearby have signal.
- Prevention: a carrier PIN or port-out lock, less personal data online, and non-SMS factors where available.
- C Chat can sign you in by SMS or email; protecting the number and inbox you use is essential.
Many people assume their phone number is safe because their phone is in their pocket. A SIM swap doesn’t touch the phone at all. It happens at the mobile carrier, and the first sign is usually that your phone stops working.
A SIM swap attack: a plain definition
A SIM swap is the theft of a phone number. Carriers legitimately move numbers to new SIM cards every day, when phones are lost, upgraded or switched to eSIM. Attackers abuse that process by pretending to be you, or by bribing an insider, so your number is moved to a SIM they hold.
Once they control your number, every text message sent to it, including one-time passcodes, arrives on their device.
How it works
The attack usually follows these steps:
- Gather personal details such as your name, number, address, birth date or account PIN, often through social engineering, data leaks or public social profiles.
- Contact the carrier in a store, by phone or online, posing as you and claiming a lost or broken phone.
- Get the number activated on a new SIM or eSIM. Your phone drops off the network.
- Trigger password resets or SMS logins on email, banking and messaging accounts.
- Take over those accounts before you notice, and use them for fraud.
Step 5 is an account takeover. In many cases, attackers first send smishing texts or phishing emails to collect the personal details needed for step 2.
Why it matters for business messaging
Messaging apps that sign people in with an SMS code are directly exposed: whoever controls the number can request a new code. For a business, the damage goes beyond one person. An attacker inside a work chat can read operational groups, impersonate the employee and ask colleagues for payments or information.
Frontline staff with personal phones are often the most exposed, because their carrier accounts rarely have extra protection and their numbers are widely shared.
How it relates to C Chat
C Chat uses passwordless sign-in: you log in with a code sent by SMS to your phone number, or by email to your email address. That means the security of your C Chat account depends on the security of that number or inbox. The reasoning and trade-offs are covered in is passwordless login secure? and passwordless sign-up.
Practical steps for teams:
- Lock phone lines. Ask every staff member to add a carrier PIN or port-out lock. It takes a few minutes.
- Watch for “no service”. If a phone suddenly loses signal, the employee should contact the carrier from another phone and tell the team admin.
- Contain quickly. Owners and admins can remove a compromised member from the team, taking them out of its groups until the number is recovered, then invite them back.
- Warn colleagues. Post in the relevant group that messages from that account may be fake for now.
- Report impostors with block and report, and review group conversations afterwards using admin audit.
Share mobile security basics for staff phones during onboarding, and use how to spot phishing in chat apps to train people on the lures that often precede a swap.
Related terms and common misconceptions
- “SIM swaps require hacking the phone.” No. They target the carrier’s customer process.
- “Only crypto investors are targeted.” High-value targets are common, but any account with SMS login is attractive.
- “Two-factor authentication protects me.” Only if the second factor isn’t SMS to the stolen number; see two-factor authentication.
Getting started
If you run a team on C Chat, add “set a carrier PIN” to your onboarding checklist today. New teams can start at getcchat.com/c, and the overall protection model is on the security page.
Frequently asked questions
How do I know if I have been SIM swapped?
The clearest sign is that your phone loses service unexpectedly and shows "No SIM" or "Emergency calls only" while people around you have signal. You might also get emails about a SIM change or logins you didn't make. Contact your carrier from another phone immediately.
How can I prevent a SIM swap?
Ask your carrier to add a PIN, passcode or port-out lock to your account; avoid posting your phone number, birthday and address publicly; and use an authenticator app or passkey instead of SMS for your most important accounts where possible.
Can a SIM swap happen with an eSIM?
Yes. The attacker simply asks the carrier to activate your number on an eSIM they control. The defense is the same: lock your account with the carrier and limit the personal details available to anyone impersonating you.
What should a business do if an employee is SIM swapped?
Help the employee recover the number through the carrier, remove or suspend their access in work tools until it is back under their control, and warn colleagues that messages from that person may be fake for a while. Review any group activity during that period.