One day your phone loses signal for no obvious reason. A few hours later you find someone has got into your bank account, Gmail and WhatsApp. That is a 'SIM swap', a scam in which the attacker persuades your mobile carrier to move your number to a SIM card they hold. From then on every call and text sent to your number reaches them, including account verification codes.
How does it happen? Usually through social engineering. The attacker gathers information about you from social media, data leaks or phishing: name, ID number, address, date of birth. They then contact your carrier, pose as you and ask to move the number to a new SIM, claiming the phone was lost or stolen. In other cases store or call-center staff collaborate with scammers, or the attacker uses your login details for the carrier's website.
Why is it so dangerous? Because many services still use SMS to confirm logins or reset passwords. Whoever holds your number can click 'forgot password' on Gmail, receive the code and take over the account, and from there reach other accounts. Favored targets include people who hold crypto, public figures and owners of social accounts with large audiences.
Five steps that reduce the risk. One: on important accounts, replace SMS verification with an authenticator app or passkey, which do not depend on your phone number. Two: in WhatsApp, turn on two-step verification with a PIN, so even someone holding your number cannot activate the account. Three: ask your carrier whether you can add a secret code or extra protection for account changes. Four: limit the personal information you post online. Five: be wary of messages asking for personal details 'for verification'.
And if your phone suddenly loses signal for no reason, especially if you also get alerts about login attempts, do not wait. Contact your carrier immediately from another device and ask whether a SIM swap was made. Then change passwords on important accounts and contact your bank and card company. In scams like this, every minute counts.
