A customer's phone goes silent at 11:47 p.m. No calls. No texts. By midnight, the customer’s bank account is empty and their email password has been reset. The attacker never even touched their device. They just took the phone number.

That’s SIM swap fraud in a nutshell. And it’s happening at a scale many security teams haven’t fully appreciated.

SIM swap fraud is a form of identity theft in which an attacker persuades (and sometimes even bribes) a mobile carrier to transfer a victim's phone number to a SIM card the attacker controls.

Once the transfer is complete, the victim's phone loses service, and the attacker begins receiving every call and text sent to that number, including those valuable one-time passcodes (OTPs) that can unlock key accounts and information.

A Florida woman recently experienced that exact scenario. Like any typical evening, she was scrolling through her phone — when suddenly everything stopped. No texts, no calls, no alerts. In just the few minutes it took her to uncover what had happened, fraudsters had taken control of her number through a SIM swap, gained access to her bank accounts, and started spending.

This identity theft method is often called SIM swapping, or a SIM swap scam when a social engineering angle is the focus. Different names, but the outcome stays the same. The attacker now owns a trusted channel that your authentication stack relies on. 

According to the FBI, as much as $50 million was stolen through SIM swapping in a single recent year, and more than $17 million in 2025. What’s more, that figure covers only the cases that were officially reported and investigated. The actual loss picture is likely considerably larger.

To build a defense that actually works, it’s important to understand the mechanics of a SIM swap attack. Here’s how they normally unfold:

1. Reconnaissance. The attacker researches the target, gathering the name, phone number, carrier, and enough personal detail to impersonate them convincingly. Common sources include social media, data broker sites, and prior data breaches.

2. Social engineering or insider access. The attacker contacts the carrier's customer service, posing as the account holder, and requests a SIM replacement or number port. What’s worse, in some cases they bypass social engineering entirely by working with a corrupt carrier employee.

3. SIM reissue or number port. The carrier processes the request. The victim's number is now active on the attacker's SIM. The victim's phone shows "No Service" or "SOS Only."

4. Interception of one-time passcodes. With the number in hand, the attacker triggers password resets and two-factor authentication prompts on the victim's accounts. Every SMS code goes to the attacker.

5. Account takeover. Email, banking, cryptocurrency wallets, and any account tied to that phone number are now accessible. And attackers usually move quickly, with most account takeovers completed within minutes of a successful swap.

Unauthorized SIM swaps continue to be a growing global problem. In fact, Cifas reports a 38% increase in SIM swaps in the first half of 2026 in the UK (and that comes on the heels of a more than 1,000% jump between 2023 and 2024). We’ve moved beyond a gradual trend and into a world where attackers have industrialized the technique.

There’s a trap built into every SMS-based authentication flow: The second factor of the two-factor authentication process (like a six-digit code) is delivered to the phone number, not to the person. If an attacker controls that number, your second factor works exactly as designed, but for them instead of you.

This isn’t an implementation flaw. It’s a structural limitation of SMS as an authentication channel. The passcode arrives. The attacker enters it. The system sees a valid credential and grants access. Nothing in that exchange looks wrong, because technically, nothing is.

The downstream result is account takeover at scale. A single successful SIM swap can unlock email, which unlocks password resets across every other account, from banks to brokerages, crypto exchanges to enterprise SSO systems. Anything that relies on SMS verification is exposed to the same chain reaction.

The common response, "we already have 2FA," is precisely the objection this attack is designed to defeat. SMS-based 2FA is not a defense against SIM swap fraud. It’s the target. 

This is where the conversation shifts from threat to solution — and where most security vendors go quiet.

Consumer-facing advice focuses on what individuals can do after a swap: call the carrier, freeze accounts, and file a report. For an enterprise protecting thousands of customers, this reactive approach is not a strategy. By the time a customer calls to report their phone went dark, the account takeover may already be complete. 

Real-time SIM swap detection doesn’t wait for a customer to report a problem. It checks a carrier-attested signal at the exact moment a sensitive action is attempted, such as a login, a password reset, or a high-value transaction.

The signal being checked is straightforward: Has the SIM associated with this phone number changed recently? If a customer's SIM was reissued two hours ago and now they’re attempting to reset their password, that’s a real-time red flag. The check happens in milliseconds, before the action completes, and without asking the user to do anything. 

A solution like Vonage SIM Swap detection within the Identity Insights API makes this possible. The API-based solution queries carrier-level data — the actual network record of whether a SIM change occurred — and returns a response that your authentication logic can act on immediately, such as blocking the transaction or flagging the session for review. The signal is carrier-attested and arrives before the login completes.

The mobile identity API market is projected to grow from approximately $2.4 billion in 2025 to $22 billion by 2029. That growth reflects industry recognition that phone-number-based identity signals, when sourced directly from the network, are among the most reliable fraud indicators available. The investment case is already being made. The question is whether your stack is positioned to use those signals. 

A few practical notes on how this fits into an existing authentication flow:

• No user friction. The SIM-change check is invisible to legitimate users. It runs server-side, against carrier data — with no prompt, additional step, or impact on the experience of customers whose SIM hasn’t changed. 

• Speed. The API response is fast enough to slot into a login or transaction flow without perceptible latency.

• Layering. SIM swap detection works alongside, not instead of, your existing authentication methods. It adds a carrier-rooted signal to a stack that may already include device fingerprinting, behavioral analytics, or app-based OTP. 

What regulators are doing

The FCC has adopted new SIM swap and port-out fraud rules (FCC 23-95) that require wireless providers to: 

• Use secure authentication before processing any SIM change or port-out

• Immediately notify customers when a SIM change request is made 

• Offer customers the ability to lock their accounts to block SIM changes

• Maintain records of SIM change requests for a minimum of 3 years 

• Establish a clear process for customers to report fraud

Not all defenses against SIM swap fraud operate at the same layer, and the differences matter when you’re deciding where to invest. Here’s how the most common approaches stack up:

SMS OTP is the baseline most organizations already have. And as the previous section explains, it’s the method SIM swap attacks are specifically designed to defeat. Device fingerprinting can flag anomalies when a session originates from an unfamiliar device, but a SIM swap doesn’t require the attacker to use a new device; they can receive codes on any handset. Knowledge-based checks, like security questions or address verification, add friction for legitimate users and are increasingly defeatable through data broker lookups and social engineering.

Carrier-attested SIM-swap detection is the only method in this table that checks the network record directly. It does not infer a swap from behavioral signals; it asks the carrier whether one occurred. That distinction is what makes it effective where the others fall short, and what makes it invisible to users who have done nothing wrong.

This is the question that often determines whether SIM swap protection actually gets implemented or stays on a roadmap indefinitely.

The honest answer is that ownership is shared. But if it’s shared without a clear accountable party, that’s the same as unowned. In general, fraud teams care about financial loss, security teams care about account integrity, and identity teams care about authentication architecture. SIM swap fraud sits at the intersection of all three, which means it can often fall through the gaps between them.

In practical terms, the owner is whoever controls step-up authentication decisions. If your organization has a team or individual who decides when to require additional verification, such as during high-risk logins, large transactions, or account changes, then that is where SIM swap detection belongs.

Do carriers have some responsibility? Yes, carriers bear some of the burden, and most have implemented internal controls. But the business still carries the financial loss when a customer is defrauded, the regulatory exposure when account security fails, and the CX damage when a customer's account is taken over and it takes days to recover it. Telecommunications fraud losses, including SMS toll fraud, climbed past $41 billion in 2025. Waiting for carriers to solve the problem entirely is not viable. 

Knowing how to prevent SIM swap fraud at the enterprise level means building detection into the authentication layer you already own, not outsourcing the problem to a channel you don’t control.

Adding carrier-signal SIM swap detection doesn’t require replacing your authentication platform. It requires an API call at the right moment in your existing flow — specifically, at any point where a sensitive action is triggered and a phone number is already in scope.

Vonage Silent Authentication through Verify API can verify a user's identity against their current network session without sending a code at all, which eliminates the SMS interception vector entirely. And Vonage Protection Suite brings SIM swap detection (a feature of Identity Insights API), silent authentication, and additional fraud signals together into a layered stack designed for enterprise fraud and identity teams.

The architecture is straightforward. The integration is lightweight. And the result is detection that steps in before the login is completed.