How do you protect a crypto wallet from a SIM-swap attack?

You protect a crypto wallet from a SIM-swap attack by removing your phone number from the authentication chain wherever possible: move two-factor codes from SMS to an authenticator app or a hardware security key, lock your mobile account against unauthorized SIM changes and port-outs, and turn on a withdrawal address whitelist with a time-lock so that even a fully hijacked phone number cannot move funds out immediately. No single step is enough on its own; the protection comes from the combination.

A SIM swap does not touch your wallet's private keys or your seed phrase directly. It targets the phone number that sits behind your accounts — the number your exchange, your email provider, or your bank uses to send a one-time code or to let you reset a password. Once an attacker controls that number, every service that still treats an SMS code as proof of identity opens for them. This article explains exactly which codes a hijacked number exposes, ranks the authentication methods you actually have by what each one stops, and gives a specific first-hour response if you suspect it is happening to you right now.

How does a SIM-swap attack actually work?

A SIM swap works by convincing a mobile carrier, not your bank or exchange, to move your phone number onto a SIM card the attacker controls, after which every SMS and call meant for you goes to them instead. The attacker rarely needs to touch your device at all.

The mechanism breaks down into three stages:

• Gathering information. The attacker collects enough personal detail to impersonate you to a carrier — a prior data breach, a social-media profile, or a phishing message is usually enough to get a name, date of birth, address, and the last four digits of an account number.
• Contacting the carrier. The attacker reaches the carrier by phone, in a retail store, or through its self-service portal, and requests either a SIM replacement ("I lost my phone") or a port-out to a different carrier. A SIM swap happens when a bad actor, posing as the victim, convinces a carrier to transfer the victim's phone service to a SIM card the bad actor controls; port-out fraud moves the number to a different carrier entirely.
• Taking over the number. Once the number lands on the attacker's device, your phone loses service — often within minutes — and the attacker starts receiving every verification code your accounts send to that number.

The weakness the attack exploits is not cryptographic. It is organizational: a phone carrier's customer-service process, and in some cases the underlying telecom signaling network, both still accept a phone number as a strong proof of identity even though neither was built to be one. The National Institute of Standards and Technology notes the same two failure points directly: many security weaknesses with SMS delivery have been identified, including SS7 (telephone signaling) vulnerabilities and the possibility of the telephone number being reassigned to a different device, perhaps by social engineering of a carrier or retail representative by an attacker.

Which codes and logins does a hijacked phone number expose?

A hijacked phone number exposes every code and reset flow that a service still routes through SMS or a voice call to that number, which in practice covers far more than a simple login prompt. Once the number is live on the attacker's SIM, these typically fall in sequence:

• Login one-time codes. Any exchange, wallet app, or bank that sends a six-digit SMS code at sign-in is now sending it straight to the attacker.
• Password-reset links and codes. "Forgot password" flows on email, exchange and custodial-wallet accounts routinely confirm identity with an SMS code, letting the attacker reset the password itself before you even notice service has dropped.
• Two-factor reset or recovery flows. Many platforms let a user who has "lost their phone" disable an authenticator app and fall back to SMS as the recovery method — this is precisely the door SMS was meant to close, now reopened by the same channel.
• Withdrawal or transaction confirmations. On platforms that confirm a crypto withdrawal with an SMS code rather than an app-based factor, that confirmation step offers no protection once the number itself is compromised.
• Account-recovery calls. Voice-based one-time passcodes and callback verification are exposed exactly the same way SMS is, since both ride the same hijacked number.

The common thread is that none of these were ever meant to be a single point of failure. They become one only when every other factor on an account quietly depends on the same phone number, which is the normal, unexamined default for most personal and small-business accounts.

Why do NIST and the FCC single out SMS authentication?

Both the agency that writes US digital-identity standards and the regulator that oversees mobile carriers now treat SMS-based authentication as a known weak point rather than a neutral option, which is why it sits in a different risk category from an app or hardware-based code.

NIST's current Digital Identity Guidelines put a formal label on it: the updated guidelines, SP 800-63B-4, formally classify SMS and PSTN one-time passcodes as a "restricted" authenticator — the first time NIST has created this explicit category. The guidance does not ban SMS outright, but a restricted authenticator is permitted only after a documented risk assessment, and NIST steers organizations away from choosing it for any new implementation.

The Federal Communications Commission approached the same weakness from the carrier side. This part of the article describes a US regulatory framework specifically; carrier-side rules and options differ outside the United States, so check what your own provider offers if you are elsewhere.

In November 2023, the FCC revised its CPNI and local-number-portability rules specifically to make the SIM-change and port-out process itself harder to abuse. The rule requires wireless providers to:

• Use secure methods to authenticate customers before performing SIM changes and number ports.
• Respond to failed authentication attempts, and train employees on SIM swap and port-out fraud.
• Block employee access to account records until a customer is authenticated.
• Notify customers of any SIM-change or port-out request.
• Let customers lock their accounts to block such changes from being processed at all.

The FCC originally set a July 8, 2024 compliance date for the provisions not tied to a paperwork-reduction review, then pushed the whole order back to take effect only once the Office of Management and Budget cleared its information-collection requirements — which it did in January 2025. Providers have been expected to comply since. In practice, a carrier-side "port freeze" or account PIN is now a standard option, and an unprotected account relying on a name-and-address check is the exception the rule was written to close.

None of this removes the underlying problem for you as an account holder: carrier rules reduce how often a swap succeeds, but they do nothing for the accounts that still treat a successful swap as a valid login. That is a choice you control directly, which is why the next section ranks the methods available to you.

Which authentication method actually stops a SIM swap?

An authenticator app or a hardware security key stops a SIM swap cold, because neither depends on your phone number at all; SMS-based codes do not, because the swap is a direct attack on the one thing SMS relies on. A withdrawal whitelist does not stop the login itself, but it stops the swap from turning into a theft. The table below ranks each method on exactly what it blocks.

A hardware key's cost reflects what feature set you need: current retail pricing runs from about $25 for a basic FIDO2-only model up to roughly $100 for a biometric or FIPS-certified series, and a simple key is enough for personal and most business accounts — the premium versions mainly add protocols unrelated to SIM-swap resistance.

The practical takeaway from this table is that these four methods are not interchangeable alternatives; they solve two different problems. The first three decide whether an attacker can log in at all. The fourth decides what an attacker can do once they are already in. A business or individual holding significant crypto balances needs at least one method from each half of that split, not just the strongest single method from one side.

How much does a SIM-swap complaint actually cost, on average?

The average dollar loss tied to a single SIM-swap complaint has stayed in the tens of thousands of dollars even as the number of complaints has fallen, which tells you the attacks that still succeed are the targeted, high-value ones rather than opportunistic ones. The FBI's Internet Crime Complaint Center tracks this every year as part of its annual report.

SIM swap complaints to the FBI rose 26 percent in 2022 to 2,026, then dropped 47 percent to 1,075 in 2023, and dropped a further 9 percent to 982 in 2024. Despite that drop in volume, the dollar cost per complaint did not fall at the same rate. Average loss per complaint was approximately $26,460 in 2024, down from approximately $45,393 in 2023 — and in the IC3's own tables, 2023's reported SIM-swap losses totalled $48,798,103 against $72,652,571 in 2022, while 2024's SIM-swap losses were reported at $25,983,946 against 982 complaints.

The overall pattern — fewer complaints, but a cost per incident that stayed elevated through 2023 before easing in 2024 — matches what the FCC's carrier rules were designed to address: making the swap itself harder to pull off, rather than assuming victims will catch it after the fact.

It also matches a wider pattern Microsoft has documented across identity attacks generally: SIM swapping is used in less than one-third of one percent of identity attacks, compared with 99 percent for breach replay, password spray, and phishing combined. SIM swapping is rare as a share of all account takeovers, but when it does succeed against someone holding a meaningful crypto balance, the loss per incident is disproportionately large — which is exactly why it is worth defending against specifically, even though it is not the attack you are statistically most likely to face.

What should you set up before you are ever targeted?

The defenses that actually work against a SIM swap all have to be in place before the attack starts, because none of them can be set up in the middle of one. Work through these in order; each one closes a specific door the previous steps leave open.

What are the first signs that a SIM swap is in progress?

The clearest early sign of a SIM swap is a sudden, total loss of cell service — no bars, no calls, no texts — on a phone that was working normally moments before, with no outage reported in your area. A single dropped call or a slow data connection is not this; a swap in progress looks like your phone simply stopping being a phone.

Other signs cluster around the same window: an email notifying you of a password reset you did not request, a login notification from an exchange or wallet app for a device you do not recognize, or a text from your carrier confirming a SIM change or port request you never made. Any one of these on its own could be noise. Two or more together, especially alongside a loss of signal, is the pattern US carrier rules were built to flag — carriers there are now required to notify customers immediately when a SIM change or port-out request is made, precisely so this moment doesn't pass unnoticed.

What do you do in the first hour after a suspected SIM swap?

The first hour after a suspected SIM swap is about locking down accounts from a device the attacker does not control, contacting your carrier through a channel that bypasses the compromised number, and documenting everything for the reports you will need to file afterward. Move through these steps in order, using a second device throughout.

How does a withdrawal whitelist limit the damage even after your phone is gone?

A withdrawal address whitelist limits the damage because it adds a delay that has nothing to do with your phone number, your password, or your two-factor code — all of which could be compromised at once in a swap, while the time-lock still holds. The mechanism is simple: an exchange will only send funds to an address you have pre-approved, and most major exchanges additionally hold a newly added address in a mandatory cooling-off period before it becomes usable.

That cooling-off period is commonly set at a day: most exchanges impose a mandatory waiting period, typically 24 hours, after a new address is added, during which withdrawals to that newly whitelisted address are locked, giving account holders time to detect and respond to any unauthorized change. The design is deliberately symmetric on at least some platforms — disabling the lock itself can also be delayed, so an attacker who gets into your account cannot simply turn the protection off and withdraw in the same session.

This is exactly why the comparison table above lists the whitelist separately from the three login-level defenses: it does not stop an attacker from reaching your account dashboard, but it stops the dashboard access from becoming a drained balance in the same hour a swap succeeds. For a business or individual who receives large payments into an exchange-custodied balance before moving funds to cold storage, this single setting is often the difference between a scare and a loss.

Does carrier regulation actually stop SIM swaps?

Carrier regulation reduces how often a SIM swap succeeds, but it does not make the attack impossible, because the US rules require carriers to authenticate customers securely without dictating exactly how — leaving room for weak implementations to persist. The FCC was explicit about this trade-off when it adopted the 2023 rules: by refraining from requiring providers to use specific authentication methods, the Commission chose to give providers flexibility in meeting these obligations and determining which fraud-protection measures will work best, while leaving room for innovation in technology and security practices.

In practice this means the strength of your carrier-side protection still depends on which carrier you use and which optional protections you turn on yourself. The baseline the rule guarantees is real and worth using — notification of SIM or port requests, and the right to lock your account against them — but it is a floor, not a ceiling, and it is a US floor specifically: readers elsewhere should check what their own regulator and carrier require. Calling your carrier and explicitly asking for a port freeze and a non-password PIN on account changes remains something you have to do yourself; the rule obliges the carrier to offer it, not to apply it automatically.

How do you rebuild your security once the number is back?

Once your phone number is recovered, rebuilding means treating the incident as the trigger to finish removing SMS from every account it still touches, not just the ones the attacker reached. Go back through every exchange, wallet platform, and email account and confirm two-factor authentication is set to an authenticator app or hardware key, with no SMS fallback left active anywhere, including on accounts the attacker never got into during this particular incident.

If any self-custody wallet's seed phrase or private key was ever typed into a device, browser extension, or website during the incident — even one you later decided was legitimate — treat that key as burned and move the funds to a newly generated wallet from a clean device. A seed phrase that was exposed, even briefly, to a compromised session should never be trusted again, regardless of whether anything was actually taken.

For the payment side specifically — the moment funds actually move to you, rather than how you store them afterward — it helps to reduce how much weight any single login carries in the first place. A payment router such as Shaka, for instance, routes the full amount of a deal and pays every party their agreed share in one transaction, with each recipient's share signed before the client ever pays; the payment is final once it is sent and goes to a wallet address agreed in advance, rather than sitting in a balance that depends on an ongoing, phone-linked account login to move it out later. That does not replace wallet or exchange security — it simply means the payment step itself is not another place where a hijacked phone number can do damage.

Finally, change the account recovery information itself: the backup email, the recovery phrase prompts, and any security questions tied to information an attacker may have gathered during the social-engineering stage of the attack. A SIM swap often comes paired with a prior data breach, so assume whatever information got your number swapped once could be reused, and update the underlying answers, not just the phone number on file.