# What is SIM swap fraud?

> SIM swap fraud is an attack where a criminal persuades or bribes a mobile operator to move a victim's number onto a SIM the attacker controls. Every SMS one-time passcode for that number then arrives on the attacker's handset, which is why SMS OTP alone is not sufficient authentication for a high-value action.

- Canonical URL: https://www.broadnet.me/answers/what-is-sim-swap-fraud
- Language: en
- Last reviewed: 2026-09-10
- Publisher: BroadNet (https://www.broadnet.me)

## How the attack actually runs

The attacker first gathers enough personal detail to pass a retention-team identity check — often from a breach dump or a phishing page. They then contact the operator claiming a lost or damaged handset and request a port or a replacement SIM. Once the swap completes, the victim's phone silently loses service and every SMS and voice call routes to the attacker. Password resets, bank OTPs and account-recovery codes follow within minutes. The victim's first signal is usually that their phone stopped working, by which time the money has moved.

## Why SMS OTP is still worth sending

The lesson is not that SMS OTP is worthless — it reaches any handset in any market with no app installed, which nothing else does. The lesson is that it authenticates a phone number, not a person, and a number can change hands. Treat it as one factor among several for anything irreversible, and pair it with a signal the attacker cannot move with the SIM.

## The defence: check the line, not just the code

A SIM swap leaves a trace in the operator's own records. A number-lookup or HLR query returns the date the SIM last changed and whether the number has recently been ported. If a subscriber's SIM changed four hours ago and they are now resetting a password, that is a step-up-authentication moment, not a normal login. Operator-direct providers can read this because they hold the operator relationship; a reseller several hops away usually cannot.

## What to do in practice

Query the line's swap and port status before sending an OTP for a high-value action. Apply a cooling-off period — many banks refuse password resets for 24 to 72 hours after a detected swap. Offer app-based or passkey authentication as the primary factor for your highest-risk flows and keep SMS as the fallback that still works when someone loses their phone. And alert the customer through a second channel, such as email, when the SIM behind their account changes.

## Related

- [All answers](https://www.broadnet.me/answers)
- [Glossary](https://www.broadnet.me/answers)
- [What is smishing?](https://www.broadnet.me/answers/what-is-smishing)
- [How does telecom fraud prevention work?](https://www.broadnet.me/answers/telecom-fraud-prevention)
- [What is HLR Lookup?](https://www.broadnet.me/answers/what-is-hlr-lookup)
- [SMS OTP or an authenticator app — which should I use?](https://www.broadnet.me/answers/sms-otp-vs-authenticator-app)
- [Anti-fraud SMS](https://www.broadnet.me/operators/anti-fraud-sms)
- [HLR Lookup](https://www.broadnet.me/products/hlr-lookup)
- [OTP](https://www.broadnet.me/products/otp)