What is a SIM swap and what might it explain?¶

A victim may suddenly lose mobile service while another person gains control of accounts linked to the number.

Evidential caution: that possession of the original handset means the victim still controlled the telephone number.

What this means¶

A SIM swap occurs when a provider moves a number to a different SIM or eSIM. This can be legitimate, for example after loss or upgrade. It can also be fraudulent if an attacker persuades or tricks the provider into transferring the service.

Once the attacker controls the number, they may receive calls, SMS messages and authentication codes intended for the victim. That can support account takeover.

The original handset may remain in the victim’s possession but lose network service. This apparent contradiction can be important evidence.

Also consider other explanations such as device failure, account closure, legitimate replacement or number porting.

Build a timeline showing the last confirmed legitimate use, the service interruption, the SIM change and subsequent account activity.

What to check or do next¶

• Preserve the timing of service loss, provider notifications, account changes, authentication messages and suspicious logins.
• Seek SIM-change, eSIM activation, subscriber-service, customer-contact and account-security records where lawful and proportionate. Record the old and new SIM identifiers if available.

Evidential limits¶

A SIM swap does not automatically explain all later activity. The attacker may control the number without controlling the victim’s device, email or messaging accounts.