What is SIM swapping?¶

SIM swapping is the transfer of a mobile number to a new SIM or eSIM.

What this means¶

This may happen legitimately when a customer replaces a lost phone, upgrades a device or changes the SIM.

It may also be used fraudulently.

An offender may persuade or trick the provider into activating the victim’s number on a SIM they control.

Once that happens, calls, SMS messages and verification codes may be delivered to the offender’s device.

The victim’s original SIM may lose service.

This can support account takeover where services rely on SMS for password resets or multi-factor authentication.

The number itself has not changed.

What changed is the SIM or eSIM profile receiving the service.

Also examine activity immediately before and after the swap.

Password resets, bank transfers, account changes and new device logins may form part of the same sequence.

The evidence must show how the swap occurred and who benefited.

The operational takeaway is: SIM swapping moves control of a number to a new network credential. Build a timeline of the swap, device changes, authentication and subsequent account activity to identify whether it was legitimate or abusive.

What to check or do next¶

• Investigators should look for the activation time, replacement request, account contact, provider notes, authentication method, device identifiers and any service interruption.

Evidential limits¶

Do not assume the registered subscriber requested the change.

Do not assume every replacement SIM is fraudulent.