What is SIM swap: the phone-number scam that empties your bank account

Your line vanishes from your phone with no warning. No signal, no texts, no data — as if the SIM had been switched off all at once. Hours later you check your statement and see that someone emptied the account by instant transfer while you were unable to receive a single verification code. That's SIM swap: a silent scam that starts at the carrier and ends in your bank account.

"SIM cloning" is the wrong name — and why that matters

"SIM cloning" is the popular name, but it's technically inaccurate. In a SIM swap the phone number isn't duplicated — it's transferred. The fraudster convinces the carrier to link your number to a new SIM card, one that's in their hands. From that point on, your SIM stops working and the criminal receives everything: calls, texts and, above all, the authentication codes your bank sends.

There are two main routes for pulling off the attack:

• Fraudulent replacement SIM: the fraudster requests a replacement SIM in a shop, through the app or over the carrier's toll-free line, claiming loss or theft, using personal data obtained from breaches. In Brazil, PSafe detected a 2021 leak containing the data of 103 million Brazilian mobile users — national ID number, phone number, account type. With that in hand, social-engineering the support agent is trivial.
• Fraudulent porting: the fraudster requests a transfer of the number to another carrier, impersonating you and using the leaked data to confirm identity.

In 2019, Kaspersky documented a Brazilian criminal group that ran SIM swaps against more than 5,000 victims — politicians and business owners among them — with an average loss of R$10,000 per target (roughly US$1,800). The scheme depended on exactly that combination: leaked data plus a phone call to the carrier.

The weak link that opens everything: SMS as a second factor

Most banks, email providers and social networks still use SMS to deliver the second authentication factor. With your number in hand, the fraudster receives the bank's OTP codes, resets the email password (which uses SMS recovery), gets into your social accounts and activates WhatsApp on their own device. It's the domino effect for anyone who bet everything on the SIM card as a security anchor.

Is SMS 2FA safe?

No. SMS is the most vulnerable second-factor method available today. The channel can be hijacked via SIM swap or via SS7 attacks (a flaw in carriers' signalling network). The immediate alternative is an authenticator app (Google Authenticator, Authy), which generates codes locally without depending on the SIM. The definitive alternative is passkeys: passwordless authentication using cryptography on the device itself, with no factor sent over the network at all.

Important: authentication push notifications aren't immune either — the MFA fatigue attack bombards you with push prompts until you approve out of sheer exhaustion. The vector changes, the result is the same.

Why instant payments amplified the risk

Before instant payments, a fraudster with access to your text messages still needed several steps to move money. With Pix — Brazil's instant payment system — the path is direct: they have the number, they have the bank's code, they have the money.

Brazil's central bank reacted. Since 2024, Normative Instruction BCB 491/2024 has limited instant transfers initiated from an unregistered device to R$200 per operation. Resolution BCB 506/2025 authorised banks to automatically block suspicious transactions for up to 72 hours pending analysis. These are real protections — but they don't replace blocking the problem at source: the SIM card.

What you can do right now: reduce your night-time transfer limit to the lowest possible value. Any increase takes at least 24 hours to take effect (a deliberate window built in by the central bank). If you rarely make large transfers at night, a night-time limit of zero is the correct setting. The risk of instant-payment scams isn't limited to SIM swap — quishing uses fake QR codes to the same end and deserves separate attention.

What the telecoms regulator did (and what is still your responsibility)

Since August 2023, in Brazil any porting request triggers an automatic text message from the number 7678 to the line's owner. You get a window in which to reply NÃO ("no") and cancel it. That closed off a good part of the porting vector.

In April 2026, ANATEL Resolution 777 went further: mandatory facial biometrics for any replacement-SIM request, validated against the federal government's identity database rather than just the carrier's internal photo. The resolution also imposes an automatic 48-hour porting block after any significant change to registration details, plus mandatory dual notification (SMS and email) to the owner before the swap goes through.

The catch: the rules only protect people who keep their details up to date with the carrier. If the registered email address is old and abandoned, the mandatory alert never arrives.

5 things to do right now

1. Enable the SIM PIN and change the carrier's default: Brazilian carriers ship with well-known defaults — Vivo uses 8486, TIM uses 1010, Claro uses 3636 and Oi uses 8888 — and most people have never changed them. Go to Settings > Security > SIM PIN and set a personal code. Careful: three wrong attempts lock the SIM and require the PUK code (printed on the original packaging or obtained from the carrier's toll-free line).
2. Swap SMS 2FA for an authenticator app: Google Authenticator or Authy. Start with the most critical accounts: main email, bank, WhatsApp.
3. Reduce your night-time transfer limit: in your banking app, set the lowest value you can live with. High limits only benefit a fraudster who gains access to the account.
4. Update the email address registered with your carrier: it's where the mandatory porting alert goes under Resolution 777. Use an address you check often, and not the same one linked to your bank.
5. Save your carrier's and bank's toll-free numbers somewhere you can reach without the SIM: in a note in your email, on a computer. If your number gets ported away, you'll need to call from another handset — and you won't be able to look the number up on the affected phone.

What to do if it happens to you

If the signal disappears for no apparent reason, the first few hours are the most critical:

1. Call the carrier from another handset (in Brazil: Vivo 0800 775 7355, Claro 0800 722 2012, TIM 0800 741 4141, Oi 0800 031 0031). Ask for an immediate block on the line and write down the case reference number.
2. Get into your banking app over Wi-Fi on another device and temporarily block instant transfers.
3. File a police report — most Brazilian states have an online police station for this. The report is needed for reimbursement by the bank and for legal action against the carrier.
4. Complain to the telecoms regulator (in Brazil, anatel.gov.br/consumidor or the 1331 hotline). The agency can push for the porting to be reversed and open an administrative case against the carrier.

The carrier bears legal responsibility for the incident: Brazil's Consumer Protection Code holds the provider liable for security failures in delivering the service. The Federal District Court of Justice ruled against a carrier in November 2024 over a failure that allowed a SIM swap against a customer. Damages for distress in similar cases range from R$5,000 to R$15,000 in recent decisions.

The root of the problem is using SMS as the only link between your identity and your accounts. Moving to cryptography-based authentication — TOTP apps or passkeys — removes the vector regardless of what the carrier does or fails to do.