SIM Swap
A SIM swap is when an attacker convinces your phone carrier to move your number to their SIM — intercepting every SMS code meant for you, including exchang
A SIM swap is when an attacker convinces your phone carrier to move your number to their SIM — intercepting every SMS code meant for you, including exchange 2FA and password resets. With your number, they reset your email, then your exchange, then withdraw. No malware needed: just a call center and your leaked personal details.
Why it matters
SMS 2FA is barely better than nothing against a targeted attacker, and phone numbers are the skeleton key to most people’s digital lives. Defenses, in order: authenticator apps or hardware keys instead of SMS everywhere; carrier PIN/port-freeze; exchange withdrawal allowlists; and keeping only spending money anywhere SMS-recoverable.