You have a 25-character password. You have enabled 2-Factor Authentication (2FA). You think you are safe. But your phone loses signal. It says "No Service". While you restart it, thinking it's a glitch, your bank account is being drained. You have been SIM Swapped. The attacker didn't hack your phone; they hacked your Cell Carrier.
The Mechanism
A SIM Swap (or SIM Jacking) occurs when an attacker convinces your mobile carrier (T-Mobile, Verizon, AT&T) to transfer your phone number to a new SIM card in their possession.
Once the transfer happens:
1. Your SIM card goes dead (No Service).
2. The attacker's SIM card becomes active with your number.
3. They receive all your calls and SMS Verification Codes.
1. The Human Vulnerability (Insider Threat)
This is rarely a technical hack. It is almost always Social Engineering or Bribery.
The Script: The attacker calls support: "Hi, I'm [Your Name]. I lost my phone and bought a new SIM. Can you activate it? I can't receive the SMS code because... I lost the phone."
The Insider: In many cases, low-level employees at retail phone stores are bribed via Telegram/Discord (~$500 per swap) to perform the swap using their internal tools, bypassing security questions.
2. Why 2FA Fails (Account Recovery)
The problem is that most services (Gmail, Coinbase, Instagram) treat your phone number as "The Master Key".
Even if the attacker doesn't know your password, they click "Forgot Password".
The service asks: "Send code to +1 (555)...?"
The attacker clicks Yes. They get the code. They set a new password. They own your account.
3. SS7 (Signaling System No. 7) Vulnerabilities
For high-value targets (Politicians, CEOs), attackers use a more technical approach.
The global telecom network (SS7) was designed in the 1970s based on trust between carriers.
If an attacker gains access to the SS7 network (often by hacking a small telco in a developing country), they can send routing commands to intercept SMS messages anywhere in the world without needing to swap the SIM.
How to Protect Yourself
1. REMOVE your phone number: Delete it from your Google/crypto accounts. Recovery email is safer than SMS.
2. App-Based Auth (TOTP): Use Google Authenticator, Authy, or Aegis. These generate codes locally on your hardware. If your SIM is swapped, the codes don't transfer.
3. Hardware Keys (YubiKey): The gold standard. A physical USB key you must touch. Phishing-proof.
4. Carrier PIN: Set a "Port-Out PIN" or "High Security Password" with your carrier that is required for any SIM changes.