Federal prosecutors have charged multiple groups of defendants across the country for using SIM swaps to seize victims’ phone numbers, intercept two-factor authentication codes, and drain bank accounts. In one case out of the Southern District of New York, seven defendants face charges tied to a million-dollar identity theft and fraud scheme. A separate civil forfeiture action in the District of Columbia targets over $5 million in Bitcoin traced to SIM-swapping scams, and three Indiana residents face indictment for a nationwide conspiracy that ran from April 2023 through May 2024. These cases, combined with federal authentication standards that flag SIM changes as a known risk signal, show how a single phone number hijack can translate into rapid financial loss.
How SIM swaps bypass bank security in minutes
The attack is deceptively simple. A thief obtains enough personal information about a target to convince a mobile carrier, or bribe a carrier employee, to transfer the victim’s phone number to a new SIM card. Once the number routes to the attacker’s device, every SMS-based security code meant to protect the victim’s bank, email, or cryptocurrency account lands in the wrong hands instead. The complaint unsealed by the U.S. Attorney’s Office states that “the purpose of the SIM swap was to control the victim’s phone number to access bank accounts” and receive two-factor security texts. That language captures how the scheme collapses the gap between number theft and money movement to a matter of minutes.
The Northern District of California indictment adds another layer. The three Indiana defendants allegedly operated a SIM-swap-for-hire ring that created fraudulent identification documents, performed the swaps at retail carrier locations, intercepted authentication codes, and then stole money and data before laundering proceeds through cryptocurrency. The indictment covers activity from April 2023 to May 2024, showing that the supply chain behind a single swap can involve document forgers, in-store operatives, and crypto launderers working in concert. The description of coordinated roles also undercuts the idea that SIM swapping is purely a crime of lone hackers; instead, it appears as a service model where one group specializes in social engineering carriers while others focus on monetizing stolen access.
Once the number is under criminal control, the rest of the attack exploits how many institutions still treat text messages as a trusted second factor. An attacker who already has a victim’s username and password-obtained through phishing, data breaches, or credential stuffing-can simply initiate a login, wait for the bank or exchange to send a one-time passcode, and then enter that code from the hijacked phone. In some cases described in the federal filings, the same number takeover allowed access to email and cloud storage, giving attackers a way to reset passwords and lock victims out of their own recovery channels.
Federal standards flag SMS codes as a weak link
The National Institute of Standards and Technology addressed this vulnerability directly. In its digital identity guidance, NIST Special Publication 800‑63B instructs verifiers to treat device swaps, SIM changes, and number porting as risk indicators before sending one-time codes over the public switched telephone network. In practical terms, the standard tells any organization relying on SMS-based verification to check whether the phone number has recently changed hands before trusting a text message as proof of identity. That guidance effectively treats SMS two-factor authentication as a conditional channel rather than a reliable one, especially in higher-risk transactions such as wire transfers or password resets.
The Federal Trade Commission’s consumer alert on SIM-swap scams reinforces this point from the user side. The FTC advises consumers to set up carrier account PINs and port-freeze protections, and to shift toward app-based authenticators that are not tied to a phone number at all. The logic is straightforward: if the second factor depends on controlling a phone number, and that number can be reassigned by a determined attacker, then the second factor is only as strong as the carrier’s identity verification process. Hardware security keys and app-based codes stored locally on a device are harder to redirect than text messages that can follow a number wherever it goes.
The hypothesis that carriers adding mandatory real-time customer notifications for any SIM port or swap request would see measurable drops in successful account takeovers, compared with carriers relying only on PIN verification, is plausible but not yet confirmed by the available federal record. None of the DOJ complaints or NIST guidance includes carrier-specific data comparing notification-based defenses against PIN-only defenses. The prosecutions do show, repeatedly, that attackers succeeded by impersonating victims or corrupting carrier employees, which suggests that PIN-only systems failed at the point of human verification. Without public benchmarks, it remains unclear which combination of carrier policies most effectively blocks fraudulent swaps.
Traced Bitcoin and open questions in SIM-swap enforcement
The financial trail in these cases extends well beyond traditional bank accounts. A civil forfeiture complaint filed in the District of Columbia seeks recovery of more than $5 million in Bitcoin that investigators traced back to SIM-swapping victims. According to the Justice Department, attackers intercepted authentication codes, impersonated victims to financial institutions, and converted stolen funds into cryptocurrency. That conversion step complicates recovery, because once funds move to a blockchain wallet, victims depend on law enforcement’s ability to trace and seize digital assets rather than simply reversing a bank transfer.
Tracing those funds often involves following transaction patterns on public blockchains, linking addresses to exchanges, and then serving legal process on intermediaries that hold or move the assets. The forfeiture filing indicates that investigators were able to connect specific wallets to SIM-swap proceeds, but it does not detail which analytic tools or techniques made that linkage possible. For victims, the key takeaway is that recovery may hinge on whether stolen money touched a regulated platform where authorities can still intervene, as opposed to remaining in self-custodied wallets beyond immediate reach.
Several questions remain open. The DOJ filings do not include internal carrier logs showing exactly how many minutes elapsed between a swap request and account access, which would quantify the window victims have to react. No bank statements in the public record detail whether real-time fraud detection systems flagged the suspicious logins that followed the swaps. And NIST’s guidance, while clear about the risk, does not include validation studies measuring how often organizations still rely on SMS-based authentication despite the published warnings. These gaps make it difficult to assess whether current industry practices have meaningfully shifted in response to federal recommendations and high-profile prosecutions.
Practical steps for reducing SIM-swap risk
For anyone whose financial accounts still depend on text-message codes, the first practical step is to call the mobile carrier and request both a port-freeze and an account PIN, then switch any critical logins to stronger forms of two-factor authentication. A port-freeze makes it harder for an attacker to move a number to a new SIM without in-depth verification, while a unique PIN adds friction for anyone trying to impersonate the account holder. Where banks, brokerages, or cryptocurrency exchanges offer app-based authenticators or hardware keys, enabling those options can sharply reduce exposure to number hijacking.
Consumers can also limit the amount of personal data available to fuel social engineering. Many SIM-swap schemes begin with information harvested from data breaches, public records, or social media profiles. Reducing the visibility of birthdates, addresses, and other identifying details makes it more difficult for attackers to answer carrier security questions convincingly. Monitoring bank and email alerts closely, and treating any sudden loss of cell service as a potential sign of fraud rather than a routine outage, can further narrow the time window in which an attacker can exploit a successful swap.
On the institutional side, aligning authentication flows with NIST’s risk-based guidance means treating phone-number-based verification as one signal among many, not as a definitive proof of identity. Financial institutions that continue to support SMS codes can still cross-check device fingerprints, IP reputation, and recent SIM-change data from carriers before approving sensitive actions. Combined with rapid customer notifications when a number is reassigned or a new device logs in, those layered checks can make the kind of fast-moving theft described in recent indictments significantly harder to pull off.
Ultimately, the recent prosecutions and forfeiture efforts show that SIM swapping has matured into a structured criminal service with real financial stakes. Federal standards already recognize the inherent weakness of phone-number-based security, and investigators have demonstrated that even cryptocurrency conversions leave trails that can be followed. The remaining challenge is whether carriers, banks, and consumers will act on those lessons quickly enough to keep a stolen phone number from turning into an empty bank account.
More from Morning Overview
*This article was researched with the help of AI, with human editors creating the final content.
