SIM Swap Attacks: Protecting Your Crypto

What a SIM swap is

An attacker persuades your mobile operator to transfer your number to a SIM they control — through social engineering, forged documents, or a bribed employee. Your phone loses service and every SMS sent to your number goes to them.

Why it targets crypto holders

SMS is still the default second factor on many platforms and the default account recovery channel for many email providers. Control the number and you often control password resets, which means you control the account.

Crypto is a particularly attractive target because transactions are irreversible. A fraudulent bank transfer can sometimes be reversed; a crypto withdrawal cannot.

What it looks like

Your phone abruptly loses signal and shows no service, often outside business hours.
You receive password reset emails you did not request.
You are logged out of accounts unexpectedly.

The loss of service is the signal that matters. If it happens without explanation, treat it as an attack in progress rather than a network fault.

How to protect against it

Remove SMS two-factor everywhere it can be removed, particularly on exchanges and the email accounts attached to them. Use an authenticator app or a hardware security key.
Use a hardware security key where supported. It is the only widely available second factor that resists phishing as well as SIM swaps.
Ask your operator for a port-out lock or additional verification on account changes. Availability varies, but it is worth requesting.
Remove your phone number as a recovery option on email accounts, or replace it with a number not publicly associated with you.
Keep your number off public profiles, particularly anywhere connected to crypto activity.
Store authenticator backup codes offline, so losing the device does not force you back to SMS.

Why this matters in India specifically

SMS-based verification is deeply embedded in Indian financial services, and many platforms still require a mobile number for account recovery. That makes the number a single point of failure across banking, email and exchange accounts simultaneously.

Where SMS cannot be removed entirely, the priority is to ensure it is not the only factor and not the recovery path for the email account that controls everything else.

If it happens

Contact your operator immediately from another line and report the unauthorised port.
From a clean device, change passwords on email and exchange accounts.
Revoke active sessions and API keys everywhere.
Contact affected exchanges to freeze withdrawals.
File a complaint through the National Cyber Crime Reporting Portal.

Why hardware security keys are different

An authenticator app resists SIM swaps but not phishing — a convincing fake page can ask for the six-digit code and use it immediately. A hardware security key resists both, because it verifies the domain cryptographically and simply will not produce a valid response to the wrong site.

For anyone holding meaningful value on an exchange, a security key is the strongest widely available protection, and support for them has improved considerably. Register two, so losing one does not lock you out.

The account that matters most

Your email account is the recovery path for nearly everything else. Securing exchanges while leaving email protected by SMS simply relocates the weak point.

Move email to app-based or hardware-key two-factor.
Remove the phone number as a recovery method, or replace it with one not publicly linked to you.
Review and remove old recovery addresses and forwarding rules — attackers add forwarding to maintain access after a password change.
Check active sessions and sign out unfamiliar ones.

Why attackers know who to target

SIM swaps are not random. Targets are selected from public information — people who post about holdings, appear in leaked exchange data, or are visible in crypto communities with a phone number attached.

Reducing the public association between your identity, your phone number and your crypto activity is a genuine defence, and it costs nothing. Discussing holdings publicly, in particular, converts an anonymous account into a named target.

Recovery codes and the fallback trap

When you enable app-based two-factor, the service gives you recovery codes. Store them offline, on paper, with your other critical backups.

The trap is that without them, losing your phone forces you back to SMS recovery — reintroducing precisely the weakness you removed. A protection that collapses the first time you change handsets was never really in place.