SIM swaps and two-factor authentication for crypto accounts

How a SIM swap works

A criminal first gathers enough information about you to persuade a mobile carrier, or a carrier shop worker, that they are the rightful customer. They may use data from breaches, social media, discarded bills, phishing messages or a bribe. Once the carrier moves your number to a different SIM, the criminal starts receiving calls and SMS messages meant for you.

That matters because many exchanges, email providers and payment services still use text messages for account recovery codes or sign-in approval. If your password is already known from another breach, the stolen number can be the missing step that turns a password leak into account takeover.

Why SMS codes are the weak point

• A phone number is not a secret. It is designed to be reachable and portable between devices and carriers.
• SMS messages can be redirected by a successful SIM swap, and sometimes exposed by malware or cloud message syncing as well.
• Recovery flows often fall back to the same number. That means the number can both receive the one-time code and approve the password reset.

Stronger second factors

• Authenticator apps. These generate six-digit codes on the device from a shared secret, without depending on your phone number. They are a clear upgrade over SMS.
• Hardware security keys. A USB, NFC or Bluetooth key stores the secret in hardware and proves the site’s origin before it responds. For the accounts that matter most, this is the best common option.
• Recovery codes. Print or write down the emergency codes a service gives you and store them separately, because losing your phone and your authenticator at once is otherwise a lockout risk.

The most important account to protect is your email, because password resets for exchanges and wallets often start there. If your email still uses SMS, upgrading only the exchange account leaves the real weak point in place.

Exchange account hygiene

1. Use a unique password for the exchange and for the email address behind it.
2. Replace SMS 2FA with an authenticator app or security key wherever the service allows it.
3. Turn off SMS-based account recovery if there is another route, or add a carrier PIN if your carrier supports one.
4. Enable withdrawal allowlists and cooling-off periods so a new address cannot receive funds immediately.
5. Review active sessions, trusted devices and API keys. Remove anything you do not recognise.

For business accounts, use role separation as well. One person should not be able to reset the email, the second factor and the withdrawal settings alone.

What to do if your phone suddenly loses service

A dead phone battery or a local outage happens. What is suspicious is when your phone shows service loss without an obvious local reason and stays that way while others nearby still have signal. Treat that as a possible incident, especially if you hold material funds on exchanges.

1. Call your carrier from another phone or go to a shop in person and ask whether the SIM was changed.
2. From a different device, change the password on your main email account first, then your exchange accounts.
3. If those services still use SMS recovery, remove it and move to an authenticator app or security key.
4. Check recent sign-ins, password resets, withdrawal requests and new API keys.
5. After access is restored, review wallet approvals and account activity as a precaution. Wallet health and token approvals help on EVM wallets.