SIM swap fraud has exploded from a telecom concern into a universal threat impacting all industries. Recent cyberattacks on major retailers like M&S and Harrods show that any business handling customer data is now at risk. In just the first half of 2024, SIM swap incidents in the UK surged by over 1,000%, with £5.35 million in financial losses attributed to SIM swap fraud between 2023 and 2024.

The fallout goes beyond financial damage. Communications fraud now threatens brand reputation, disrupts supply chains, and erodes customer trust. As cyber threats evolve, businesses must shift their focus from simply maintaining service to actively safeguarding sensitive data, especially as regulatory scrutiny and potential fines intensify.

No business, regardless of size or sector, can afford to treat communications security as optional. Advanced, layered security and firewall are now essential for protecting customer data, maintaining trust, and safeguarding business operations.

What is SIM swap fraud?

In short, here’s how it works:

• Cybercriminals legally or illegally get access to your data (including mobile phone number) and contact mobile network operators (MNOs) pretending to be you.
• They deceive the MNOs into activating a new SIM card with your phone number.
• Once the new SIM card is activated, fraudsters can access every one-time-pin (OTP) and two-factor authentication (2FA) message sent to that number, effectively gaining access to all your accounts that use your phone number for verification.

This lets them receive all calls and SMS messages sent to the original number, including OTPs and 2FA codes used by banks, retailers, and online services for two factor authentication.

Armed with access to these codes, fraudsters can reset passwords, drain bank accounts, make unauthorized purchases, and steal sensitive business data.

Social engineering is at the heart of most SIM swap attacks, with fraudsters exploiting personal data from breaches or phishing, and sometimes even recruiting insiders within telecom operators (BioCatch/Financial Times, May 2023).

Why is SIM swap fraud on the rise?

SIM swap fraud thrives due to our growing dependence on phone numbers for security key accounts, oversharing personal information online, and gaps in telecom security practices.

When personal details are easily accessible through social media or data breaches, scammers can impersonate victims and convince mobile operators to transfer their number to a new SIM card, often bypassing weak verification steps.

This enables attackers to gain control of sensitive accounts protected by two-factor authentication, putting both individuals and businesses at risk.

Several other trends are fueling the dramatic spike in SIM swap fraud:

• Widespread reliance on SMS and OTPs for verifying digital identity means a single compromised phone number can unlock multiple accounts.
• Massive data breaches across industries have put personal information needed to pull off a SIM swap within easy reach of attackers.
• AI and automation make it easier than ever for fraudsters to launch convincing phishing attacks and social engineering campaigns at scale.

The result? SIM swap fraud is now a top risk not just for telecoms but also for retailers, eCommerce providers, banks, fintech, and consumers worldwide. In the U.S., the FBI estimates average losses of $10,000 per victim (IC3 Report). As more businesses move to mobile, this risk will only grow.

Impact of SIM swap on Retail & eCommerce and how to prevent it

Trust and revenue at stake

SIM swap attacks are increasingly targeting retailers and eCommerce platforms. These attacks can result in unauthorized purchases, emptied loyalty accounts, lost revenue, data breach, and customer access.

These incidents don’t just mean financial losses, they can also trigger operational disruptions and long-term reputational damage. When high-profile breaches make headlines, brands risk losing the very trust they’ve built with their customers.

How can businesses protect themselves and their customers?

Effective SIM swap fraud prevention in retail and eCommerce starts with layered security:

• Integrate SIM swap detection from network APIs into fraud prevention workflows. If a SIM swap is detected, require extra identity verification—such as biometric authentication—before allowing sensitive actions like high-value purchases or password changes.
• Combine telco data with behavioral analytics to flag suspicious login attempts, location changes, or account updates.
• Educate customers at critical touchpoints (like checkout and profile updates) about the risks of SIM swap attacks and best practices for digital identity protection.

Impact of SIM swap on telecom operators and how to prevent it?

Telecom operators occupy a unique position as both frequent targets and frontline defenders against SIM swap fraud. If attackers slip past weak verification processes, telcos can face regulatory fines, customer churn, operational costs, and severe reputational harm. The responsibility to detect and prevent SIM swaps is greater than ever.

Best-in-class telecom security now includes:

• AI-driven analytics to monitor for abnormal SIM swap patterns—such as mass porting events or sudden changes in user location.
• Stricter internal controls: Limiting and rotating employee access to SIM management systems, and enforcing multi-factor authentication for staff.
• Active customer confirmation: Requiring direct digital approval from customers before processing any SIM changes, closing a key social engineering loophole.

Impact of SIM swap on banks & financial services and how to prevent it

For banks, fintechs, and financial service providers, SIM swap fraud can swiftly undermine SMS-based two-factor authentication, opening the door to direct financial theft, regulatory breaches, and customer attrition.

The speed and scale of SIM swap-enabled attacks make robust fraud prevention critical in financial services.

Leading financial institutions are adopting a multi-layered approach:

• Adopt out-of-band authentication methods such as secure banking apps, push notifications, or voice biometrics instead of relying solely on SMS OTPs.
• Monitor recent SIM activity: Flag accounts with recently swapped SIMs and require additional verification for high-risk transactions.
• Establish real-time data sharing with telcos via network APIs, so that suspicious activity can be detected and stopped before funds are lost.

How to detect and prevent SIM swap fraud?

To detect SIM swap fraud, businesses can check for changes to a mobile user’s phone number (MSISDN) and International Mobile Subscriber Identity (IMSI) number.

An IMSI number is unique to each SIM card and is used to identify every mobile phone subscriber on a UMTS or GSM network. The IMSI remains unchanged even when a mobile (MSISDN) number is ported to a different SIM card.

Our Mobile identity solution can assist enterprises in mitigating SIM swapping by recent changes in the MSISDN – IMSI combination on the side of the mobile operator.

In other words, it can provide information on which phone number is currently assigned to a particular SIM card. Most commonly, business trigger a SIM swap check right before a high-risk action, such as a large transaction or password reset, to ensure the request is coming from the legitimate user. If a SIM swap is detected, businesses can require additional verification before allowing the action to be taken.

Strengthening fraud prevention with RCS and Network APIs

Combining Rich Communication Services (RCS) with Network APIs gives telcos and enterprises a smarter, more secure way to deliver trusted and high-impact messaging.

APIs for SIM swap detection, Silent Number Verification, Know Your Customer (KYC) checks, and device location enable businesses to build fraud protection and identity assurance directly into the messaging flow, without adding friction for users.

Delivered through RCS with verified sender profiles, these interactions feel seamless to customers while giving businesses more control and security than traditional SMS or OTT apps.

As demand for secure, high-engagement channels grows, Network APIs become a new source of value. By offering them alongside RCS as a managed service, operators can position themselves as trusted technology partners while generating new revenue through API consumption.

Infobip’s role in securing the ecosystem from SIM swap fraud

Working with businesses across industries, we can confidently say that effective SIM swap fraud prevention is never about one tool or one policy. It’s about layering the right technologies, processes, and ongoing education.

As attackers evolve their tactics, businesses must adapt, updating their strategies to protect their customers, their brand, and their bottom line.

Here’s how we help businesses stay protected:

• Real-time network intelligence: Our SIM Swap Detection API instantly alerts you to SIM changes, so you can pause suspicious activity and require extra verification before fraud occurs.
• Modern network firewalls: Anam Protect detects and blocks unauthorized SIM swaps and suspicious port-outs at the network edge.
• Stronger mobile identity verification: Silent verification, device-binding, and biometrics reduce dependence on vulnerable SMS codes.
• RCS fraud prevention: Verified RCS business messaging, complete with brand logos and sender checkmarks, ensures secure and trusted customer communication.
• AI and behavioral analytics: We flag unusual behaviors, such as device swapping or rapid transaction patterns, allowing for fast, targeted intervention.

What sets our approach apart is a commitment to ongoing vigilance, customer education, and close collaboration with industry partners. Fraud tactics never stand still, neither do we.

Every business is a target, but you can take action!

SIM swapping fraud is not just a telecom issue or a banking risk. It is a serious threat that can lead to significant financial loss and reputational damage. However, by taking proactive measures, both individual mobile users and businesses can significantly reduce the risk and consequences.

Ultimately, staying ahead of attackers requires continuous effort, collaboration, and adaptation. Businesses that prioritize security at every level, the right technology, process, and people are best positioned to safeguard their customers, protect their reputation, and thrive in today’s mobile-first world.

Imagine your phone has been stolen or hacked and you need to verify your identity to change bank account passwords. But then you discover that the only way to do this is with a code sent to….you guessed it – the phone you no longer have control of.

Or say you are at work registering to buy tickets for Talyor Swift’s new tour and the clock is ticking. But there is a problem – you don’t have cell signal, and you need a One-Time-Pincode (OTP) sent to you by SMS to verify that you aren’t a ticket-hogging bot.

We can tell you how to avoid getting into this situation (which we will later on), but that won’t help you right now. You want to know how to bypass the verification process or receive an OTP verification some other way.

We are here to help!

How to get a verification code without your phone?

There is no single answer to this question as two-step verification can be implemented in all sorts of ways. However, we can provide a checklist that you can use to hopefully find a solution for your specific situation.

1. Are other forms of verification available?

When you set up your account or signed up for a service you may have been asked to provide a backup phone number or an email address that could be used to verify yourself. Look for a link or prompt that offers an alternate channel for verification when you can’t receive an SMS for whatever reason.

2. Is there another device that you can use?

Even when you don’t have your phone, there may be another device that you have used to access your account previously that has cached your login credentials and is therefore deemed safe by the organization. Maybe a tablet, your work computer, or even an old phone could be used (you wouldn’t have mobile signal without a SIM card but could connect to the internet).

3. Can you use a pre-generated one-off code?

Some organizations provide a set of codes that can each be used once in place of a dynamically generated OTP message. Hopefully you saved these somewhere safe when you first set up your account, but if you didn’t you may be able to log into your account on another device and retrieve them. Be careful to keep these safe as hackers would love to get their hands on them.

4. Can you get verified using an app?

This may only be an option when you have replaced your phone, or if you have another device, but if your service has a mobile app, you may be able to use in-app notifications or push notifications to get verified.

5. Use a third-party authenticator app

If you have set up an authenticator app (like Google Authenticator, or Microsoft Authenticator) on another device, you can generate the OTP directly from the app.

6. Use a QR code for authentication (when you have your phone but no mobile signal)

Some websites and apps support verification by scanning a QR code. If you have another device with a screen, like a computer or iPad, you can use it to display a QR code from a website or app, then use your phone camera to scan the code.

7. Does the organization have a call center?

For retail and banking businesses who are motivated to provide the best possible customer experience, you can usually call a helpdesk number and speak to a human who can authenticate you manually and help you to achieve what you need to do. Calling a business may be intimidating to younger generations, but a friendly support agent would be best placed to solve your problem.

8. Can you authenticate yourself biometrically?

We have seen some businesses automate the verification process and enable customers to interact with a chatbot to authenticate themselves by uploading photos of their ID. One of our customers, the ride hailing mobility app Bolt, uses similar technology to authenticate new drivers. Check out their story here.

9. Can you get limited access to the service without getting fully verified?

In some cases, you can access limited services without going through the full verification process. For example, some banks allow you to check account balances and make payments into an account by providing your login details but not going through the full verification process. To withdraw or transfer funds you would need to be fully verified.

10. Get verified by other users

We have only seen this feature available in TikTok, but it is a brilliantly simple way of getting your identity verified by your contemporaries that is likely to go mainstream. TikTok already offers excellent account safety and recovery support but this feature goes further than most by enabling locked out users to forward verification requests to friends and other users who know them.

I’ve got my phone but I’m not receiving verification codes

There can be all sorts of reasons for not receiving codes. It could be a temporary network glitch that will rectify itself in a few minutes, or a setting on your phone that needs to be changed. Here are some options that you can check.

Did you enter your phone number correctly?

This may seem obvious, but best to check. You could have made a simple typo or the service may require the number to be entered in a particular format. For example, some international services may require the country’s dialing code and no leading zero in the number i.e. +44 (0)78555 555 555

Restart your device or toggle airplane mode on and off

Always a favorite with IT support, a simple restart can resolve temporary glitches. Alternatively, turning Airplane mode on for a few seconds can reset your network connection.

Does your phone block texts from unknown numbers?

You may need to change your phone settings if you have any SMS filters or spam blockers enabled. Sometimes a phone operating system update can introduce new settings or reset existing ones.

Did a verification email get sent to your junk folder?

If you have enabled email verification in addition to SMS then the email may have ended up in your junk folder. To avoid this happening in the future, mark the verification code sender as trusted to ensure codes go straight to your inbox.

Contact your cell provider

If none of these options work, you should contact your provider. They will know about any network outages or issues with your account that require action from their side.

Unfortunately, for large platforms like Google, Microsoft and others who have millions of customers, the verification process is managed by AI as it is not feasible to support it with human staff. As a result, it can sometimes appear rather inflexible.

Take a look at this genuine exchange from the Google support page (we’ve changed names and removed some irrelevant detail)

You can sense the frustration that this user is feeling, and they are not alone with internet message boards and support forums full of people in a similar predicament. However, the news isn’t always good.

If you didn’t take the suggested precautions, you may have to accept that your account is lost, or you won’t be able to get those concert tickets that you had your heart set on.

Alternatively, you may want to try the following resources for help:

• How to recover your Gmail or Google account
• Get help with Microsoft account recovery
• Recover your Facebook account without email or phone number
• Recover your Amazon account after two-step verification fails

When you get your new phone, you will probably be motivated to explore the options you have to avoid getting into the situation again. If your provider doesn’t support any of these, you may be tempted to switch to one that does.

There are lots of ways that you can avoid getting into the situation where you are unable to complete a verification process because you can’t access your phone or don’t have signal.

Not all services and apps will support these approaches, but if you live somewhere with patchy network coverage or you travel a lot then you should be aware of the available options.

1. Add a backup phone number to your account

If the service offers this option, then you should add another phone number that you can receive OTPs on. This could be a mobile device belonging to a family member, or a landline that you can use to receive verification codes by voice.

2. Add a backup verification channel

Many more services now offer the option to send verification codes by email, or messaging apps like WhatsApp, Viber, and Messenger. Take advantage of this flexibility and add your favorite channel that can be accessed via the internet for when you don’t have network signal.

3. Use a native app

Businesses will often offer incentives to customers to opt in to receiving messages via their app. This is because it is cheaper for them, and that includes OTPs and other verification messages. This is another good option to get verified when you have an internet connection but no cell signal.

4. Use a physical device

Hardware authentication devices usually come as key fobs or USB sticks that users can plug into their computer or mobile device, and they either generate OTP codes or directly confirm the person’s identity. They’re very secure but the drawback is that they are small and can be easily misplaced. We would recommend that they are used as a backup verification method along with a flexible omnichannel OTP solution.

5. Use a third-party authenticator app

If a service supports it, you can use an authenticator app like Google Authenticator or Microsoft Authenticator on your device, which you can use generate the OTP directly on your phone.

6. Go old-school and save backup codes

It may seem like a solution from the 2000’s but many services enable users to access a set of one-off OTP codes that can be downloaded when they are logged into their account. These can be saved in a secure location on your phone and/or PC and used in emergencies.

7. Use (trusted) SMS forwarding services

There are some third-party services that offer SMS forwarding to alternate numbers, but we wouldn’t recommend this due to privacy and reliability concerns. It is far better to use the options provided by your own device manufacturer or phone provider.