SIM Swap Fraud: How Attackers Take Over Your Phone Number

Your mobile phone number is the single most important identifier in your digital life in East Africa. It is your mobile money account. It is the recovery method for your email. It is the two-factor authentication channel for your bank. Whoever controls that number controls the accounts attached to it.

SIM swap fraud — also called SIM porting or SIM hijacking — transfers your phone number from your physical SIM card to a SIM card in an attacker's possession. The attack takes minutes. The damage can take months to reverse.

How attackers gather the information they need

SIM swaps do not require technical sophistication. They require social engineering — specifically, convincing a mobile network operator's customer service representative that the attacker is you.

To pass this verification, attackers need personal information: your full name as registered, your national ID number, your date of birth, the last few digits of your account number, or the answer to a security question. Much of this information is available through social media profiles, previous data breaches, or direct social engineering of the victim.

The attack sequence

Once an attacker has enough information, they contact your mobile network operator — in person at a retail outlet or by phone — and request a SIM replacement. They claim their SIM was lost or damaged. They provide the personal information gathered. If the verification passes, the operator deactivates your SIM and activates a new one in the attacker's hands.

Within seconds, your phone loses signal. The attacker's phone begins receiving your calls and messages — including one-time codes from your bank, mobile money reset confirmations, and account recovery links.

The warning signs before a SIM swap completes

Your phone loses signal unexpectedly and does not recover when you move to a different location. You receive an unexpected notification about a SIM change or account update. You can no longer make calls or receive messages despite being in a coverage area.

If this happens, call your mobile network operator immediately from a different phone and ask them to freeze your account.

Reducing your exposure

Register a PIN or verbal passphrase with your mobile network operator specifically for account changes. Use authenticator apps rather than SMS for two-factor authentication wherever possible. Avoid sharing your national ID number, full date of birth, or registered name publicly on social media.

Lindanix cannot prevent a SIM swap once it has begun at the operator level, but it can identify messages attempting to gather the information attackers need — and flag them before you respond.