SIM Swap Protection for Crypto Users

A SIM swap attack lets someone take over your phone number. The attacker convinces or bribes a mobile carrier employee to move your number to a SIM card they control. Suddenly your phone loses service, and every text message, including login codes and password resets, goes to the attacker. Crypto users are frequent targets because a single successful attack can unlock exchange accounts, email and social profiles.

How the attack works

A typical SIM swap follows these steps:

1. The attacker gathers personal information from data leaks, social media or phishing
2. They contact your carrier pretending to be you, or recruit an insider
3. The carrier transfers your number to the attacker's SIM
4. The attacker requests password resets and login codes by SMS
5. They take over email, exchange and social accounts, then move funds or post scams

Many victims first notice when their phone shows "No service" unexpectedly.

Which accounts are exposed

Any account that uses your phone number for recovery or two-factor authentication is at risk:

Account type	Risk if number is hijacked
Email	Password resets for everything else
Exchanges	Withdrawals if SMS 2FA is enabled
Social media	Account takeover, scam posts to followers
Messaging apps	Impersonation of you to friends and communities
Cloud storage	Access to stored documents or backups
Banking and payment apps	Financial access

Self-custody wallets are not directly affected by SIM swaps, but seed phrases stored in email or cloud accounts become exposed.

Remove SMS from critical accounts

The most important protection is removing phone numbers as a security method:

• Switch two-factor authentication to an authenticator app or hardware security key
• Remove phone numbers from account recovery options where possible
• Use backup codes stored securely offline
• Prioritise email, exchanges and social accounts first

If a service only offers SMS, consider whether you need that service to hold significant value.

Protect the number itself

You can also make your number harder to move:

1. Ask your carrier about a port-out PIN, SIM lock or account security features
2. Set a strong account password with the carrier
3. Avoid sharing your phone number publicly, especially alongside crypto activity
4. Use a separate number, not linked to your identity online, for accounts that insist on SMS
5. Remove your number from public profiles and data broker sites where possible

Carrier protections vary by country, so check what your provider offers.

Protect your email

Email is often the master key. Secure it with:

• A strong unique password
• Hardware key or authenticator app two-factor authentication
• No phone number recovery option
• Regular review of login activity and connected apps

A dedicated email address for crypto accounts, not shared publicly, adds another layer.

What to do if you are SIM swapped

Act immediately:

1. Contact your carrier from another phone to regain your number
2. Secure your email account first, then change passwords on exchanges and social accounts
3. Revoke active sessions everywhere possible
4. Warn contacts and communities that messages from your accounts may be fraudulent
5. Move self-custody funds if any seed phrases or keys may have been exposed
6. Report the incident to your carrier and relevant authorities

For project teams

Team members who manage official accounts are prime targets. Require authenticator apps or security keys on all project accounts, avoid linking project accounts to personal phone numbers and maintain a response plan. Publishing official links across several independent places, including the website and profiles such as a Proud Globe pin, helps communities verify announcements if one account is compromised.