SIM swapping

The main vector is social engineering against the carrier's call center or bribing insider employees. Messages to carrier employees in the US offering modest sums per SIM swap have been documented. Once the number is ported, every one-time-code SMS, every voice verification and every SMS reset reaches the attacker. That allows bypassing SMS-based 2FA on exchanges, email and banking, and from there stealing accounts and funds. It is an attack on the telecom and identity layer, not on the blockchain: it does not touch the private key directly, but it can open the door to it via a custodial exchange or the recovery email.

Regulation has already responded. The US FCC adopted rules on SIM swap and port-out in November 2023, with a compliance date set for July 2024, requiring carriers to securely authenticate the customer before a SIM change or port. They are outcome-based and do not prescribe a specific technology, so some room for social engineering remains. The trend that security reports reflect is a sustained rise in cases, which explains the tightening of the rules.

Mitigations are straightforward: replace SMS 2FA with an authenticator app (TOTP) or with FIDO2 hardware keys and passkeys, set a transfer PIN or passcode with the carrier, lock the number against porting, and never use the phone as the sole factor on accounts tied to assets. In Spain, porting is coordinated by carriers under CNMC supervision, and it is worth setting the above safeguards with the provider. Initiatives such as the privacy-focused carrier Cape, and filings like EPIC's before the FCC, illustrate the response to the phenomenon. SIM swapping is an entry path toward account or key compromise whenever security or recovery depends on the phone.