How Criminals Can Break Into Your Phone and Access Your Accounts

In SIM-swap scams, scammers impersonate customers to get phone companies to transfer their numbers to the criminals

Jessica McMaster,

AARP

Comments

Published April 08, 2026

puppet strings connect a hovering hand to a smartphone and sim card

Elena Lacey

On a quiet evening while babysitting for a neighbor in Coconut Creek, Florida, Patricia Escriva, 61, glanced at her phone and was alarmed: It had stopped working. “I couldn’t send a text. I couldn’t make a call,” she says.

When she connected it to Wi-Fi, her phone came back to life, and alerts began flooding in. Two of the alerts were from her bank. One showed that a new device had been added to her account. Another said her password had been changed.

But it didn’t make sense. Escriva’s husband, who was sick at home at the time, was the only other person who would have access to their bank account.

“I was almost having a heart attack,” Escriva says. “I knew it wasn’t me. I knew it wasn’t my husband. Nobody else [had access to] our account.”

Then charges began to appear, including $1,500 from Nordstrom and $850 from Uber Eats.

Back home, Escriva grabbed her husband’s phone to contact her bank, only to discover that he didn’t have a network connection either.

What she didn’t yet realize was that they had been targeted in a SIM-swap scam — a type of fraud where criminals convince a mobile carrier to transfer a phone number to a device the scammers control.

The criminals were able to raid the couple’s financial accounts and even trade their stocks. After using her credit cards, they paid them off with money from Escriva’s bank account, then made additional purchases.

They stole more than $125,000 from the couple. “It’s an incredibly helpless feeling,” Escriva says.

To the couple’s relief, the bank eventually reimbursed them for the stolen money. (It helped that she reported the loss immediately.) You can hear her full story on this recent episode of AARP’s The Perfect Scam podcast.

How SIM swapping works

A SIM (subscriber identity module) card is a removable chip that connects a phone to a specific mobile network. It allows you to easily transfer your phone number and network settings to another device.

SIM-swapping scams begin with a criminal posing as the cellphone owner in a phone call to the mobile carrier, persuading them to transfer the phone number to another device. It’s the same process used when a person legitimately upgrades their phone, says Joe Hooper, a special agent in charge of the FBI's Phoenix Field Office.

Criminals trade tips and scripts on the dark web to perpetrate these scams, Hooper explains: “There are online groups that talk about exactly how to do this and the different nuances for the different telecommunication companies,” he says.

Once they’re able to transfer the number, criminals get to work immediately, resetting passwords and requesting access to accounts. They’re assisted by the fact that many people are automatically logged into their apps, so they don’t have to enter their passwords manually. This creates an easy environment for criminals to steal everything — “any personal, social or financial information that you have on the phone,” says Hooper.

These attacks often happen overnight, when victims are less likely to notice that their phones have stopped working. By the time the victim is aware of the problem, damage has already been done.

If victims report the fraud to their financial institutions immediately, as Escriva did, the bank may cover the loss.

Fewer cases reported, but still a problem

SIM-swapping cases surged in 2021 and 2022, drawing the attention of federal investigators and prompting public warnings. The numbers look a bit more promising today: “We’ve definitely seen a dip in the losses and then also in the complaints,” Hooper says.

Americans reported criminals stealing more than $26 million through SIM-swap scams in 2024, down from nearly $49 million the year before, according to the FBI’s Internet Crime Complaint Center. This likely represents a fraction of the actual amount lost to this type of scam because so many fraud crimes go unreported.

But experts like Hooper note that SIM swapping remains a problem, and it’s particularly disconcerting for victims because it appears to come out of nowhere. Criminals don’t need to extract passwords and other personal information from their victims; they often rely on previously exposed data, primarily through data breaches.

How to protect yourself

The key? Make it as difficult as possible for criminals to access your accounts.

“Think of this as being very similar to protecting your house,” says Vandana Venkatesh, executive vice president and chief legal officer for Verizon. “When I go to bed, I turn on my alarm system. I make sure all my doors are locked. I make sure my windows are closed. Make sure you’re securing your account.”

That means:

1. Use strong, unique passwords for every account.

2. Avoid automatic logins.

3. Keep passwords and security codes private.

4. Check with your phone provider to see if they offer additional security measures. Venkatesh says Verizon has opt-ins, including a number lock — a free security feature that prevents unauthorized transfers (porting) of someone’s cellphone number to another carrier.

5. Be wary of unsolicited texts, e-mails and calls from your bank or provider. “Verizon is not going to call you out of the blue, asking for your password or your Social Security number or a one-time security code,” Venkatesh says.

If you are a victim of a SIM-swap scam

Contact your bank immediately. Report the fraudulent transaction to your financial institution as soon as you spot it so it can immediately freeze that account and start an investigation.

Notify your cellphone service provider. Verizon, for example, says that when a customer reports an improper SIM swap, the company restores their line, so all calls and texts go to and from their device, and secures their account.

Report the crime to local law enforcement and the FBI’s Internet Crime Complaint Center at IC3.gov

You can also call the toll-free AARP Fraud Watch Network Helpline at 877-908-3360 for advice, support and resources. It’s available Monday through Friday, 8 a.m. to 8 p.m. ET.

%{postComment}%