Chances are you’ve received a suspicious text message and deleted it. You likely also blocked spam emails coming in from unknown senders.
But are you aware of the warning signs of SIM-swap scams? Also known as SIM hijacking, this type of account-takeover fraud is on the rise.
In 2024, Toronto Police arrested and charged the people involved in a SIM-swap scheme that affected roughly 1,500 cell phone accounts across Canada.
The financial impact of fraud is significant. Reports from the Canadian Anti-Fraud Centre found that victims of fraud and cybercrime lost more than $638 million in 2024, up from $578 million the previous year. SIM-swap fraud is one such scam contributing to these losses.
Importantly, Canadian Anti-Fraud Centre estimates that only 5-10% of fraud is reported, so the financial loss from fraud is likely much higher.
The good news is you can take measures to help protect yourself against SIM-swap fraud. Here’s what you need to know.
What is a SIM-swap scam?
A SIM-swap scam is when a fraudster tricks your mobile phone carrier into transferring your phone number to a SIM card they control without your knowledge.
Bad actors can do this by gathering personal information about you online, such as your email, address, and phone number. They may also use your social media to collect your personal details.
Once armed with your information, the scammer can contact your wireless provider and impersonate you in order to have your phone number ported over to a new SIM card. (Scammers will likely obtain this information through phishing or purchasing it on the dark web.)
Once the phone number is moved, the fraudster can receive your text messages and calls — including one-time passwords and verification codes. With this information, they can reset account passwords, bypass SMS-based two-factor authentication, or impersonate you with the intention to cause financial harm.
The signs of a SIM-swap fraud
If you suddenly experience a loss of service, that’s a telltale sign of a SIM swap. If your phone unexpectedly shows “no service” and you’re not in a dead zone, it could be a sign your number has been stolen. In this instance, it’s best to contact your mobile carrier right away.
What’s more, if you find yourself suddenly locked out of your banking app, email, or social media accounts, contact or report to the provider immediately. The same goes for receiving unexpected password reset notifications that you didn’t initiate. These are all red flags.
How to help protect yourself against SIM-swap fraud
Set up a PIN or passcode with your mobile carrier
Most wireless carriers allow customers to set up a unique PIN or password that must be provided before account changes can be made. This unique PIN or password should be private and only known to you. This is one of the simplest ways to stop unauthorized access.
Use stronger two-factor authentication than SMS
Instead of using your mobile phone number for two-factor authentication, consider using an app-based authenticator or hardware key. An app-based authenticator will add an additional layer of security that generates a temporary, time-based one-time passwords on a device versus a code texted to your mobile device
To learn more about two-factor authentication, visit the Canadian Centre for Cyber Security’s info page here.
Minimize public exposure of personal data
Avoid sharing personal information, such as your phone number, address, or birthday, on social media. Posting this information makes it easier for fraudsters to attempt to impersonate you.
Keep your phone updated
Software updates do more than just add new features; they often include critical security enhancements designed to help protect your personal data.
Turn on biometric security measures
Keep your accounts more secure by activating biometric authentication on your phone, such as face or finger-touch ID. This is especially helpful for sensitive accounts, such as your banking app and email.
If you are a victim of SIM-swap fraud
Contact your wireless provider immediately
Make sure to alert your mobile phone provider right away so they can attempt to reverse an unauthorized port (SIM-swap) or suspend the account.
Contact your bank
Alert your financial institution immediately about the fraud so they can take steps to help protect your bank accounts with them.
Report the fraud
File a police report with your local law enforcement and report the fraud to the Canadian Anti-Fraud Centre. This will help the authorities monitor the fraud and how it is impacting people.
Change passwords on accounts that use your phone number for recovery
Start with your most important accounts, such as your banking, email, and social media.
For more information on fraud and how to help protect yourself against it, visit: TD.com/ProtectYourself.