A criminal can empty your bank account and hijack your social media without ever touching your phone, just by convincing your carrier to hand over your number.
Quick Take
- Federal regulators say SIM swapping and port-out fraud let criminals redirect your calls and texts to a device they control.
- Intercepted two-factor codes can let thieves reset passwords, drain bank accounts, and take over social media profiles.
- A Pennsylvania man was indicted in 2019 for allegedly using social engineering to trick carriers into transferring victims’ numbers.
- Independent testing found attackers succeeded in 39 of 50 attempts against major wireless carriers, exposing weak identity checks.
How Your Phone Number Becomes A Weapon Against You
The Federal Communications Commission spells out two distinct tricks. SIM swapping moves your account to a new SIM card. Port-out fraud moves your number to a different carrier entirely. Both let a criminal receive your calls and texts without stealing your physical phone, according to the agency’s 2021 order on the subject. Once they have your number, they have the keys to almost everything else tied to it.
The FCC’s own consumer warning card puts it bluntly. Intercepting your two-factor security messages can let a thief take over your financial and social media accounts. From there, criminals change your passwords, drain your bank balance, or hold your social media profile for ransom. The phone number you’ve had for years, the one every app trusts to confirm it’s really you, becomes the single point of failure.
Criminals No Longer Need Your Device In Hand
What makes this threat harder to spot is how little criminals need from you directly. A 2023 FCC public notice warns that scammers increasingly pull off these schemes without ever gaining physical control of a victim’s phone. They gather personal details from data breaches, social media posts, or old leaked passwords, then use that information to impersonate you to a customer service representative.
CBS Philadelphia’s reporting lines up with that federal description. Scammers collect personal information from social media and data breaches, then impersonate the account holder to the carrier, convincing an employee to transfer the number to a device the scammer controls. It’s a con built on patience and paperwork, not hacking skill. The weak link is often a rushed customer service call, not a firewall.
A Real Prosecution Shows The Scheme In Action
This isn’t theoretical. In December 2019, federal prosecutors indicted Pennsylvania man Matthew Faulk, alleging he and co-conspirators used fraud, deception, and social engineering to trick cellphone providers into transferring victims’ numbers to devices they controlled, with the goal of stealing cryptocurrency. The case shows real people building entire criminal operations around tricking phone company employees, not computers.
Separate testing backs up how often these tricks work. Researchers who ran 50 controlled SIM-swap attempts against five prepaid carriers succeeded 39 times, including every single attempt against the three major national carriers. Some accounts could be broken into through the number swap alone, even though stronger security options existed and were simply not used.
Regulators Are Moving, But The Phone Number Problem Remains
The Federal Register published new rules in December 2023 requiring carriers to tighten identity verification before approving a SIM swap or port-out request. That’s a real step forward. But the deeper issue predates any single rule: too many banks, apps, and social platforms still treat possession of a phone number as proof of identity, even though that number can be redirected with the right lies told to the right customer service agent.
The fix starts with you, not just your carrier. Add a PIN or passcode to your wireless account specifically for SIM changes. Move away from text-message codes toward authentication apps or physical security keys where your bank or social platform allows it. Watch for a sudden loss of cell signal, since that’s often the first sign your number has already been stolen out from under you.
It was a Saturday afternoon at an airport lounge. My phone showed a network named "Free Airport WiFi," I clicked it and a login page popped up asking for my phone number and email.
Then it asked me to input my email password.
It looked official, and I was tired, so I almost…— SimplyDera ◻ (@Simply_Dera1) October 24, 2026
Common sense says you shouldn’t need a law degree or a cybersecurity certification to protect a ten-digit number from strangers. Yet that’s effectively the burden federal regulators have placed on consumers while carriers close security gaps one rulemaking at a time. Until phone numbers stop functioning as de facto identity documents, Americans will keep paying the price for a system built on convenience instead of caution.
Sources:
youtube.com, fcc.gov, cbsnews.com, docs.fcc.gov, federalregister.gov
