What does a SIM swap attacker see when they clone your number?

17 October 2026

A SIM swap attacker who successfully clones your phone number sees everything that relies on your number for verification or identification. They gain access to incoming SMS messages, phone calls, and any account that uses your number as a recovery method, second-factor authentication, or login credential. The attacker does not see your old SIM card's content or your phone's local data, but they do see the stream of communications sent to your number after the swap completes.

What the attacker gains immediately

Once the attacker's SIM card activates on your number, your real SIM stops working. The attacker now receives:

• SMS messages: All text messages sent to your number, including authentication codes, bank alerts, and password reset links.
• Phone calls: Incoming calls route to the attacker's device. This includes calls from banks, exchanges, or services that use voice verification.
• Two-factor authentication codes: Any SMS-based 2FA codes now go to the attacker. This is the primary mechanism for account takeover after a SIM swap.
• Password reset links: If a service sends a reset link or code via SMS, the attacker can initiate a password reset on your account and intercept the confirmation message.
• Account recovery attempts: Some platforms send SMS codes when you try to recover a locked account. The attacker sees these too.

What the attacker does not see

• Your phone's stored data: Photos, apps, contacts, and messages saved on your device remain private unless you sync them to cloud accounts that the attacker can now access.
• Your old SIM's history: Past messages and call logs stored on your previous SIM are not transferred to the new one.
• App-based 2FA codes: Authenticator apps (Google Authenticator, Authy, Microsoft Authenticator) are tied to your device, not your phone number. The attacker cannot see codes generated by these apps unless they also gain access to your device.
• Hardware security keys: Physical keys like YubiKeys or Google Titan keys are not affected by a SIM swap.
• Your email accounts: Unless your email provider uses SMS for recovery, the attacker does not automatically gain access to your email inbox.

The attack timeline: what they see step by step

Step 1: the swap completes

The attacker's SIM activates. Your phone loses service. The attacker now sees any SMS or call sent to your number from this moment forward.

Step 2: Reconnaissance

The attacker checks what accounts are linked to your number. They may: - Try to log into your email provider using "forgot password" with SMS recovery. - Attempt password resets on cryptocurrency exchanges, banks, or social media accounts. - Check if your number is registered with messaging apps like WhatsApp or Telegram.

Step 3: account takeover

For each service that sends a verification code via SMS, the attacker sees that code. They can then: - Reset your password. - Change recovery options to their own email or phone. - Disable security alerts. - Withdraw funds, change account settings, or impersonate you.

Step 4: damage control

Once inside an account, the attacker often changes the email, phone number, and password to lock you out permanently. You may receive no further notifications because the attacker controls your number.

How services respond when they see two numbers

Some platforms detect a SIM swap and block sensitive actions for 24 to 72 hours. But many do not. The attacker sees whether your service has protection by how quickly the SMS code arrives. A delayed or denied code suggests the service has a SIM swap detection delay in place.

What you cannot see during the attack

While the attacker sees your incoming messages, you see nothing. Your phone shows "No Service" or "SOS Only." You cannot receive calls or texts. This silence is a red flag, but by the time you notice it, the attacker may have already accessed your accounts.

Making Yourself a Hard Target: What the Attacker Sees Instead

If you take the precautions already covered on this site, the attacker sees much less:

• With a carrier number lock or port freeze: The swap never completes. The attacker sees a failed activation message.
• With app-based 2FA or hardware keys: The attacker sees SMS codes that are useless because you do not use SMS for authentication on critical accounts.
• With a dedicated email for financial accounts: The attacker sees your number, but cannot use it to reset your financial email because that email is not tied to SMS.
• With Google Advanced Protection Program: The attacker sees SMS codes, but your Google account requires a physical security key to log in. SMS alone does nothing.
• With a SIM PIN on your phone: This protects your physical SIM from being swapped to another device if your phone is stolen, but does not prevent a carrier-initiated swap.

The critical difference: what they see vs. what they can use

The attacker sees everything sent to your number, but they can only use what the receiving service accepts. If a bank sends a code via SMS and allows it for password resets, the attacker can use it. If a cryptocurrency exchange sends a code but also requires email confirmation, the attacker needs both. If a service requires a hardware key, the SMS code is irrelevant.

The key takeaway: the attacker always sees your SMS traffic after a swap. Whether that matters depends entirely on what you have linked to your phone number and how those services authenticate sensitive actions. Reducing your number's role in your security setup is the only way to make what the attacker sees worthless.

Back to sim swaps