SIM swap fraud: what it means for texted codes

Unauthorised SIM swaps recorded on the UK's National Fraud Database rose 402% in the first half of 2026, compared with the same six months of 2025. The figure comes from Cifas, the fraud prevention body that runs the database, in the six-month update to its Fraudscape report published in August 2026, and the rise amounted to 4,109 extra cases. Cifas's explanation is one sentence long: SIM swaps "are used to intercept authentication codes, bypass security measures, and facilitate wider account compromise". If your business texts one-time codes, this is the attack aimed squarely at your text.

Our post on one-time codes by text covers where NCSC and NIST rank a texted code against other second factors. This one is about the phone number underneath the code: how a criminal takes it over, how often that's happening, what the networks have promised the banks, and what a business can check before it trusts a number.

What is a SIM swap, and when is it fraud?

A SIM swap on its own is routine. CAMARA, an open source project within the Linux Foundation that writes network API specifications, defines it as the point where "a user's mobile phone number (MSISDN) is associated with a new SIM card (IMSI)". Its list of ordinary reasons includes a lost or damaged SIM, a new phone, moving network while keeping the number, and adding a second SIM to the same number.

The fraud is someone else asking for it. Ofcom's policy statement on scam calls and texts, published on 23 February 2022, describes it in two sentences: the scammer "tricks a mobile provider into providing a new SIM card for an account that does not belong to the scammer", and the provider "then cancels the victim's existing SIM card and activates the new one which is sent to the fraudster". From that moment every text to the number, codes included, lands on the criminal's handset.

The first telecoms fraud sector charter, published by the Home Office in October 2021, lists a close cousin alongside it. Under "SIM Swap/ Network Divert Fraud", criminals "use personal data, which may be illegally obtained, and other credentials to pass security checks". Under mobile number porting fraud, "a criminal transfers a victim's number to another network to intercept communications intended for the victim". In both cases the criminal ends up with the number, and so with any code sent to it.

How common is SIM swap fraud in the UK?

Nobody publishes an official count. The nearest thing is the National Fraud Database, where Cifas's members (nearly 800 of them, across banking, retail, insurance and telecoms) file the cases they've identified as fraud. Cifas reports the totals each year in Fraudscape.

Fraudscape 2025, published in May 2025, found unauthorised SIM swaps up 1,055% in 2024: "nearly 3,000 cases from 289 in 2023". Fraudscape 2026, published on 12 March 2026, put 2025 a further 38% higher, a rise Cifas linked to "the growing availability of stolen personal data, and the use of more automated methods for compromising accounts". Then came the first half of 2026 and the 402%. Cifas hasn't given a count for 2025 or for this year, only the percentage changes, so we can't tell you how many cases there were in 2026.

SIM swaps sit inside a bigger category Cifas calls facility (account) takeover, where a criminal gets into an account that belongs to somebody else. Members filed 78,387 takeover cases in 2025, 6% more than in 2024, and the communications sector, which here means mobile phone accounts above all, filed 48,805 of them. That was 13,390 more than the year before, a 38% rise.

Telecoms has been taking a bigger slice every year: 41% of takeover cases in 2023, 48% in 2024 and 62% in 2025. The leading reasons in 2025 were "unauthorised addition of facility" (on a phone account, typically a handset upgrade put on the victim's contract) and "unauthorised security/personal details change".

These are cases filed by members, so they move with how much members report as well as with how much fraud there is. Cifas says as much about the first half of 2026, when telecoms takeover filings fell 23%: that "may reflect changes in reporting patterns, prevention controls, or focus into other targeted products rather than a substantive reduction in threat". (Even after the fall, telecoms filed 51% of takeover cases, 20,214 of them.) And the database only holds fraud that someone spotted and filed.

Is SIM swap how most texted codes get stolen?

The banks' own figures point somewhere else first. UK Finance's Annual Fraud Report 2026, covering 2025, says "intelligence continues to point to social engineering to extract one-time passcodes", which criminals then use "to register digital wallets or make one-off transactions". Remote purchase card fraud, the category where those codes stand guard, reached £423.5 million in 2025, with cases up 13%. In plainer words, a common way for a code to be stolen is for the customer to be talked into handing it over.

A SIM swap is the costlier route, and the NCSC's paper comparing traditional sign-in with FIDO2, published on 23 April 2026, puts it in context. It names "SIM-swap attacks to gain access to codes sent by SMS" next to other routes, including that "malware on Android devices can intercept and capture SMS authentication codes". Its section on account recovery is the one that matters most to anyone sending codes. Attackers go after recovery because it's often weaker than the sign-in itself, and a financially motivated attacker will spend more on the job, "such as paying for a SIM-swap attack on the victim where the recovery flow requires it". A password reset that needs nothing but a texted code is exactly that flow.

There's also a route that never touches the victim's SIM. Ofcom's statement on Global Titles, published on 22 April 2025, says addresses created from UK +44 number ranges are "one of the most significant and persistent sources of malicious signalling traffic affecting mobile networks globally", and that external evidence of their misuse "has included location tracking and the interception of SMS used for 2-step verification (2SV)". Ofcom banned new leasing of Global Titles from that day, banned existing arrangements from 22 April 2026, and gave two specific migration routes until 22 October 2026.

What have the networks promised the banks?

The 2021 charter set out what the mobile networks would do, and Action 4 is the relevant one. The industry "will continue to support the banking industry by supplying a consistent real time check of whether or not a mobile phone has recently been subject to a SIM-swap or MNP" (mobile number porting), using a GSMA account takeover protection standard that every provider supports. The providers would also work with UK Finance so banks knew the data was there, with implementation due within three months to a year. Ofcom's 2022 statement repeated the commitment: providers "will supply a real-time check to financial providers of whether a mobile phone has recently been subject to a SIM swap".

A second charter replaced the first on 5 November 2025, signed for the mobile networks by BT EE, Sky, TalkTalk, Tesco Mobile, Virgin Media O2 and VodafoneThree. It doesn't mention SIM swaps by name. It does commit the networks to "maintain and promote the 12 existing banking-sector fraud prevention APIs", with "increased usage of existing fraud prevention APIs" as a 12-month goal, and to agree sector best practice "including measures such as requiring two-factor authentication before account transfers". The 2021 commitment is what lets a bank ask the network whether a number has just moved before it trusts a text to it. The 2025 charter doesn't say which checks the 12 APIs cover.

How does a SIM swap check work?

The open version of the check is CAMARA's SIM Swap API, which takes its lead from the same GSMA Account Takeover Protection specification the 2021 charter names. Version 2.1.0, in the project's r3.3 release, answers two questions: "When did the last SIM swap occur?" and "Has a SIM swap occurred during last n hours?"

The default window is ten days. Operators can cap it for privacy reasons, and the specification's own example of the error that comes back is "Check monitor period could not exceed local regulations (30 days)". You can't simply call it from a laptop, either: access is "agreed upon during the onboarding process, happening between the provider of the application consuming the API and the operator's API exposure platform". So a small business would normally reach it through a provider that has already done that onboarding.

The standard that tells you what to do with the answer is NIST's SP 800-63B-4, reissued in July 2025. "Verifiers SHOULD consider risk indicators (e.g., device swap, SIM change, number porting, other abnormal behavior)" before using the phone network to deliver a code. And "setting or changing the pre-registered telephone number is considered to be the binding of a new authenticator", which means a number change deserves the same care as adding a new way to sign in.

What should a business that texts codes do?

Most of this costs nothing but a little thought about where the code sits in your sign-in.

• Don't let a text be the only thing that resets an account. If "forgot password" plus a texted code gets someone in, the code is the whole lock. Ask for a second thing as well: a link to the email address on file, a recovery code, or the current password when the number itself is changing.
• Treat a new phone number as a new way into the account, as NIST does. Confirm the change through something the customer already has, and tell them on the old number and by email that it changed.
• Check before the moments that matter: a new payee, a large transfer, a change of address or bank details. If you have a SIM swap check through a partner, ask it with a short window just before you send the code. If you don't, use what you can see, such as a new device or a number added to the account in the last few days, which are the same signals NIST lists.
• Offer an authenticator app beside the text. The app's codes are made on the handset from a secret stored there, so moving the number to a new SIM doesn't move them. Our post on two-step sign-in with an authenticator app explains how those codes work.
• Write the code text for the phone call you can't see. Say what the code is for and say you'll never ask for it.

Hallam Lettings: 731044 is your code to change your bank details. We will never call you to ask for it.

A customer being talked through "just reading out the code" by someone claiming to be from the bank sees, in the text itself, that the code changes their bank details. It won't save everyone, but it gives the customer a chance to notice before the code is read out.

CaptiFi Connect's part in a code flow is delivery. Your application makes the code, stores it and checks it; our verification codes page shows the send with an Idempotency-Key, so a retry can't text the same code twice, and a signed webhook when a text fails, so your app can offer another route straight away. Texts go to UK mobiles only. And when a customer rings to say their phone lost all service an hour ago, take it as a possible SIM swap and hold anything that depends on a code until the number is back with them.