Unauthorised SIM swaps recorded by UK fraud prevention body Cifas jumped 1,055% in 2024 to almost 3,000 cases, then rose another 38% in 2025, while in the US the FBI’s SIM swap complaint count fell to 982 in 2024 from a 2022 peak of 2,026. Those two numbers point in opposite directions, and both are true: SIM swapping is a gateway crime whose losses usually get booked under some other label. The bigger frame is account takeover, which cost US consumers more than $15 billion in 2025 according to Javelin Strategy and Research, and which Cifas counts at more than 78,000 UK cases in the same year. For the wider identity crime picture, see our identity theft statistics. We aggregated data from the FBI Internet Crime Complaint Center, the FTC, the FCC, Cifas, Javelin Strategy and Research, NIST, Princeton University researchers, telecom regulators in India, Australia, Spain and Belgium, and court records reported by Commsrisk.
TL;DR
- 982 SIM swap complaints and $25,983,946 in losses reported to the FBI in 2024, down from 2,026 and $72,652,571 in 2022 (FBI IC3 Internet Crime Reports).
- 1,611 SIM swap complaints and more than $68 million in losses in 2021, versus 320 complaints and about $12 million across 2018 to 2020 combined (FBI IC3 PSA, February 2022).
- Unauthorised SIM swaps in the UK up 1,055% in 2024 to almost 3,000 cases (Cifas Fraudscape 2025).
- Unauthorised SIM swaps up a further 38% in 2025 (Cifas Fraudscape 2026).
- More than 78,000 UK account takeover cases in 2025, 18% of all filings (Cifas Fraudscape 2026).
- 48% of UK account takeover cases in 2024 involved mobile phone accounts (Cifas, May 2025).
- US account takeover losses exceeded $15 billion in 2025, hitting 6 million consumers (Javelin Strategy and Research, 2026 Identity Fraud Study).
- 1,008,597 complaints and $20.877 billion in total losses reported to the FBI in 2025, up 26% (FBI IC3 2025 report).
- More than 99% of SIM change and port-out requests are legitimate (FCC Report and Order 23-95, November 2023).
- 17 websites found where a SIM swap alone was enough to take over an account (Lee et al., Princeton, SOUPS 2020).
- 27,000 unauthorized SIM swaps at T-Mobile between 2016 and February 2020, per evidence in a $33 million arbitration case (Commsrisk, September 2025).
- India requires a 7-day wait before porting a number after a SIM replacement, effective July 1, 2024 (TRAI via Commsrisk).
1. US Reported SIM Swap Losses: A Peak in 2022, Then a Long Slide
The FBI is the only US agency that publishes a SIM swap line item every year, and its series has an unusual shape. The Internet Crime Complaint Center’s February 2022 public service announcement counted 320 complaints with about $12 million in losses across 2018 to 2020, then 1,611 complaints and more than $68 million in losses in 2021 alone. Reported losses peaked in 2022 at $72,652,571 across 2,026 complaints and have fallen every year since, to $25,983,946 in 2024 (FBI IC3 2024 Internet Crime Report).
Read the decline carefully. Complaints fell 51.5% from 2022 to 2024 (2,026 to 982), but losses fell faster, 64.2% ($72.65 million to $25.98 million), so the average reported loss per complaint dropped from about $35,860 in 2022 to about $26,460 in 2024 (our division of the IC3 totals). The 2023 figure, about $45,394 per complaint, was the high point. A SIM swap is usually the first step of a crypto theft, a bank account takeover or an email compromise, and victims often report the end result rather than the method, so the IC3 line measures what was labeled a SIM swap, not every attack that used one.
| Metric | Value | Source |
|---|---|---|
| SIM swap complaints and losses, 2018 to 2020 combined | 320 complaints, about $12 million | FBI IC3 PSA 220208, February 2022 |
| SIM swap complaints and losses, 2021 | 1,611 complaints, more than $68 million | FBI IC3 PSA 220208, February 2022 |
| SIM swap complaints and losses, 2022 | 2,026 complaints, $72,652,571 | FBI IC3 Internet Crime Report |
| SIM swap complaints and losses, 2023 | 1,075 complaints, $48,798,103 | FBI IC3 Internet Crime Report 2024 |
| SIM swap complaints and losses, 2024 | 982 complaints, $25,983,946 | FBI IC3 Internet Crime Report 2024 |
| Change in complaints, 2022 to 2024 | -51.5% (2,026 to 982) | Calculated from FBI IC3 data |
| Average reported loss per complaint, 2022 / 2023 / 2024 | About $35,860 / $45,394 / $26,460 | Calculated from FBI IC3 data |
Context note: the 2025 IC3 report shows SIM swapping as about 10% of the top threats in its threat breakdown, behind data breaches (39%), ransomware (36%) and alongside malware (9%) and botnets (7%), as reported by CyberScoop. We could not read the 2025 SIM swap complaint row in a fetched copy of the report, so the series above stops at 2024.
2. Account Takeover: The Crime That SIM Swaps Feed
If SIM swap losses look small, it is because the money moves under a different heading. Account takeover losses in the US exceeded $15 billion in 2025 and affected 6 million consumers, an 18% rise in victims from 2024 (Javelin Strategy and Research, 2026 Identity Fraud Study). That works out to roughly $2,500 per victim ($15 billion divided by 6 million), an order of magnitude below the average IC3 SIM swap complaint, which fits the pattern that the costliest phone-number hijacks end up reported to the FBI while routine card and bank takeovers are absorbed by issuers.
The total fraud bill is still rising at the FBI, even as Javelin’s consumer survey shows overall losses easing. IC3 received 1,008,597 complaints in 2025 with $20.877 billion in losses, up 26% from $16.6 billion in 2024 (SecurityWeek). Javelin, by contrast, measured total identity fraud and scam losses falling to $38 billion in 2025, down $9 billion, with identity fraud flat at $27.3 billion and scam losses down 45% to $10.7 billion. Older victims carry a disproportionate share of the FBI total, a theme we track in our elder fraud statistics.
| Metric | Value | Source |
|---|---|---|
| US account takeover losses, 2025 | More than $15 billion | Javelin Strategy and Research, 2026 Identity Fraud Study |
| Account takeover victims, 2025 | 6 million (+18% vs 2024) | Javelin Strategy and Research, 2026 |
| New account fraud, 2025 | $7 billion, 5.4 million victims (+31%) | Javelin Strategy and Research, 2026 |
| Identity fraud and scam losses combined, 2025 | $38 billion (down $9 billion), 36 million victims | Javelin Strategy and Research, 2026 |
| FBI IC3 complaints and losses, 2025 | 1,008,597 complaints, $20.877 billion (+26%) | FBI IC3 2025 report via SecurityWeek |
| Victims aged 60 and over, 2025 | About 201,000 complaints, $7.75 billion (37% of losses) | FBI IC3 2025 report via CyberScoop |
| Identity theft reports to the FTC, 2024 | More than 1.1 million (6.5 million total Sentinel reports) | FTC Consumer Sentinel data, March 2025 |
| Share of fraud reporters who lost money, 2024 | 38% (up from 27% in 2023) | FTC Consumer Sentinel data, March 2025 |
Context note: the FTC’s March 2025 data release put total reported fraud losses at $12.5 billion for 2024, up 25%. The FTC does not publish a SIM swap category; its closest label, ‘Phone Carrier Switching’, is covered in section 6.
3. United Kingdom: The 1,055% Surge and the Counting Problem
The UK produced the most dramatic SIM swap number of the decade. Cifas members filed almost 3,000 unauthorised SIM swap cases to the National Fraud Database in 2024, up 1,055% from 289 the year before (Cifas, May 2025). The surge came with a broader shift toward the telecoms sector: identity fraud linked to mobile products rose 87% to more than 16,000 cases, unauthorised mobile upgrades rose 96%, and 48% of all account takeover cases involved mobile phone accounts. The Fraudscape 2026 update, published on 12 March 2026, recorded a further 38% rise in unauthorised SIM swaps in 2025, which Cifas attributes to stolen personal data and increasingly automated attack methods.
The UK also illustrates how fragile these counts are. Action Fraud, the national reporting centre, recorded 558 SIM swap reports in 2022, 1,070 in 2023 and 2,037 by late November 2024, roughly a doubling rather than a tenfold jump. In 2023 the Action Fraud figure was almost four times the Cifas figure, before the ratio reversed in 2024 (Commsrisk, July 2025). Both series agree on direction; they disagree sharply on speed.
| Metric | Value | Source |
|---|---|---|
| Unauthorised SIM swaps, 2024 | Almost 3,000 cases (+1,055%, from 289 in 2023) | Cifas Fraudscape 2025 |
| Unauthorised SIM swaps, 2025 | +38% year on year | Cifas Fraudscape 2026 |
| SIM swap reports to Action Fraud | 558 (2022), 1,070 (2023), 2,037 (to late November 2024) | Action Fraud via Commsrisk, July 2025 |
| Account takeover cases, 2024 | Over 74,000 (+76%) | Cifas Fraudscape 2025 |
| Account takeover cases involving mobile phone accounts, 2024 | 48% | Cifas, May 2025 |
| Identity fraud linked to mobile products, 2024 | More than 16,000 cases (+87%) | Cifas, May 2025 |
| Unauthorised mobile upgrade filings, 2024 | +96% | Cifas, May 2025 |
| Account takeover share aged 61 and over, 2024 | 29% (filings +90% year on year) | Cifas, May 2025 |
Context note: Cifas data reflects cases filed by its member organisations, so a new member joining or a change in filing practice can move the numbers sharply. Treat the 1,055% figure as a signal of change in a small base, not as a measure of total UK incidence.
4. The National Fraud Database in 2025: Takeover Becomes the Default Play
The 2025 Cifas numbers show criminals shifting from opening fake accounts to hijacking real ones. More than 78,000 facility (account) takeover cases were filed in 2025, 18% of all filings and 6% more than in 2024, while identity fraud filings fell 3% to 242,000 (Cifas Fraudscape 2026). Cases linked to mobile phone products continued to dominate, and together with online retail and personal credit cards they made up around 90% of all takeovers.
The tactics are getting quieter. Cifas reports that criminals are disabling alerts and altering account details gradually to avoid detection, and are using AI to improve malicious messages and automate credential attacks, the same toolset behind the impersonation calls in our voice AI scam statistics. Overall filings set a record: more than 444,000 cases, over 1,200 a day, after 421,000 in 2024 (Cifas Fraudscape 2025).
| Metric | Value | Source |
|---|---|---|
| Total National Fraud Database cases, 2025 | More than 444,000 (+6%), over 1,200 per day | Cifas Fraudscape 2026 |
| Total National Fraud Database cases, 2024 | 421,000 (+13%) | Cifas Fraudscape 2025 |
| Account takeover cases, 2025 | More than 78,000 (18% of filings, +6%) | Cifas Fraudscape 2026 |
| Mobile, online retail and credit card share of takeovers, 2025 | Around 90% | Cifas Fraudscape 2026 |
| Identity fraud and account takeover share of all cases, 2025 | 72% | Cifas Fraudscape 2026 |
| Identity fraud filings, 2025 | 242,000 (54% of cases, -3%) | Cifas Fraudscape 2026 |
| Fraud losses prevented by Cifas members | £2.1 billion (2024), £2.4 billion (2025) | Cifas Fraudscape 2025 and 2026 |
5. Inside the Carrier: Insiders, Social Engineering and Court Evidence
Most SIM swaps succeed at a store counter or a support desk, and recent litigation has put rare numbers on that. In an arbitration case against T-Mobile US that ended in a $33 million award, evidence described 27,000 unauthorized SIM swaps at the carrier between 2016 and February 2020, and an internal report found 478 customer accounts accessed through a single compromised employee credential (Commsrisk, September 2025). A perpetrator quoted in the case claimed a 90 to 100% success rate in obtaining staff credentials. These are figures from one carrier’s litigation, not an industry rate, but they show why regulators now target employee access.
The insider risk is not limited to telcos. At Société Générale in France, an intern fed customer data to a SIM swap ring that stole more than EUR 1 million from 50 customers, all of whom were reimbursed (Commsrisk, June 2025). Data breaches at carriers raise the stakes further: the Orange Belgium breach exposed 850,000 customer accounts, including SIM card numbers and PUK codes, prompting the regulator BIPT to require an SMS warning on port-out requests with an 8-day window to reply STOP (Commsrisk, September 2025).
| Metric | Value | Source |
|---|---|---|
| Unauthorized SIM swaps at T-Mobile US, 2016 to February 2020 | 27,000 | Jones v. T-Mobile arbitration evidence via Commsrisk, September 2025 |
| Arbitration award to one SIM swap victim | $33 million | Jones v. T-Mobile via Commsrisk, September 2025 |
| Accounts accessed via one compromised employee credential | 478 | T-Mobile internal report via Commsrisk, September 2025 |
| Société Générale insider SIM swap ring | 50 customers, more than EUR 1 million stolen | Le Parisien via Commsrisk, June 2025 |
| Orange Belgium breach | 850,000 customer accounts exposed | BIPT and Orange Belgium via Commsrisk, September 2025 |
| Bitcoin stolen in a 2021 Rogers SIM swap case | CAD 534,000 then, about USD 1.3 million now | British Columbia Supreme Court via Commsrisk, July 2025 |
| US crypto theft lawsuits blaming lax security | 11 in 2023 vs 20 in 2022; over 50% cite SIM swaps | Bloomberg Law via Commsrisk, April 2024 |
Context note: carrier staff remain a social engineering target in the same way call center agents are; the US Cyber Safety Review Board’s review of the Lapsus$ attacks (August 10, 2023) examined how that group used SIM swapping against large organizations.
6. Regulation and Enforcement: From the FCC to TRAI
The FCC’s order on SIM swap and port-out fraud is the main US policy response. Adopted on November 15, 2023, it requires wireless providers to use secure authentication before a SIM change, notify customers immediately of SIM change and port-out requests, offer account locks, keep employees away from customer data until a customer is authenticated, and keep records (FCC Report and Order 23-95). The order also gives a sense of the complaint baseline: the FCC received about 300 SIM swap or port-out complaints in 2020, 400 in 2021 and 500 in 2022, while the FTC logged 966 ‘Phone Carrier Switching’ reports in 2020, 157 in 2021 and 188 in 2022.
Compliance arrived late. The original deadline of July 8, 2024 was pushed back by a July 5, 2024 FCC waiver until the paperwork review by the Office of Management and Budget was complete; OMB approval was issued on January 15, 2025 (Nelson Mullins). Other regulators moved with blunter tools: India’s TRAI imposed a 7-day wait before porting after a SIM replacement from July 1, 2024 (Commsrisk), Australia’s ACMA fined Medion Australia AUD 259,440 after nine unauthorized swaps (Commsrisk), and Spain’s data protection authority AEPD has fined telcos repeatedly (Commsrisk).
| Metric | Value | Source |
|---|---|---|
| FCC SIM swap and port-out complaints | About 300 (2020), 400 (2021), 500 (2022) | FCC Report and Order 23-95, November 2023 |
| FTC ‘Phone Carrier Switching’ reports | 966 (2020), 157 (2021), 188 (2022) | FTC Consumer Sentinel data cited in FCC 23-95 |
| Share of SIM change and port-out requests that are legitimate | More than 99% | FCC Report and Order 23-95 |
| FCC rules: original compliance date / OMB approval | July 8, 2024 (waived) / January 15, 2025 | FCC DA 24-649; Nelson Mullins, 2025 |
| India wait before porting after SIM replacement | 7 days, from July 1, 2024 | TRAI via Commsrisk, June 2024 |
| ACMA fine on Medion Australia | AUD 259,440; AUD 160,000 customer losses; 1,697 SIM replacements without ID checks | ACMA via Commsrisk, January 2024 |
| AEPD fines on Spanish telcos | Digi EUR 970,000 across 12 fines; Movistar EUR 900,000 across 3 | AEPD via Commsrisk, April 2024 |
Context note: Commsrisk notes that more than 1 in 20 of all known GDPR fines in Europe have been issued by the AEPD against Spanish telcos, largely over duplicate SIMs issued to impostors.
7. Authentication: Why the Phone Number Is the Weak Link
The defensive story is a slow move away from the phone number as proof of identity. A Princeton study of five US prepaid carriers found that their authentication challenges could be subverted, and after reverse-engineering the policies of more than 140 websites that use phone-based authentication, the authors found 17 sites where a SIM swap alone, with no password, was enough to take over an account; nine of the 17 companies left the flaw unfixed after disclosure (Lee et al., SOUPS 2020). The study is from 2020 (most recent available academic measurement), but it is the evidence base the FCC order cites.
Standards bodies have since caught up. NIST’s SP 800-63B-4, finalized on August 26, 2025, keeps out-of-band codes over the public phone network in the ‘restricted’ category and says verifiers should check risk indicators such as a SIM change or number porting before sending one. Telcos now expose that signal directly: the CAMARA open-source SIM Swap API, at version 2.1.0 since September 2025, lets a bank ask whether a number’s SIM changed recently before trusting an SMS code (CAMARA Project). Our two-factor authentication statistics cover adoption of the app-based and passkey alternatives.
| Metric | Value | Source |
|---|---|---|
| US prepaid carriers tested | 5, all using challenges that could be subverted | Lee et al., Princeton, SOUPS 2020 |
| Websites with phone-based authentication analyzed | More than 140 | Lee et al., SOUPS 2020 |
| Websites vulnerable to takeover via SIM swap alone | 17 | Lee et al., SOUPS 2020 |
| Companies that left the flaw unfixed after disclosure | 9 of 17 | Lee et al., SOUPS 2020 |
| NIST status of phone-network one-time codes | ’Restricted’ (SP 800-63B-4, August 26, 2025) | NIST SP 800-63B-4 |
| Carrier review of authentication methods required | At least annually | FCC Report and Order 23-95 |
| CAMARA SIM Swap API | v2.1.0 stable, September 2025 | CAMARA Project (Linux Foundation) |
Summary: SIM Swap Fraud by the Numbers
| Metric | Value | Source |
|---|---|---|
| US SIM swap complaints and losses, 2024 | 982 complaints, $25,983,946 | FBI IC3 Internet Crime Report 2024 |
| US SIM swap peak, 2022 | 2,026 complaints, $72,652,571 | FBI IC3 Internet Crime Report |
| US SIM swap complaints and losses, 2021 | 1,611, more than $68 million | FBI IC3 PSA, February 2022 |
| Average reported loss per SIM swap complaint, 2024 | About $26,460 | Calculated from FBI IC3 data |
| SIM swapping share of top threats, 2025 | About 10% | FBI IC3 2025 report via CyberScoop |
| Total FBI IC3 losses, 2025 | $20.877 billion (+26%) | FBI IC3 2025 report |
| US account takeover losses, 2025 | More than $15 billion, 6 million victims | Javelin Strategy and Research, 2026 |
| UK unauthorised SIM swaps, 2024 | Almost 3,000 (+1,055%) | Cifas Fraudscape 2025 |
| UK unauthorised SIM swaps, 2025 | +38% | Cifas Fraudscape 2026 |
| UK SIM swap reports to Action Fraud, 2023 | 1,070 | Action Fraud via Commsrisk |
| UK account takeover cases, 2025 | More than 78,000 (18% of filings) | Cifas Fraudscape 2026 |
| Mobile phone share of UK account takeovers, 2024 | 48% | Cifas, May 2025 |
| Account takeover share aged 61 and over (UK, 2024) | 29% | Cifas, May 2025 |
| Losses of US victims aged 60 and over, 2025 | $7.75 billion (37% of total) | FBI IC3 2025 report |
| Unauthorized SIM swaps at T-Mobile, 2016 to 2020 | 27,000 | Arbitration evidence via Commsrisk |
| Legitimate share of SIM change and port-out requests | More than 99% | FCC 23-95 |
| FCC SIM swap and port-out complaints, 2022 | About 500 | FCC 23-95 |
| Websites open to takeover via SIM swap alone | 17 of 140+ studied | Princeton, SOUPS 2020 |
| India porting wait after SIM replacement | 7 days | TRAI, July 2024 |
Methodology and Sources
Every figure above was read during research for this article. Where a primary document could not be read directly (the FBI IC3 annual report PDFs did not render as text, and fcc.gov, GSMA and IDCARE pages blocked automated access), we used named intermediaries that cite the original document and say so in each table. SIM swap statistics circulating on vendor blogs without a primary source, including round ‘per victim’ and ‘minutes to drain’ figures, were excluded.
- FBI Internet Crime Complaint Center: PSA 220208, February 2022, 2024 Internet Crime Report (SIM swap rows for 2022 to 2024 read via MessageCentral and Efani summaries of the report), 2025 Internet Crime Report via SecurityWeek and CyberScoop
- Federal Trade Commission: Consumer Sentinel 2024 data release, March 2025
- Javelin Strategy and Research: 2026 Identity Fraud Study press release, April 21, 2026
- Cifas: Fraudscape 2026, Fraudscape 2025, SIM swap and telecoms release, May 2025
- Federal Communications Commission: Report and Order FCC 23-95, Order DA 24-649, OMB approval date via Nelson Mullins and compliance delay via Commsrisk
- NIST: SP 800-63B-4, August 2025
- Princeton University: Lee, Kaiser, Mayer and Narayanan, An Empirical Study of Wireless Carrier Authentication for SIM Swaps, SOUPS 2020
- CAMARA Project: SIM Swap API
- US Cyber Safety Review Board: Review of the Attacks Associated with Lapsus$, August 2023
- Commsrisk (reporting on court records, regulators and Action Fraud): UK SIM swap statistics, T-Mobile arbitration, Orange Belgium and BIPT, Société Générale, Rogers case, Bloomberg Law crypto lawsuits, TRAI 7-day rule, ACMA fine, AEPD fines
- Data watch: The FBI IC3 2025 SIM swap complaint and loss row could not be confirmed in a fetched copy of the report, so the US series ends at 2024; expect the 2025 row to continue the downward trend in reported losses. IC3 figures for 2022 to 2024 were read through secondary summaries of the official report and agree across them. UK sources conflict: Cifas reports a 1,055% rise in 2024 (from 289 to almost 3,000) while Action Fraud shows roughly a doubling (1,070 to 2,037 by late November 2024), and 289 x 11.55 does not reconcile exactly with ‘almost 3,000’, so treat the percentage as approximate. Javelin’s survey shows total fraud losses falling in 2025 while FBI IC3 complaint losses rose 26%; the two measure different populations (a consumer survey vs voluntary complaints). The FCC and FTC complaint counts and the Princeton study date from 2020 to 2022 (most recent available data). The T-Mobile figures come from one arbitration case and are not an industry rate. The exact FCC compliance date after OMB approval was not confirmed from an FCC page during research; one trade source cited March 10, 2025 before the waiver order, which instead tied compliance to the OMB review. GSMA Open Gateway deployment counts and Australia’s IDCARE data were unreachable and are excluded. An FTC Consumer Sentinel Data Book for 2025 was not yet listed on the FTC open data page.
Last updated: October 3, 2026. We update this roundup quarterly, and the next refresh is expected when the FTC publishes its 2025 Consumer Sentinel Network Data Book and Cifas releases its next Fraudscape update.