How to Find a SIM-Swap Scammer

A SIM swap, sometimes called SIM hijacking or a port-out scam, is a takeover of your phone number rather than your phone. Every mobile number lives on a carrier account, and the carrier can move that number to a new SIM card or a new eSIM profile whenever a “customer” asks and passes verification. In a SIM swap, the attacker convinces your carrier that they are you, and the carrier obligingly moves your number onto a SIM in the attacker’s possession. The instant that happens, your handset goes dark and theirs starts ringing. Your calls, your texts, and crucially your text-message security codes now arrive on the attacker’s device.

That last point is the whole game. So much of modern life uses your phone number as the master key: it is the “forgot password” fallback for your email, the one-time code your bank texts you, the recovery method on your crypto exchange. Control the number and an attacker can chain a cascade of password resets through email into banking and digital wallets within minutes. They get to your number one of two ways. The first is information: they impersonate you to the carrier using personal details harvested from data breaches, phishing, or your own public footprint, then talk a call-center agent into the swap. The second is uglier and increasingly common: an insider, a complicit or bribed carrier-store or call-center employee, processes the swap directly, skipping verification entirely. Either way, real human beings are involved at multiple points, and that is exactly what makes attribution possible.

From the moment your number moves, the attacker is sprinting through password resets, so you have to move faster. Do not wait to “see if it comes back.” Borrow a phone, get to a laptop, and work the order below. As soon as you are stable, file with the FTC fraud reporting site and follow the recovery checklist at the FTC’s identity-theft service, because a SIM swap is identity theft and the agency walks you through reclaiming each account.

The technical trail. This is the lane your carrier, the banks, the exchanges, and law enforcement work, and it is powerful precisely because a SIM swap is so logged. The carrier knows the exact channel and timestamp of the swap and the device the number moved to; banks and exchanges hold the IP addresses, device fingerprints, and login records of the takeover; and where crypto was cashed out, the blockchain preserves a permanent path of the funds. With subpoenas and internal records, investigators can tie a swap to a store, an employee badge, an IP, or a deposit address at a regulated exchange. Our role on this side is supportive: documenting and organizing the swap record, the login alerts, and the transaction trail so your report is one investigators can actually act on. Our overview of how to investigate fraud walks through how that documentation comes together.

The human trail. This is the lane almost no one works, and it is where People Locator Skip Tracing fits. A SIM swap is not a faceless event; it runs on real people. There is the insider, the carrier-store or call-center worker who processed the swap, often traceable to a specific location and shift. There is the mule, the person whose bank account or card received the stolen funds, and the U.S.-based individual who opened the exchange account used to cash out. There is the social-engineering contact: the phone number, email, or handle used to phish you or impersonate the carrier. Those identifiers can be researched lawfully through public records and skip tracing to surface a real name, address, and associates, the same way our guides on identifying a scammer by phone number and tracing the people behind a fraud through an email address approach it. A named, located individual changes everything: it strengthens your IC3 and carrier reports, gives a prosecutor or an attorney something concrete, and opens the door to a civil claim that technical logs alone cannot support.

SIM-swap attackers run on the same rails as other account-takeover fraud, so the people behind them surface through the same lawful research that powers our work on finding someone who scammed you and full-spectrum skip tracing. Send us what you have, even if it feels like nothing: a phone number, an email, a username, the store where the swap was processed, the account a transfer landed in, or a name the attacker used with your carrier. We work strictly for lawful, permissible purposes, we never confront anyone on your behalf, and we tell you honestly what the records can and cannot show. For a legitimate matter, an initial locate typically comes back within 24 hours.