It has been estimated that SIM-swap fraud has increased by more than 1,000% in the United Kingdom in just a year, a shocking increase that has resulted from the recent surge in reported cases. Using newly released data from the National Fraud Database, it has been estimated that incidents increased from 289 in 2023 to almost 3,000 in 2024, a staggering 1,055% increase in incidents.
It is clear from this sharp increase in cybercrime that a growing trend is emerging among cybercriminals who are increasingly exploiting the widespread adoption of two-factor authentication by businesses as a security measure to protect sensitive customer information. SIM-swap fraud, also known as sophisticated identity theft, is where fraudsters gain control of a victim's mobile phone number by transferring it to a new SIM card, usually without the victim's knowledge.
When criminals hijack the phone number, they can intercept security codes sent via SMS and one-time passwords sent by SMS, thus gaining access to online banking, email, and other personal accounts protected by two-factor authentication (2FA), thereby gaining unauthorised access. In a world where businesses continue to heavily rely on mobile-based authentication to safeguard user data, this increasing threat underscores the urgent need for cybersecurity strategies that are more resilient and layered.
There are critical concerns about the vulnerability inherent in current digital security protocols in light of the dramatic increase in such cases, and it is evident that cybercriminals are evolving their methods of bypassing these protocols as well. A serious warning has been issued by CIFAS, the most prominent fraud prevention organisation in the UK, regarding a dramatic increase in SIM-swap fraud reported through 2024, with a 1,055% increase reported in cases.
In its latest report, Fraudscape, which examines the UK's fraud landscape and presents a detailed and data-driven analysis of emerging threats, particularly among mobile and telecommunications companies, the organisation released the concerning figures, which are based on the latest figures. According to the National Fraud Database (NFD), there were nearly 3,000 incidents of SIM swaps that were registered during the year 2024, a significant increase over the previous year's 289 cases.
Fraudsters acan illicitly transfer the victim's phone number SIM card in order totheir communication, which enaenablingeffectively take control of their communications. Criminals can intercept security verification codes, such as two-factor authentication codes, when they have access to a victim's calls and text messages. This allows them to perform more extensive fraud, including app takeovers, unauthorised account access, and a wider array of identity theft attacks.
A new report, Fraudscape, indicates an unprecedented number of fraud cases will be filed with the National Fraud Agency (NFF) in 2024, demonstrating that fraud in all sectors has increased significantly. The telecommunications industry in particular has become a prime target, with identity fraud involving mobile services going up 87% year-on-year over the last five years alone. As a result of this surge, more than 16,000 new fraud cases have occurred in the industry, which suggests that stronger fraud defences within the industry are urgently needed.
It is not uncommon for facility takeover fraud to be on the rise in the last few years, an insidious technique in which criminals seize complete control of an individual's financial and service accounts, compounding the problem. In 2024, the number of account takeover cases soared by 76%, with e-commerce and the telecommunications sectors bearing the greatest burden. During the year, nearly half (48%) of all account takeover incidents involving mobile phones were reported.
As a result, reports of unauthorised upgrades to mobile phones soared by 96%, indicating that fraudsters are becoming increasingly sophisticated in their manipulation of telecom infrastructure to gain illicit benefits.
In light of this upward trend in mobile-related fraud, it is clear that there is a growing threat landscape within the UK, prompting calls for urgent action and innovation to improve the digital security frameworks.
SIM-swap fraud refers to a meticulously planned cybercrime that usually involves the acquisition of a victim's personal and financial information as a key part of the fraud scheme.
This sensitive information, such as national identification numbers, mobile phone numbers, bank account numbers, and card details, is often collected by criminals through deceptive phishing schemes and sophisticated social engineering tricks.
In other words, the scammer tricks victims into disclosing their credentials voluntarily by using fraudulent websites, impersonating them over phone calls, messages, or emails, or by a convincing impersonation over the phone.
Once this information is in their possession, fraudsters proceed to make a SIM swap request or a number port-out request. The victim may have to convert their existing physical SIM card to an eSIM card with the same telecom provider, or they may have to transfer the number to another local operator.
It is common for these requests to be performed remotely through the official apps provided by the telecom provider. This streamlines the process and allows criminals to circumvent in-person authentication procedures.
It is important to know that in jurisdictions with advanced digital safeguards, a SIM swap is usually governed by a government-regulated electronic verification platform. Before any SIM replacements or number porting requests can be approved, identity authentication is required.
The most common methods of verification include biometric authentication, secure login prompt approvals, or one-time authorisation codes; however, fraudsters have developed methods by which to exploit even these protective measures.
An attacker commonly manipulates victims into unintentionally authorising the swap as a way to circumvent verification requirements. In the role of representatives from trusted organisations such as banks, telecom providers, or employers, they create urgent scenarios involving job applications, account updates, or fraud alerts by pretending to be representatives of such organisations.
When victims are unaware of what is going on, they approve verification requests, allowing the fraudsters to gain control of their mobile numbers.
After the SIM swap is completed, the victim's original SIM is deactivated, and then a new SIM card, which is now controlled by the fraudster, is activated. Utilising SMS-based two-factor authentication codes (2FA), which are commonly used for securing online accounts, financial services, and critical communications, the criminal can access all of the victim's information.
This means that fraudsters can easily execute unauthorised transactions, gain access to sensitive digital platforms, and perpetrate identity-related crimes using these credentials, often without the victim being aware of it at all.
Because SIM-swap fraud is an escalating threat that needs to be addressed in light of the rapid escalating threat, organisations as well as individuals must reassess their digital security practices and move away from relying exclusively on SMS authentication to protect themselves.
Although two-factor authentication is an important layer of security, its dependence on mobile networks has become a critical vulnerability that cybercriminals are increasingly exploiting to their fullest extent. Businesses must adopt more secure methods of authentication, including biometric verification, authenticator apps, and hardware security keys, so that they can protect customer data and digital access points with greater security.
Additionally, telecom providers must play a more proactive role in their customer verification protocols, monitor for unusual SIM activity, and make sure that SIM swaps and port-out requests are thoroughly checked through multi-step procedures. Additionally, policymakers and regulators should consider putting in place stronger safeguards across the sector, including a uniform standard for digital identity verification and a real-time fraud alert system.
Consumers must become aware of the risks associated with cybercrime to defend themselves. In addition to remaining vigilant against SIM tampering, individuals must avoid sharing sensitive personal information online or during unsolicited calls and report any loss of mobile service or suspicious activity of their accounts immediately. To counter fraud on a multi-layered scale, there must be an equally dynamic response rooted in education, innovation, and collaboration across all levels of the digital ecosystem.
A concerted effort is required if the UK's digital economy is to continue to thrive in the face of this growing and extremely intrusive threat - and the wider digital economy as a whole.
