A SIM swap is an attack in which the attacker deceives a carrier's identity verification process and has the victim's phone number moved to a SIM card the attacker holds. Once the transfer completes, every call and SMS meant for the victim arrives on the attacker's device, and the victim's own phone drops to an "out of service" state. Japanese law obliges mobile carriers to verify a subscriber's identity when a contract is signed and when it is transferred, but a SIM swap defeats that very check.
The main goal is intercepting two-factor authentication codes delivered by SMS. Online banking, cryptocurrency exchanges, and email accounts that lean on SMS codes are the usual targets, and attackers pair passwords harvested through phishing or data breaches with the codes they now receive. In February 2022 the FBI Internet Crime Complaint Center (IC3) reported that the 1,611 SIM swapping complaints it received during 2021 carried adjusted losses of more than $68 million; for the three years from January 2018 through December 2020 the figures were 320 complaints and roughly $12 million, and the notice was issued to warn carriers and the public about the growing use of the technique.
Carriers are deceived in two main ways. The first is social engineering: the attacker gathers the victim's name, date of birth, and address in advance, then calls the support line claiming the SIM was lost. The second is an insider route that recruits carrier shop staff as accomplices. The insider route is harder to detect and tends to cause larger losses.
An effective defense is switching from SMS codes to an authenticator app (Google Authenticator, Authy, and the like) or a hardware key (such as a YubiKey). Because the code is generated inside your own device or the key itself, losing control of the phone number no longer hands codes to the attacker. Setting a PIN or passphrase on your carrier account, so that in-store and phone-based procedures require extra verification, also helps. If your phone suddenly loses signal, treat a SIM swap as a possibility and contact your carrier immediately. Hold one more line as well: never read out a verification code to someone who calls you, even if they say they are from your carrier or your bank. Risks of Phone-Based Two-Factor Authentication and Safer Alternatives compares the weaknesses of SMS authentication with the available alternatives.