How virtual numbers are stopping SIM-swap fraud in 2026

When “No Service” means something worse than a dead battery

Full bars, then nothing. No storm rolling through, no tower maintenance notice – just silence. That’s usually the first sign. A minute or two later comes the flood: password-reset emails for a bank account, an inbox, maybe a crypto wallet someone forgot they’d even linked 2FA to. Not a glitch. A SIM swap, already in motion, and by the time anyone notices, most of the damage is done.

This particular scam has been around for years, but it’s aged badly – like a lock everyone assumed was solid until someone worked out how to pick it in under ten minutes. The mechanics are almost insultingly simple. A fraudster scrapes together enough personal detail (a breached password database here, a LinkedIn profile there) to convince a mobile carrier they’re the account holder. The carrier ports the number over. And just like that, every text, every call, every one-time code meant for the real owner lands somewhere else entirely.

What the numbers actually say

Here’s where it gets messy, honestly. According to the FBI’s Internet Crime Complaint Center (IC3) 2024 Internet Crime Report, 982 SIM-swap complaints were logged in the US in 2024, totaling nearly $26 million in losses – down from a 2022 peak north of 2,000 complaints and $72 million. Sounds like good news. Sort of. The drop mostly reflects tighter carrier rules, not fewer attacks; fraud tends to migrate rather than vanish. Overall internet crime losses climbed to more than $16 billion in 2024, a 33% jump from the year before, which gives some sense of the scale fraud has reached even as individual categories like SIM swapping shift around.

NIST’s 2025 authentication guidance made the SMS problem official in its own quiet way, formally reclassifying SMS and phone-network one-time codes as a “restricted authenticator” – a polite way of admitting text messages were never built to guard a bank account, and that any organization still leaning on them needs to actively mitigate risks like SIM swaps and number porting.

Other regions tell a rougher story. The UK’s Cifas Fraudscape report clocked a 1,055% jump in unauthorized SIM swaps in a single year – 289 cases in 2023 ballooning to nearly 3,000 by 2024. Australia’s IDCARE found something similar: a 240% surge, with 90% of victims never realizing anything was wrong until it was far too late to stop it. And the payouts can be brutal. One arbitration case in early 2025 ended with a carrier on the hook for $33 million after a swap drained a customer’s crypto wallet in a single afternoon.

Why carriers keep getting outplayed

Part of it comes down to how thin carrier verification really is. A widely cited Princeton University study from the school’s Center for Information Technology Policy tested five major US prepaid carriers and found that 39 of 50 simulated swap attempts succeeded – no real resistance, just a security question or two that any determined fraudster could answer from data already floating around breach forums. The same research team reverse-engineered authentication policies across more than 140 websites and found 17 of them could be compromised through a SIM swap alone, without a password ever being touched. Call-center staff trained to move fast aren’t exactly built to catch a con that’s had years to get good at sounding convincing.

It’s not just individual consumers getting caught out, either. A cluster of well-organized attackers has turned SIM swapping into an enterprise-grade access technique – using a hijacked employee phone number as the opening move for a much bigger breach, rather than the endgame itself. Two major hospitality companies learned this the hard way in 2023, when a single successful swap against an employee cascaded into system-wide outages costing tens of millions in recovery and lost business. That shift matters: it means the threat isn’t confined to personal banking apps anymore. It’s a corporate access-control problem too, which is exactly why network-level defenses are getting so much attention right now.

Where virtual numbers fit in

Which is roughly where a virtual number for SMS enters the picture. Businesses leaning on phone verification – for signups, delivery alerts, support tickets, whatever – are increasingly separating that traffic from anyone’s actual mobile line. A virtual number doesn’t live on a physical SIM sitting in someone’s pocket, so there’s no carrier account to social-engineer, no retail counter to walk into. It’s not a silver bullet. But it does quietly remove one of the easier paths fraudsters currently rely on, especially for the account-recovery and verification flows that attackers love to target first.

A rough comparison, if it helps:

• Physical SIM numbers lean entirely on carrier-side checks, and those checks vary a lot – some carriers are strict, plenty aren’t, as the Princeton research above makes clear.
• eSIMs cut down on swap risk since there’s nothing to physically remove, though social engineering against the carrier still works exactly the same way.
• Virtual numbers separate verification from any single device or carrier account, which makes the usual attack playbook a lot harder to run end to end.
• Authenticator apps skip the phone number entirely – which is exactly why NIST now favors them over SMS for anything above baseline assurance.

For businesses handling high volumes of verification traffic, that separation isn’t just a security nicety. It reduces the blast radius when something does go wrong – a compromised virtual number can be rotated or reissued without touching a customer’s actual carrier relationship, which isn’t true when the number itself is the point of attack.

Where this is all heading

None of this spells the end of SMS. It’s cheap, familiar, everyone’s phone supports it. But treating a text message as a genuinely secure credential? That era’s winding down. Banks are shifting toward device-based biometrics. Enterprises are bolting network-level SIM-swap detection onto existing verification flows. And plenty of organizations that used to think of phone numbers as fixed, low-risk identifiers are starting to treat them more like passwords – things that get stolen, and should be designed around rather than trusted blindly.

For anyone running verification at scale, the takeaway isn’t complicated. One number, tied to one carrier account, is a soft target – and fraudsters have gotten uncomfortably efficient at hitting soft targets, as both the FBI’s complaint data and Princeton’s carrier testing show. Spreading that risk across virtual numbers, authenticator apps, or carrier-side fraud signals isn’t overcautious anymore. It’s just catching up with how the attacks already work