A SIM swap attack is a form of identity fraud in which a criminal persuades a mobile network operator to transfer a victim's phone number onto a SIM card that the criminal controls. Once the transfer completes, the victim's handset loses signal and every call and text message intended for that number, including one-time PINs and transaction alerts, is delivered to the attacker instead.

The critical point is that nothing is hacked. A SIM swap is a legitimate service that networks provide for customers whose phones have been lost, stolen or damaged. The attack works by abusing that process rather than defeating it, which is why a victim can be fully compromised without ever clicking a malicious link or having a device infected.

For South African businesses, this matters well beyond consumer awareness. A mobile number is used across the economy as a de facto proof of identity, as a channel for authentication, and as a contact point of record. When that number is silently reassigned to someone else, every control that depends on it fails at the same moment.

How Does a SIM Swap Attack Work?

A successful SIM swap attack generally unfolds in four stages.

Stage one: information harvesting. The attacker gathers enough personal information to impersonate the victim. This typically comes from phishing or smishing messages, social engineering calls, data breaches, or information the victim has shared publicly. Banking credentials are frequently harvested at this stage, because the SIM swap alone is rarely the whole attack.

Stage two: the swap request. Posing as the victim, the attacker approaches the mobile network operator, through a call centre, a retail outlet or an online channel, and reports a lost or damaged SIM. The attacker supplies the harvested personal details to satisfy the operator's verification process and requests that the number be moved to a new SIM.

Stage three: interception. Once the swap is processed, the victim's phone loses network service and the attacker begins receiving all calls and messages sent to the number. This includes one-time PINs, transaction verification requests and fraud alerts.

Stage four: exploitation. Using previously harvested credentials together with intercepted one-time PINs, the attacker logs into banking, payment or other accounts, adds beneficiaries, and moves funds. Victims often describe the same experience: the phone went quiet, and by the time they established why, money had already left their accounts.

The sequencing is important. The SIM swap is usually the second stage of a fraud that began with credential theft, not the first. This is why the industry position has consistently been that a SIM swap on its own does not compromise a bank account. It removes the warning system and defeats the second authentication factor for an account the attacker can already partially access.

Why is a Mobile Number Such a Valuable Target?

South Africa has built a great deal of its digital trust infrastructure on the mobile number. It is the delivery channel for one-time PINs, the destination for transaction alerts, the recovery route for forgotten passwords, the login identifier for many services, and the contact record that businesses use to reach customers.

That concentration is what makes the number worth stealing. Compromising it does not grant access to one account. It grants a route into every account that treats possession of the number as evidence of identity, which in practice means banking, payment applications, email, social media, messaging platforms and any service whose password reset flow sends a code by text message.

It also degrades the victim's ability to respond. Alerts that would normally warn of a new beneficiary or an unusual transaction are delivered to the attacker, which extends the window in which the fraud can continue undetected.

How Common is SIM Swap Fraud in South Africa?

The picture is more nuanced than most coverage suggests, and the most recent data changes the conventional account.

According to the South African Banking Risk Information Centre (SABRIC), there were 110,074 digital banking crime incidents in South Africa in 2025, with total reported client claims reaching R2.41 billion, an increase of 29.2% from R1.86 billion in 2024.

Within that total, the distribution across channels has shifted substantially. Banking applications accounted for approximately 89 percent of reported cases and around 70.5 percent of the total claim amount, equating to roughly R1.7 billion in client losses. Internet banking accounted for fewer than 9 percent of cases but approximately 28.6 percent of claim value. Mobile banking, the channel most closely associated with SIM swap fraud, represented fewer than 3 percent of cases and less than 1 percent of claim value, though SABRIC specifically noted that it remains important precisely because of its association with SIM swap risk.

This warrants careful interpretation rather than a simple conclusion that SIM swap fraud has gone away. In earlier reporting periods, SIM swaps featured in the overwhelming majority of mobile banking fraud incidents, and reported SIM swap volumes rose sharply between 2020 and 2021 before falling steeply as networks and banks tightened controls. What the current data indicates is that the channel through which SIM swap fraud was historically measured has shrunk relative to app-based fraud, not that mobile number compromise has ceased to be a threat.

SABRIC has also been explicit about something that reframes the whole category. The dominance of banking applications in the statistics does not mean bank systems were breached. In most cases the fraud began outside the banking platform, with criminals impersonating trusted organisations, manufacturing urgency, or guiding customers through transactions in real time. The banking application is simply where the money moves once the customer has been deceived.

A note on a figure that circulates widely: estimates of around R5.3 billion in annual losses are sometimes attributed to SIM swap fraud specifically. That figure refers to telecommunications-linked fraud in aggregate, including fraudulent subscriptions and broader identity theft, and should not be cited as the cost of SIM swap attacks alone.

What Does South African Law Require of Mobile Operators?

SIM swaps are governed by the Regulation of Interception of Communications and Provision of Communication-Related Information Act 70 of 2002, commonly known as RICA. Under RICA, a service provider may not activate a replacement SIM unless it has satisfied itself as to the identity of the person making the request.

In practice, this creates a recognised regulatory gap. The verification standard RICA requires can often be met by someone presenting harvested personal details, because the Act was drafted around identity documents and proof of address rather than around live identity confirmation. Enforcement has also been contested. The Independent Communications Authority of South Africa has previously indicated that it does not adjudicate complaints about operators who fail to comply with RICA's SIM swap provisions, which has historically left affected consumers without a clear route of recourse against the network.

There is movement on this. Industry figures have argued that requiring biometric verification at the point of a SIM swap request would eliminate the great majority of this fraud, since an attacker holding stolen personal details cannot present the victim's face or fingerprints. Mobile networks have proposed such a solution through amendments to the Electronic Communications Act, and the shortcoming was among the concerns raised during South Africa's period on the Financial Action Task Force greylist. As of 2026 the proposal remained in the legislative process rather than in force, so businesses should not plan on the assumption that the network-side gap will close soon.

Who is Liable When a SIM Swap Attack Succeeds?

Liability is contested and determined case by case rather than by a general rule.

Mobile operators have generally resisted liability on the basis that the resulting financial loss arises from the compromise of banking credentials, which happens outside their systems. Banks assess each case on its facts and refund in some circumstances but not others.

Where a customer disputes a bank's decision, the complaint now goes to the National Financial Ombud Scheme South Africa. This is worth noting because many published resources still refer to the Ombudsman for Banking Services, which ceased to exist at the end of February 2024 when it was amalgamated, along with the Credit Ombud and the two insurance ombud schemes, into the National Financial Ombud Scheme. The new scheme commenced operations on 1 March 2024 and handles banking complaints through its Banking Division.

The adjudication principle established in earlier banking ombud determinations remains instructive. In one case, a complainant lost R30 698 after transactions were authorised using her card details and one-time PINs sent to her registered number. The ombud established that a fraudulent SIM swap had occurred on the day of the fraud, which meant the attacker received the one-time PINs. The bank was then required to demonstrate that the customer had been negligent in compromising her credentials. It could not do so, and the loss was refunded.

The practical lesson for any business relying on one-time PINs is that the evidentiary burden can fall on the institution rather than the customer. Being able to show that a SIM swap check was performed before a high-risk transaction is a materially stronger position than being unable to say whether the number was compromised at all.

How Can Businesses Detect and Prevent SIM Swap Fraud?

Businesses cannot control the mobile network's verification process, but they can stop treating a mobile number as inherently trustworthy. Several controls make a practical difference.

• Check for recent SIM swap activity at high-risk moments: A SIM swap check returns a risk rating for the number along with the dates and times of any previous SIM swap activity, the carrier, and the device type. A swap that occurred hours or days before a login, a beneficiary addition, a password reset or a large payment is one of the strongest single fraud indicators available, and it is cheap to check relative to the loss it prevents.
• Verify the number itself: Confirming that a number is live on a network, identifying its carrier, and checking its porting status establishes basic integrity before the number is relied upon for authentication or contact. Refer to our guide: How to Verify Physical Addresses and Contact Details.
• Confirm the number belongs to the customer: Matching a mobile number against the identity number it is associated with, including historical associations, tests whether the person presenting the number is plausibly its owner. This is particularly valuable at onboarding, where a number that has no association with the stated identity is a meaningful early warning.
• Score the number for prior fraud exposure: Some numbers carry a history. Risk indicators that expose numbers previously linked to fraudulent activity or to organised collusion syndicates allow a business to decline or escalate before any loss occurs. Fraud intelligence databases can also be queried directly on a mobile number, which surfaces whether the number has featured in previously reported incidents. Refer to our guide: SAFPS Report vs SAFPS Snapshot: Choosing the Right Fraud Intelligence Service.
• Stop relying on SMS one-time PINs as the only second factor: The entire SIM swap business model exists because a text message is treated as proof of possession. For higher-value events, step up to a control that a swapped SIM does not defeat, such as biometric confirmation against the photograph held at the Department of Home Affairs. Refer to our guide: What is Identity Verification (IDV) and Why Does it Matter?
• Verify the destination before money moves: A SIM swap is frequently paired with the addition of a fraudulent beneficiary. Confirming that a bank account genuinely belongs to the intended recipient closes the exit route even where authentication has been defeated. Refer to our guide: What is Bank AVS?

Where Does SIM Swap Screening Fit into KYC and FICA Compliance?

For Accountable Institutions, this is not solely a fraud question.

Contact details form part of the customer information that FICA requires institutions to obtain and keep current, and the method by which an institution verifies and maintains that information should be documented in its Risk Management and Compliance Programme. An institution that relies on mobile numbers for authentication, but has no control for detecting when a number has been reassigned, has a gap between what its programme implies and what it can actually demonstrate. Refer to our guides: What is a Risk Management and Compliance Programme (RMCP)? and What is an Accountable Institution? FICA Obligations Unpacked.

The same logic applies to ongoing due diligence. Customer information degrades over time, and a number that was genuinely the customer's at onboarding may not be under their control today. Treating contact data as something to be monitored rather than captured once is consistent with the wider shift from point-in-time screening to continuous oversight. Refer to our guide: Once-Off AML Screening vs Continuous AML Monitoring: What's the Difference?

SIM Swap Detection and Mobile Fraud Solutions for South African Businesses

As South Africa's leading provider of world-class identity verification, KYC, AML screening and due diligence solutions, ThisIsMe gives businesses the tools to treat mobile numbers as something to be verified rather than trusted. Our SIM Swap service returns a risk rating along with the dates and times of any previous SIM swap activity on a number, while Mobile Check confirms carrier, porting status and network status, Mobile Risk flags numbers linked to known fraud and collusion syndicates, and Mobile2ID confirms whether a number genuinely matches the identity presenting it. Combined with biometric photo comparison against Department of Home Affairs records, SAFPS fraud intelligence, and bank account verification, ThisIsMe helps businesses close the gap that SIM swap fraudsters depend on. To experience our full suite of verification and fraud prevention solutions and find out how we can serve your business, contact our team here.