How to Tell if Your Sim Has Been Cloned or Hacked?

Do you have trouble making calls or sending texts? Noticed calls on your bill that you didn’t make? Or received a weird text message asking you to restart your phone?

These could be signs that someone has hacked your SIM card.

Although it sounds like something out of a spy movie, SIM card hacking and cloning are real threats with serious consequences.

Let’s dive into how to spot those red flags and protect yourself.

Why Would Someone Want to Hack Your SIM Card?

There are a few main reasons why someone would want to clone/hack a SIM card:

• Gain access to two-factor authentication (2FA) codes sent via text message: This would allow the hacker to gain access to important online accounts that would otherwise be protected, such as online banking.
• To receive another person’s texts and calls, etc: This could be for various reasons, including monitoring their communication activities and interactions with others.
• To impersonate another person: If someone has cloned someone else’s SIM card, not only do they have the ability to receive their incoming texts and calls, but they can also send outgoing texts and calls using their number. This means they could impersonate them to gain access to important accounts, or even scam the victim’s contacts.
• To target a high-value individual: High-profile SIM swap attacks continue to make headlines. In 2023, members of the hacker group Scattered Spider used SIM swapping to compromise employees at MGM Resorts and Caesars Entertainment, resulting in hundreds of millions of dollars in losses.

How SIM Card Hacking Works

Let’s look at three types of SIM card hacks that can be used to take over a victim’s SIM card.

SIM swapping

A SIM swap is a type of hack where an attacker uses social engineering techniques to trick your phone service provider into switching your number over to a new SIM card.

This would involve trying to convince an employee of the phone service provider to swap the number from one SIM card to another by posing as the account holder.

If the hacker can convince the employee to swap the numbers, they will unwittingly give up access to the account holder’s phone number.

Another way hackers can approach SIM card swapping is by recruiting an insider who will help them swap SIMs in bulk. Such a case was revealed in 2018 by staff at a large mobile service provider in the U.S.

Once the SIM has been swapped, the victim’s phone will need to be restarted to complete the transfer to the new SIM card.

Typically, hackers will pose as the phone service provider and send a fake SMS message to the victim asking them to restart their phone to resolve a problem.

Fig 1. Example text message received in a SIM swapping attack.

SIM cloning

An attacker gains physical access to your SIM card and clones it onto a new SIM under their control.

This is a method that requires the hacker to physically copy the SIM card by placing it in a card reader attached to a computer. Smart card copying software will then allow the number to be cloned onto a blank SIM card.

In some advanced attacks, this can even be carried out wirelessly if the hacking method is sophisticated enough to break the built-in security encryption that protects the SIM card.

Once the hacker has a clone of the SIM card, they can use it in their own device to access the victim’s texts, phone calls, and location data.

Simjacker

A rarer method called Simjacker works by sending a specially crafted SMS to the target’s phone. The message exploits legacy software built into some SIM cards, and the attack often happens completely silently.

Once triggered, it can allow attackers to track the victim’s location, intercept calls and messages, or take other actions on the device — all without any physical access or social engineering.

Simjacker is mainly seen outside the US and is less of an everyday concern than swapping or cloning. But it’s a reminder that not all SIM-level attacks rely on tricking people, some exploit the technology itself.

What to Do If Your SIM Has Been Cloned or Hacked

Contact your carrier

You must act fast if you suspect your phone’s SIM card has been compromised.

Ask your network provider to deactivate the fraudulent SIM card immediately. Reporting a stolen SIM card quickly minimizes the risk of damage.

Change your passwords

As with any hack, you’ll need to change your passwords. Prioritize the most important ones like email, bank, and social media accounts.

When changing passwords, focus on security. Don’t reuse old passwords—make each one unique and strong. A password manager can help you generate and organize these complex passwords.

If an account offers two-factor authentication that doesn’t use SMS verification (like an authenticator app or security key), enable it for an extra layer of protection.

Run an anti-spyware scan

An attacker who has accessed your phone may have left more behind than you realize. A SIM compromise can sometimes be accompanied by spyware installed on the device itself.

It’s worth running a scan to rule this out.

Certo AntiSpy for iPhone and Certo AntiSpy for Android are designed specifically for this — they check for malicious software that may be silently monitoring your calls, messages, and activity. If anything is found, the app will walk you through removing it safely.

Fig. 2: Detecting spyware with Certo AntiSpy for Android.

Additional tips

• Monitor your accounts: Check your bank statements and online accounts for unusual activity.
• Report fraudulent activity: If you discover any unauthorized charges or suspicious login attempts, promptly report them to your bank or the relevant service.
• Consider a credit freeze if you’re concerned about severe identity theft. A credit freeze can prevent anyone from opening new accounts in your name.

FAQs

How do I check if someone is using my SIM card?

While there’s no direct way to see if someone has cloned your SIM card, there are strong indicators that something is wrong.

The most obvious sign is that you can no longer make or receive calls or texts. This indicates that your SIM card has been deactivated, likely because the hacker has activated a clone of your SIM.

Other red flags include unexpected account lockouts, unusual calls on your bill, and strange messages requesting a restart.

Can I prevent SIM hacking?

First, educate yourself on the SIM hacking methods available, so you know what to look out for.

Next, take proactive measures to secure your SIM. This can include setting a secure and unique password for your mobile account, which is required in order to make changes to your account over the telephone.

You can also set up a PIN directly on your SIM card to prevent it from being used in another device.

What’s the difference between SIM hacking and spyware?

SIM hacking gives the culprit access to your texts and calls, while spyware provides a wider range of information like emails, browsing history, and more.