Follow the Money · 25 — The Number: Stealing the Phone to Steal the Coins

Follow the Money — Case 25. This register follows illicit value from the keyboard to its final resting place, and closes on the money's disposition: LAUNDERED · RECOVERED · FROZEN · CONVERTED · VANISHED · SPENT.

The register has followed money stolen through exploited protocols, deceived victims, and betraying custodians. This case follows money stolen through something smaller and more intimate than any of them: a phone number. In a SIM swap, a criminal takes over the victim's mobile number — and with it, their entire digital life — and uses that stolen identity to drain the victim's cryptocurrency, often while the victim's own phone sits dead and useless in their hand.

The attack exploits a weak link most people never think about, and the FBI's IC3 defines it in a single sentence: a SIM swap is the use of social-engineering techniques against mobile service providers to transfer a victim's phone service to a mobile device in the criminal's possession. Read that carefully, because the whole crime is in it. The attacker does not break into the victim's phone. They do not hack the blockchain, or crack a password, or exploit a software flaw in an exchange. They talk the phone company into moving the victim's number to a SIM card the attacker controls — and from that moment, for every system in the world that trusts the phone number as proof of identity, the attacker is the victim.

This is the letter about the theft of a number, and the disposition is LAUNDERED — because once the number is stolen and the accounts are seized, the crypto is swept out and washed through the same laundering machinery the register has spent two dozen cases cataloguing. The novelty is not where the money ends up; it ends up in the wash, like so much else. The novelty is where the theft begins: not with an attack on the money at all, but with an attack on a phone number that the entire security system had, unwisely, decided to trust.

1. How a Phone Number Became a Master Key

Start with the drift that made the attack possible, because no one decided the phone number should become a master key — it happened by accident, one convenience at a time, and the SIM swap is the bill coming due. A mobile phone number was designed to do one thing: route calls and texts to a device. It was never designed to prove who you are. And yet, over the past decade, it quietly became the single most important credential in most people's digital lives.

The mechanism of the drift was two-factor authentication and account recovery. Services wanted a second factor beyond the password, and SMS was the easiest to deploy — everyone has a phone, everyone can receive a text, so 'we'll send a code to your number' became the default second factor across email, banking, and crypto exchanges. And services wanted a way for locked-out users to recover their accounts, so 'forgot password? we'll text you a reset code' became the default recovery flow. Both decisions were reasonable in isolation and catastrophic in combination, because together they made control of the phone number equivalent to control of the accounts. If the code that proves your identity and the code that resets your password both go to your phone number, then whoever holds your phone number can prove they are you and reset anything you own. The number stopped being a way to reach you and became a way to be you.

This is the misplaced trust the whole attack rests on: the security systems of email providers, exchanges, and banks came to treat 'can receive a text at this number' as strong evidence of 'is this person.' It is a bad assumption, because a phone number is not a secret you know or a device you hold — it is an assignment a phone company makes, and a phone company can be talked into reassigning it. The register frames Case 25 around this because it is the case's whole vulnerability in one idea: the industry built its authentication on top of the phone number without asking whether the phone number was actually secure, and it was not. The master key to digital life turned out to be a key the phone company would hand to whoever asked convincingly enough.

2. Talking the Number Loose

Now the mechanism of the theft itself, because understanding how the number is stolen shows why the carrier — not the victim and not the exchange — is the soft underbelly of the whole system. There are two paths to the swap, and both end with the victim's number on the attacker's SIM.

The first path is social engineering the carrier. The attacker contacts the victim's mobile provider — calls customer service, or walks into a store — and impersonates the victim, armed with personal data that is often cheap to obtain: bought from a data breach, phished, or assembled from public sources. They claim they got a new phone, or lost their SIM, and need their number activated on a new card. A support agent, whose job is to help customers and who faces a plausible-sounding person with the right personal details, performs the port. CrowdStrike documents this exact tradecraft in adversaries like Scattered Spider, who used vishing — voice phishing — and calls to help desks to persuade support personnel to provide password and multi-factor-authentication resets. The attack is not technical; it is a performance, aimed at a human being trained to be helpful. The second path is the bribed insider: a corrupt employee at the carrier who performs the port-out for a fee, cutting out the social engineering entirely. Why talk your way past the help desk when you can pay someone inside to do it in seconds? Both routes exploit the same fact — that the port is ultimately performed by a carrier employee, and carrier employees can be fooled or bought.

This is why the register locates the vulnerability at the carrier and not at the victim or the exchange. The victim did nothing wrong beyond using SMS 2FA, which the whole industry told them to use. The exchange did nothing but trust the phone number, which the whole industry treats as trustworthy. The weak point is the moment of the port — the instant a carrier employee decides that the person requesting the number is who they claim to be — because that decision is made by a human with weak verification and strong incentives to be accommodating, and it is the single hinge on which the entire authentication chain turns. Steal that one decision, by fraud or by bribe, and everything downstream that trusts the number falls. The SIM swap is a lesson in where a security chain actually breaks: not at the strong, technical links everyone hardens, but at the soft, human link no one was guarding — the phone company's willingness to say yes.

3. The Cascade

Once the attacker holds the number, the theft cascades with terrible speed, and the register follows the cascade because it explains why the victim so rarely recovers. The moment the port completes, the victim's phone abruptly loses service — the number now lives on the attacker's SIM, so the victim's device shows no signal, no calls, no texts. To the victim, this looks like a network glitch. To the attacker, it is the starting gun.

The attacker moves to the hub first: the email account. They go to the victim's email provider, click 'forgot password,' and request a reset — and the reset code, sent by SMS or automated call, arrives on the attacker's phone, because the attacker now holds the number. With that code, they seize the email account, which is the master account that controls everything else, because almost every other account uses that email for its own recovery. From the email, the cascade completes: the attacker resets and takes over the victim's cryptocurrency exchange accounts, and any wallet or account protected by SMS two-factor authentication, intercepting each verification code as it comes to the stolen number. They disable the victim's security settings, add their own, and sweep the crypto out to wallets they control. The whole sequence — number to email to exchange to empty — can run in minutes, a chain of dominoes where the first tile is the phone number and the last is the drained wallet.

And the cruelty of the timing is that the theft and the victim's helplessness are the same event. The act that steals the number is the act that cuts off the victim's ability to respond, because the victim's phone — the very device they would use to receive fraud alerts, to call the exchange, to authenticate their way back in — is now dead. The victim watches their phone lose service, perhaps assumes a carrier problem, maybe waits, maybe restarts the device, and by the time they understand that their number has been hijacked and rush to a computer or a borrowed phone to respond, the attacker has already been inside their accounts for precious minutes and the crypto is already gone. The SIM swap does not just steal the key; it simultaneously removes the victim's ability to notice the door has opened. That simultaneity is why it works, and why it hurts.

4. Into the Wash

Now the disposition, because the money's fate after the cascade is the register's most familiar sight, and naming it precisely is the point. The SIM swap is an access attack — a way in — not a laundering technique. But the register follows the money's fate, and the fate of SIM-swapped crypto is the laundering pipeline this whole series has catalogued.

The instant the crypto is swept from the victim's exchange accounts and wallets, it enters the wash. It moves through intermediary wallets to break the direct link, often into a mixer (Case 05) to sever the trail, across chains via chain-hopping (Case 11) to fracture it further, and toward a cash-out — a bulletproof exchange (Case 12) or a swap into a privacy coin (Case 16). The proceeds of the SIM swap are laundered exactly like the proceeds of a bridge hack or a ransom, because once the crypto is in the attacker's wallet, its origin — a phone number talked out of a carrier — is irrelevant to the laundering machinery, which cleans dirty crypto regardless of which crime dirtied it. The disposition is LAUNDERED: the stolen value is cleaned and moved toward spendability, the theft of a stranger's phone number buried under the same wash that buries every other origin.

And the speed of the wash is what dooms the individual victim. Recall the timing: the victim is still on hold with their phone company, trying to get their number back and their accounts locked, while the attacker is already pushing the crypto through the laundering pipeline. The head start the SIM swap builds in — the victim's dead phone, the minutes of confusion — is exactly the window the attacker uses to launder. By the time the victim regains access and reports the theft, the money has already hopped through a mixer and toward a cash-out, and the register's usual hard truth applies: for the individual victim, the money is almost always gone. The crypto's traceability may help investigators map the crew and, sometimes, prosecute it; it rarely returns the coins to the person whose phone number was stolen. The novelty of this case is the front door — the phone number as the way in — but the back door is the same laundering pipeline as everywhere else, and it swallows the money before the victim can even find a working phone.

5. The Defense Is to Stop Trusting the Number

The register owes this case a clear statement of the fix, because unlike much in this series, the defense against SIM swaps is well-understood, effective, and available — and it follows directly from the diagnosis. The attack works because the phone number is trusted as an identity factor; the defense is to stop trusting it.

The security standards say this plainly. NIST's digital-identity guidelines treat SMS and phone-based one-time passwords as a 'restricted' authenticator, precisely because an out-of-band secret sent to a phone number can be intercepted — including by a SIM swap. OWASP's guidance names SIM-swap (and the related SS7 signaling weaknesses) as reasons SMS is a weak second factor and points to stronger alternatives. And those alternatives are the concrete fix: app-based authenticators that generate time-based one-time passwords (TOTP) on the device itself, and above all hardware security keys implementing WebAuthn/FIDO2, which are phishing-resistant and are not tied to a phone number at all. The crucial property of both is that the second factor lives in an app or a physical key rather than in the SMS channel — so when an attacker steals the phone number, they get the number and nothing else. The email stays locked, the exchange stays locked, the wallet stays locked, because the factor guarding them was never something the phone number could produce. On the carrier side, a port-freeze or a carrier PIN — a code required before any number transfer — raises the bar against the social-engineered swap, forcing the attacker past an extra check the help desk cannot casually waive.

This is why the register frames the SIM swap as, ultimately, a solvable problem with an unsolved deployment. The vulnerability is specific — reliance on the phone number as an identity factor — and the fix is specific — remove that reliance, on both the account side (hardware keys and app authenticators instead of SMS) and the carrier side (port-freezes and PINs). The technology to defeat SIM swaps exists, is proven, and is often free; the reason the attack still works is that SMS 2FA remains the default across much of the industry, and most people never change it, and many services still offer no better option. The SIM swap persists not because it is unstoppable but because the world has not yet finished getting off the phone number — and every account still protected by nothing but a text is still a number away from being drained. The register's clearest advice in this whole series is also its simplest: for anything that holds real value, do not let the phone number be the key.

6. The counter-narrative, steelmanned

The strongest objection to this letter is that it blames the wrong parties and overstates a solved problem, and it deserves a fair hearing.

The argument runs like this. If the fix is as simple as 'use a hardware key,' the objection goes, then the SIM swap is really the victim's own fault for using SMS 2FA, and the register's sympathy for victims is misplaced — people who hold serious crypto and secure it with a text message have chosen convenience over security and should bear the consequence. And blaming the carriers, the argument continues, is unfair too: carriers serve hundreds of millions of customers who legitimately lose phones and need SIM replacements, and a support agent cannot be expected to detect every skilled impersonator, so calling the port a 'weak decision' ignores the real operational bind of running customer service at scale. The honest conclusion, on this view, is that the SIM swap is a solved problem being kept alive by careless individuals and unavoidable service realities, not a systemic failure worth a whole case.

The register grants what is true and refuses the victim-blaming. Yes, the fix is known, and yes, victims who could have used a hardware key and did not are, in a narrow sense, more exposed — the register says so in Section 5 and urges exactly that fix. But 'the victim should have known better' collapses under the same weight it did in the elder-scam and pig-butchering cases: the entire industry told users to use SMS 2FA, most services made it the default and many offered no alternative, and blaming the individual for trusting the security their bank and exchange handed them inverts the responsibility — the failure to make phishing-resistant authentication the default is the industry's, not the user's. And yes, carriers face a real operational bind — but that bind is precisely the systemic failure the case names: an authentication system for the world's financial accounts should not hinge on a single underpaid support agent's split-second judgment about an impersonator, and the fact that it does is the vulnerability, not an excuse for it; carriers can and increasingly do add port-freezes and stronger verification, which is the fix on their side. What the register will not concede is that a known fix makes the problem unworthy of attention. The opposite is true: a solvable attack that keeps succeeding because the solution is not deployed is exactly the kind of failure worth naming loudly, because naming it is how the deployment finally happens. The SIM swap is not the victim's fault for trusting the system; it is the system's fault for being trustworthy in name only, and the register's job is to say so — and to say, plainly, what everyone should do about it.

7. Disposition — LAUNDERED

Case 25 followed money stolen through the theft of a phone number — the SIM swap, where a criminal talks a carrier into moving a victim's number to their own SIM, inherits everything the number unlocks, and drains the victim's crypto while their dead phone tells them nothing is wrong. The attack broke no cryptography and hacked no blockchain; it exploited the quiet, dangerous fact that the phone number had become the master key to digital life, and that the phone company would hand that key to whoever asked convincingly, or paid an insider.

The disposition — the money's fate — is LAUNDERED. Once the number was stolen and the accounts were seized, the crypto was swept out and pushed into the same wash as every crypto-native theft — intermediary wallets, mixers, chain-hops, bulletproof cash-outs — its origin, a stranger's hijacked phone number, buried under the machinery that cleans dirty crypto regardless of which crime produced it. The novelty was the front door; the back door was the register's ordinary laundering pipeline, and it swallowed the money in the window the attack itself created, while the victim was still on hold with their carrier, trying to get their own number back.

Hold the case's clearest lesson, because it is the register's most actionable. The SIM swap is a solvable problem kept alive by an unfinished fix: the vulnerability is the reliance on the phone number as identity, and the cure is to stop relying on it — hardware keys and app authenticators on the account side, port-freezes and PINs on the carrier side, none of which a stolen number can defeat. The attack persists not because it is unstoppable but because the world has not yet gotten off the phone number, and every account still guarded by a text is one port away from empty. The honeypot beneath these words watches attackers probe machines; this case watched an attacker probe a help desk, talk a number loose, and empty a human being's savings through a stolen identity. The vectors do not lie: the number moved to the attacker's SIM, the codes followed, the accounts fell, and the crypto went into the wash. Judge the crews who steal phone numbers to steal fortunes, and the carriers whose weak verification hands them the key. Then take the register's simplest advice in the whole series — that for anything holding real value, the phone number must not be the lock, because a lock the phone company will open for a stranger is not a lock at all.

Follow the Money continues. Case 25 disposition: LAUNDERED. Confidence: HIGH on the mechanism and the defense — the SIM-swap definition (social-engineering carriers to transfer a victim's phone service) is from the FBI IC3; the weakness of SMS/PSTN one-time passwords and the phishing-resistant alternatives (TOTP apps, WebAuthn/FIDO2 hardware keys) are documented in NIST SP 800-63B and OWASP's MFA guidance; the carrier/help-desk social-engineering tradecraft (vishing, MFA resets) is documented by CrowdStrike (e.g., Scattered Spider). The takeover cascade, the laundering-window aftermath, and the carrier-PIN/port-freeze defenses are described per the public record and standards. The proceeds' laundering through the register's standard pipeline (mixers, chain-hops, cash-outs) ties to Cases 05, 11, 12, 16. Bribed-insider port-outs are characterized as a documented path. Victims are centered and the victim-blaming frame is rejected; the fix is stated plainly. Classification: TLP:WHITE. Include everything — the vectors do not lie, and they do not judge. The reader judges the crews, the carriers, and the number that should never have been the key.