Threat Intelligence Directory
Fraud

SIM Swap Attack

Attack Trigger

Attacker convinces your mobile carrier to transfer your number to their SIM card

What Attackers Want

Full financial account access — losses of $10,000–$1,000,000+ reported

How This Attack Works

In a SIM swap attack, a fraudster calls your mobile carrier pretending to be you and requests a SIM transfer to a new phone. Once your number is moved to their device, they intercept SMS-based two-factor authentication codes and gain access to your bank, email, and crypto accounts.

Red Flags to Watch For

  • Your phone suddenly loses all carrier signal for no apparent reason
  • You receive unexpected carrier account change confirmation texts
  • Emails or bank alerts show logins or password resets you did not initiate
  • Fraudulent account access notifications across multiple services simultaneously
  • Carrier customer service confirms a recent SIM transfer you did not request

Known Malicious Domains

These domains have been associated with this attack. Never click links going to these addresses.

  • carrier-account-verify.comMALICIOUS
  • phone-number-transfer.netMALICIOUS
  • mobile-sim-update.comMALICIOUS

Glance automatically blocks emails from domains on this list. Domain list is not exhaustive — attackers register new domains continuously.

How Glance Stops This

  • Domain similarity analysis catches lookalike sender addresses at millisecond speed
  • SPF / DKIM / DMARC validation flags authentication failures before you ever see the email
  • VirusTotal + Google Safe Browsing checks every link in real time
  • Urgency language detection scores the email higher for manual review
  • Known malicious domain blocklist updated continuously from live scan data

Don't wait to get hit.

Glance scans every incoming email against 12 detection layers — including the exact tactics described above — before it reaches your inbox.

Protect My Inbox — Free