What is a sim-swap? How you could be targeted by the fraud used to hack M&S

Experts have raised the alarm about SIM swapping fraud after the number of recorded scams surged tenfold in a year.

There was a 1,055 per cent increase in unauthorised phone SIM swaps in the UK in 2024 - a practice which not only leads to people having their money stolen but also their identity.

SIM swapping, believed to have played a role in the cyberattack on Marks & Spencer and the Co-op, is when a fraudster transfers a customer’s phone number to a SIM card in their possession, thereby gaining control of that mobile phone.

Simon Miller, director of policy, strategy and communications at fraud prevention service CIFAS, which conducted the research, told The Independent the rise was “particularly concerning.”

“Many frauds are just a case of a single loss of money,” he said. “When you lose your identity, it has an enduring long term impact. SIM swap fraud points to the growing sophistication of frauds and gives them ever more control over our daily lives.”

M&S revealed it had fallen victim to a “cyber incident” on Easter Monday and has since paused online sales. The National Cyber Security Centre (NCSC) later put out guidance for retailers to help combat “social engineering” techniques used by hackers, including impersonating employees and tricking IT helpdesks into resetting passwords.

Here’s all you need to know about SIM swapping - and how not to fall victim to it.

What is it?

SIM swapping is when fraudsters take control of a consumer’s phone account and request a SIM swap through identity theft or stolen data. The consumer’s phone number is then transferred to the fraudster’s SIM card and in many cases they even request a new SIM number.

With access to your phone account, fraudsters can bypass defence systems against fraud and identity theft, such as two-factor authentication, or receipt of security codes which help access accounts.

Mr Miller said: “It's not just about the phone account - which is useful because it would ultimately enable fraudsters to request an upgrade and potentially get a £1000 phone for free - it's about the access to all of your other accounts and particularly the security mechanism that enables you to verify your identity.”

How could it affect me?

Losing control of your phone account has a direct impact on every service you use that is connected to your mobile phone number. This includes access to your social media accounts and even your bank account. Not only can the fraudster gain access to your finances, but SIM swapping can leave you in the dark about exactly how much money you might be using.

“If you think of the number of times in a day, every time you go to the a shop or buy a coffee, you'll receive a push notification from your bank telling you that a transaction has made,” says Mr Miller. “You suddenly lose sight of all of that. So it's not just the fact you become more susceptible to fraud, you're much less likely to be aware of the fact that it's happening in the first instance.”

How many people and companies has it affected?

Levels of SIM swapping remain low, but are increasing rapidly, according to experts. A total of 289 cases were logged on the National Fraud Database in 2023, which rose to more than 3,000 in 2024.

How do I know if I’ve had my SIM swapped?

A sudden loss of control from your phone is the first sign of SIM swapping. Your device will no longer work because it is no longer connected to the network, although it may still be connected to Wi-Fi.

You many also lose access to your email, bank or social media accounts. Keep an eye out for unauthorised transactions - any payments on your account that you don’t remember making could be a sign of fraudulent activity.

What should I do if I’ve been affected?

Those affected by SIM swapping should immediately get in contact with their bank and mobile service providers in order to regain control of their accounts.

It’s important to start contacting service providers the moment you realise you’ve fallen victim to SIM swapping because the person who has taken control of your accounts will do what they can to rapidly change all the details associated with the accounts, which make make it harder to prove that you are the original account owner.

How can I prevent it?

While anyone can fall victim to fraud, there are some “golden rules” which can make you safer, according to Mr Miller.

Rule number one is making sure you have strong passwords across the board - and making sure you use different passwords for key accounts.

Mr Miller added that many of these frauds are enabled by people responding to unexpected text messages. In the case of SIM swap fraud, this may be because of a text message asking you to put details into a website, or a phone call from someone pretending to be on the mobile phone provider.

“The rule here is if you received an unexpected message and we are bombarded with these, it's always to pause,” he says. “It's always to stop and think actually this is genuinely for me was I expecting this and get a second opinion.”