SIM swap in Mexico: what it is and how to protect yourself

SIM swap — also called portability fraud or SIM hijacking — happens when someone transfers your phone number to a SIM card they control. Overnight, your calls and SMS go to the criminal's device. If your bank sends verification codes via text, the attacker receives them and can authorize transfers, change passwords, or register new devices in your online banking.

How SIM swap is executed in Mexico

Criminals collect personal data (name, CURP, address, recent transactions) through phishing, leaks, or social engineering. With that information they call or visit a carrier store — or bribe employees — to request a SIM replacement or portability to another carrier. Once activated, your line stops working and theirs receives everything.

• Sudden loss of cell signal without geographic explanation.
• Portability or SIM change SMS you didn't request.
• Banking login notifications while you have no service.
• Prior calls from 'technical support' asking to confirm personal data.

Why it's so dangerous for your banking

Many Mexican banks still use SMS as a second authentication factor. Although the trend is migrating to token apps or biometrics, millions of accounts depend on a six-digit code sent by message. If the criminal controls your number, that code is theirs. In documented cases, victims lost tens or hundreds of thousands of pesos within minutes.

Your cell number isn't just a phone — it's a master key if your bank uses it to verify identity.

Concrete protection measures

1. Activate the portability PIN with your carrier (Telcel, AT&T, Movistar). Without it, no one can port your line.
2. Configure SIM change or portability alerts if your carrier offers them.
3. Move banking verification to a token app or security key, not SMS.
4. Don't publish your number on social media or use it as recovery for critical accounts if you can avoid it.
5. Require in-person ID and additional verification for SIM replacement at stores.

What to do if you suddenly lose signal

Immediately contact your carrier from another phone to block portabilities. Call the bank to freeze transfers and digital access. Change email and banking passwords from a secure device. File a report: SIM swap is a crime and documentation helps in claim processes.

Businesses: corporate numbers are targets too

Numbers assigned to treasury or CFOs are especially valuable. Restrict who can request SIM changes on business contracts, use hardware tokens for corporate banking, and document emergency procedures if a key number is compromised.

Regulatory framework in Mexico

Since 2020 carriers must request portability PIN before transferring a line. If you suffer SIM swap and the carrier accepted fake documents, you can file complaints with IFT and PROFECO besides criminal report. Document the exact time you lost signal, portability SMS screenshots, and subsequent banking transactions — that timeline is key for recovery and investigation.

Devson Labs advises companies on authentication hardening and response to telephony fraud incidents. If you depend on SMS for critical operations, let's talk about more resilient alternatives.