T-Mobile Cuts SIM Swap Attacks by 99%

The carrier credits tighter identity checks, biometric verification, and passwordless authentication for the drop in successful attacks since 2022.

Updated on Nov. 2, 2026 in Cybersecurity

Isometric editorial illustration of an oversized brass key with a fingerprint-patterned bit on a deep-teal plinth against a muted background. — T-Mobile says successful SIM swap attacks against its customers have fallen more than 99% since 2022, crediting tighter identity checks and biometric verification. AI Illustration. Upload story photo >

Live Poll

Do you trust your phone carrier to protect your number from SIM swap attacks?

T-Mobile reported in a cybersecurity report that successful SIM swap attacks against its customers have fallen more than 99% since 2022. Attempted intrusions against its systems rose 37% over a recent 12-month period.

Why it matters

SIM swap fraud lets attackers take over a phone number and intercept accounts, and the carrier's figures show how identity controls can reduce that risk. The report also indicates that intrusion attempts are rising even as successful attacks decline.

T-Mobile reported that successful SIM swap attacks fell more than 99% since 2022 and that phishing-related employee credential compromises fell by the same margin after it moved staff to FIDO2 hardware security keys. The company's figures are self-reported, and the report does not give the underlying attack counts.

The players

T-Mobile

T-Mobile is a major U.S. wireless carrier that operates one of the country's largest mobile networks and has publicly reported on its cybersecurity defenses.

Salt Typhoon

Salt Typhoon is a state-linked hacking group that has targeted telecommunications providers to access sensitive communications data.

The details

T-Mobile credits tighter identity checks, biometric verification, SIM Protection, and Port-Out Protection for the improvement. The company restored self-service SIM transfers through its T-Life app in 2025, reversing a 2022 restriction.

2022: Self-service SIM transfer restriction introduced, the baseline for the 99% decline.
2024: Defenses stopped the Salt Typhoon group from accessing sensitive customer communications.
2025: Self-service SIM transfers restored through T-Life; nearly three billion scam texts blocked.
2026-11-02
T-Mobile publishes its cybersecurity report.

Roadmap

T-Mobile's 2022 restriction on self-service SIM transfers was a direct response to rising SIM swap fraud across the wireless industry. Restoring self-service transfers in 2025 while reporting a 99% drop in successful attacks marks a shift toward relying on stronger identity verification rather than blanket access limits.

Customers can once again transfer SIM service through the T-Life app, but the restored feature keeps the identity checks T-Mobile says cut successful attacks. Users who rely on phone numbers for account recovery should keep additional verification enabled on their accounts.

The takeaway

Strong identity verification can sharply reduce SIM swap fraud without shutting off legitimate account management. Customers should enable carrier-level protections such as SIM Protection and Port-Out Protection where available.