Which? publishes data showing Sim-swap scam reports to Action Fraud doubled year-on-year

Which? published exclusive data at the beginning of the year showing that reports of Sim-swap scams to Action Fraud had doubled year-on-year¹. In a follow-up article on 21 May 2025, it reported new figures from the fraud prevention service Cifas showing that its members, including mobile networks and other telecom providers, recorded a 1,055% increase in cases of unauthorised Sim swaps, up from 289 in 2023 to almost 3,000 in 2024¹.

Sim swapping involves criminals hijacking a mobile number, which allows them to access online accounts and intercept text messages from a bank¹. Which? said that in two cases it examined, the victims' email accounts had been compromised first and were not secured with two-factor authentication¹. It said that while mobile networks run their own security checks at login, customers can ask for one-time passcodes to be sent to their email address instead of their phone, which can open the door to fraudsters¹.

Action Fraud shared findings with Which? based on analysis of a representative sample of 1,000 reports across five years¹. It said 2024 saw a substantial rise in cyber-dependent means of accessing an online mobile account to commit a Sim swap, that vishing calls impersonating a mobile provider remain prevalent, and that references to eSIMs rose from 18 reports in 2022 to 763 in 2024, an increase of over 600%¹. It added that there is no indication that victims who have an eSIM are uniquely vulnerable¹.

Reported losses increased by 26% between 2023 and 2024, to a total of £5.4m, compared with an increase in reporting of 129%¹.

Which? reported that in one case, a Giffgaff customer's email account was hijacked, allowing scammers to reset her Giffgaff password and request a number swap to a Sim they controlled; her bank blocked a card attempt to buy iPhones and other goods¹. In the other, an O2 customer's email account was accessed, and scammers called customer services to move her number to their own eSIM; her bank blocked an £800 transaction at B&Q and froze her card¹.

Why it matters for households

A Sim swap gives a criminal control of a phone number, so passcodes sent by text to that number can be intercepted and used to reach bank, email and shopping accounts¹. The Cifas figures cover unauthorised swaps reported by telecom providers, so they reflect cases detected and recorded by those members rather than the total number of attempts¹. Action Fraud's sample indicates that reported losses have grown more slowly than reporting volumes, with losses up 26% against a 129% rise in reporting between 2023 and 2024¹. Which? reported that both victims it spoke to had email accounts without two-factor authentication, and that networks allow passcodes to be sent by email in some circumstances¹. It has not been reported how many of the Cifas cases involved email accounts without two-factor authentication.

What happens next

No further steps have been reported. Which? set out five measures it says can reduce the risk of Sim-swap fraud, including asking a network about additional security such as a PIN or password for account changes, turning on two-factor authentication for email and social media accounts, restricting what is visible on social media profiles, contacting a network immediately after an unexpected message about a Sim being ported or a PAC request, and telling banks so accounts can be frozen and statements checked¹. Its scams and fraud guide covers how to report and respond to fraud, and its comparison of credit card and debit card protection sets out how each is treated when fraud occurs.