T-Mobile Reports a 99% Drop in Successful SIM Swap Attacks

A sharp decline, with an important caveat

T-Mobile says successful SIM swap attacks against its customers have fallen by more than 99% since 2022. The figure, published in a cybersecurity report today, points to a sharp change in account security at a carrier with a history of breaches and costly fraud. It’s a striking result, but it’s also a company-reported measure: the report’s claim describes outcomes, and readers don’t have enough detail here to independently assess how T-Mobile counted them.

A SIM swap attack targets the link between a phone number and the SIM or eSIM that connects a device to a mobile network. If an attacker persuades a carrier to move a number to a device they control, they may be able to receive calls and text messages intended for the customer. That can matter beyond phone service, because some online accounts use a texted code as part of sign-in or account recovery. The phone number becomes a route into other accounts.

The word “successful” matters. A fall in completed attacks doesn’t necessarily mean fewer criminals are trying, or that every customer is equally protected. It means the carrier says fewer attempts reached the outcome it tracks. The report’s separate claim that attempts rose 37% over a recent 12-month period reinforces that distinction: defense can improve while attackers keep probing.

Why SIM swaps can have wider consequences

SIM swaps exploit the trust placed in a phone number. Customers and services often treat control of that number as evidence that a person is who they say they are, even though the number can be transferred through a carrier’s account and support processes. When that transfer is abused, the damage can spread from mobile service to accounts that rely on calls or text messages for verification.

This doesn’t mean a SIM swap automatically gives an attacker access to a customer’s financial or online accounts. Other protections may stand in the way, and services differ in how they verify identity. But the attack illustrates a weakness in treating a phone number as a durable credential: it’s an identifier that a carrier can reassign, rather than a secret that only the customer knows.

That’s why carrier controls matter. Similar systems typically need to verify who’s requesting a number change, restrict suspicious changes, and give customers a way to detect or challenge account activity. The report’s headline figure suggests T-Mobile believes its defenses are working better. The available information doesn’t explain which particular safeguards drove the decline, so it can’t establish which measure deserves the credit.

The history gives the figure weight

The stakes are clear: early last year, T-Mobile paid $33 million after a SIM swap attack enabled the theft of $38 million in cryptocurrency from a customer. That history makes the latest numbers significant, though they’re the carrier’s own reported results. The payment and theft show how an attack on a mobile account can become part of a much larger loss.

This is more significant than it looks, but the comparison has limits. One high-profile incident demonstrates the potential harm; it doesn’t tell us how often similar attacks succeed across the company’s customer base. Likewise, a reported decline of more than 99% conveys a large change from the stated baseline, yet without additional detail about the underlying count, the reporting period, or the definition of success, the percentage alone doesn’t show the remaining level of risk.

That distinction is familiar in security reporting. A percentage can describe progress while hiding the scale of the starting point, and a decline in one class of incident can coexist with exposure elsewhere. For customers, the report is a signal about the carrier’s defenses, not a guarantee that a phone number can’t be targeted or that every account connected to it is safe.

Other reported defenses, and persistent pressure

The report also cites a 99% reduction in phishing-related employee credential compromises, alongside billions of blocked scam calls and texts. Those measures address different parts of the security problem. Employee credentials can provide access to internal systems, while scam calls and texts target people directly. Together, the figures describe a mix of controls aimed at company accounts and customer-facing abuse.

They shouldn’t be collapsed into one score. A blocked call or message is a different unit from a compromised employee credential or a successful SIM swap. Each measure can still be useful, but understanding it depends on knowing what’s counted and over what period. The report’s figures suggest activity across several defensive fronts; they don’t, by themselves, show that risk has disappeared.

And yet the 37% increase in attempted intrusions points to continued pressure on T-Mobile’s systems. A rise in attempts doesn’t prove that defenses are failing: it may accompany stronger detection or reflect attackers repeatedly testing accounts and infrastructure. But it does make the reported reduction in successful attacks a moving target. Defenses have to keep holding as the volume and character of attempts change.

What the results mean for customers

If you’re working in this space, the key question is how the carrier turns a percentage claim into a durable security outcome. That depends not just on preventing unauthorized number transfers, but also on how account changes are reviewed, how customers are alerted, and how quickly suspicious activity can be stopped. The report doesn’t supply enough detail to judge those processes, so the headline should be read as evidence of reported progress rather than a complete account of the controls.

For customers, the wider lesson is that phone numbers can be vulnerable points in account security. Where a service offers stronger sign-in options that don’t rely only on text messages, those options can reduce dependence on a number as proof of identity. A carrier’s defenses still matter, because a customer can’t personally control every step involved in moving a number between devices.

(And this is the part most people overlook.) Security metrics measure what an organization has chosen to track. They’re useful when definitions and baselines are clear, but a headline percentage can’t answer every practical question about the remaining threats. The report presents a marked improvement in T-Mobile’s stated results. The next test is whether that improvement holds while attempted intrusions continue to rise. Better defenses. Ongoing pressure.