MOBILE IDENTITY / FRAUD FILE
When the number moves,
check the accounts.
SIM-swap fraud is an account-control problem as well as a mobile-network problem.
A phone number can sit behind several account-recovery and verification routes. Losing control of it can therefore create a wider access problem even when the physical phone has not been stolen.
The Cifas findings describe a sharp rise in recorded SIM-swap fraud. Their scope matters, and the practical response should not depend on assumptions about a universal attack sequence.
THE EXECUTIVE BRIEF
The decisions that matter.
- The 1,055% rise concerns 2024 cases filed to the Cifas National Fraud Database.
- Protect the mobile-provider account, primary email, and important recovery routes together.
- Choose stronger supported sign-in without creating a recovery lockout.
THE ORIGINAL FIGURE / MAY 2025
What increased by 1,055%?
Cifas’s 7 May 2025 release reported nearly 3,000 unauthorised SIM-swap cases filed to its National Fraud Database in 2024, up 1,055%. It also reported an 87% rise in identity fraud linked to mobile products and a 76% increase in facility takeover. Those categories overlap in context but are not interchangeable counts.
The figures describe database filings and their reporting period, not every incident in the UK or a current population-wide probability. A large percentage increase should be read alongside the underlying case volume.
The verified release supports a proportionate review of mobile-account protection. It does not establish a universal attack duration or a guaranteed reduction in fraud from one bank’s technical control.
THE ACCOUNT CONNECTION
The number is one link in a chain of authority.
A MOBILE-ACCESS REVIEW
Protect the route behind the code.
PROVIDER
Who can change the mobile account?
Check supported account protections and how a replacement SIM, eSIM, or number transfer is authorised.
Who can reset the account behind it?
Protect primary email and review the recovery details that can be used to change access.
IMPORTANT SERVICES
Which systems still depend on the number?
Identify financial, cloud, and business accounts using the number for sign-in or recovery.
RECOVERY
What works when the number does not?
Keep supported alternative recovery methods available and protected away from the single point of loss.
CyberSolace account review. This is a dependency checklist, not a claim that all SIM-swap incidents follow the same sequence.
Fraud can involve stolen information, social engineering, compromised accounts, or abuse of an authorised process. The role of an insider is a risk to assess, not an inference that every provider employee or contractor is suspect.
A case in one country or provider does not establish a typical UK mechanism. Apply role-based access, supervision, and appropriate review of sensitive changes to the actual service.
STRONGER SIGN-IN
Remove avoidable dependence without breaking recovery.
NCSC passkey guidance explains a phishing-resistant option where services support it. NIST authentication guidance distinguishes those methods from SMS and app-generated one-time codes, which are not phishing-resistant. That does not make every additional factor useless; the options and risk need assessing for the account.
For important services, select the strongest supported method and review fallback routes. A service can retain a weak recovery path even after a stronger everyday sign-in is enabled.
Do not delete every recovery number or method blindly. Make sure a supported and usable alternative exists first. Record recovery material securely and avoid keeping its only copy on the phone needed to use it.
WHEN SOMETHING CHANGES
Treat unexplained loss of service as a prompt to check.
Contact the provider through an independently established route if service unexpectedly disappears or the account shows an unfamiliar change. Do not assume every outage is fraud, but do not rely on the affected number as the only way to verify what happened.
Where financial or business accounts may be exposed, alert the relevant bank or support team and use their recovery process. Review changes, active sessions, and relevant records as well as the password.
For a business, agree who can request number or account changes and how those requests are checked. Keep the arrangements current when devices, staff, or providers change. The goal is a controlled route to regain access, not a promise that a single PIN prevents every scenario.
A PRACTICAL NEXT STEP
Review the accounts that depend on one number.
Start with email, the mobile provider, and the services whose recovery would be hardest to manage without that number.
SOURCES & EDITORIAL REVIEW
Historical findings and incident accounts are dated in the text. Illustrative review prompts are CyberSolace commentary. Editorial review: 20 October 2026.