T-Mobile says it's winning the fight against SIM swap attacks after years of trouble

T-Mobile knows better than most carriers how expensive a stolen phone number can become. Early last year, the Un-carrier paid out $33 million after a SIM swap attack cost a customer $38 million in cryptocurrency. Add the carrier’s troubled history with data breaches, and it’s easy to see why security promises alone might not inspire much confidence. But T-Mobile now has some striking numbers to back up its latest claims.

In a new cybersecurity report published today, the carrier says successful SIM swap attacks against its customers have fallen by more than 99% since 2022. That’s a remarkable turnaround for a company whose security record has repeatedly made headlines for the wrong reasons.

T-Mobile says its security overhaul is paying off

The carrier credits tighter identity checks, biometric verification, and features such as SIM Protection and Port-Out Protection for the improvement.

These safeguards matter because a phone number can become a skeleton key to someone’s digital life. As we recently saw with Garmin Messenger, even legitimately recycled numbers can raise troubling questions about access to private conversations when services rely heavily on SMS verification. SIM swapping creates a different, more deliberate route to the same underlying danger: someone else controlling the number you trust to protect your accounts.

Interestingly, T-Mobile restored self-service SIM transfers through its T-Life app last year, reversing a 2022 restriction introduced amid security concerns. But customer accounts aren’t the only battleground. Phishing-related employee credential compromises have also dropped by more than 99% after the company switched to passwordless authentication using FIDO2 hardware security keys.

The report highlights several other milestones:

• Nearly three billion scam and spam texts blocked in 2025.
• More than 160 billion unwanted calls identified or blocked since 2017.
• Its zero-trust security platform blocked over six million online threats.

T-Mobile also claims its defenses stopped the Salt Typhoon hacking group from accessing sensitive customer communications during a 2024 intrusion attempt. Still, the attackers haven’t disappeared. Attempted intrusions actually increased 37% over a recent 12-month period.

For a carrier that has repeatedly made headlines for security failures, these numbers mark a welcome change of direction. But there’s still a telling twist: while T-Mobile says successful attacks are plummeting, attempts to break into its systems are actually increasing. The hackers clearly haven’t given up. T-Mobile just wants us to believe it’s getting much better at keeping them out.