Poland's SIM Swap Arrests Show Why Your Phone Number Is Still a Financial Attack Surface

Polish cybercrime police have arrested four suspected members of an organized group accused of using SIM swapping to steal cryptocurrency and launder the proceeds through a distributed financial network.

The case matters because it shows how modern SIM swap attacks are no longer just about tricking a carrier store employee into issuing a duplicate SIM. According to Poland's Central Bureau for Combating Cybercrime, the suspects allegedly breached telecom-adjacent infrastructure and employee email accounts, then used that access to take over victims' phone numbers, intercept communications, and compromise cryptocurrency exchange accounts.

For anyone holding high-value digital assets, the lesson is simple: your phone number should not be treated as a secure identity anchor.

On June 25, 2026, Poland's Central Bureau for Combating Cybercrime, known locally as CBZC, announced that officers had detained four people suspected of participating in an organized cybercrime group involved in advanced cyberattacks, digital-asset theft, and large-scale money laundering.

The operation was not purely domestic. CBZC said agents from the FBI and Homeland Security Investigations took part in coordinated operational activity, while the Regional Prosecutor's Office in Krakow is supervising the investigation.

According to investigators, members of the group allegedly used specialized software and social engineering to gain unauthorized access to the infrastructure of entities cooperating with telecom operators, as well as employee email accounts. The information obtained through those intrusions allegedly enabled SIM swap attacks, including illegal cloning or takeover of victims' phone numbers.

Once the attackers controlled the number, they could intercept SMS messages and email communications. That gave them a path into online accounts, including cryptocurrency exchange accounts. Authorities allege the group then stole digital assets at scale.

CBZC also said the stolen funds were quickly moved into the legal financial system through a dispersed network. The suspects allegedly used personal bank accounts in Poland and abroad, international payment platforms, and multi-currency digital wallets. Authorities estimate that the total value of funds laundered through the scheme exceeded several tens of millions of Polish zloty.

All four detained people were placed in pre-trial detention. They face allegations including participation in an organized criminal group, breaking into IT systems connected to theft, and money laundering. Polish authorities said the potential penalty could reach 25 years in prison.

CBZC has not disclosed the names of the victims, the exact exchanges involved, the number of compromised accounts, or the accounts secured by law enforcement. The agency said the case remains developing and that details are limited because of the investigation's international component.

SIM swapping is often explained as a consumer scam: a criminal gathers personal information, calls the carrier, impersonates the victim, and convinces the carrier to move the victim's number to a SIM controlled by the attacker.

That still happens. But the Poland case points to something more serious: attackers allegedly went after the systems and people around the telecom process. Instead of only impersonating individual victims, they are accused of compromising telecom-adjacent infrastructure and employee email accounts to obtain the data needed for number takeovers.

That distinction matters.

It shows that a phone number is not just a customer-support issue. It is an identity dependency shared across telecom providers, email services, banks, payment platforms, cryptocurrency exchanges, and account recovery workflows. If attackers can control the number, they may be able to trigger password resets, intercept one-time codes, bypass weak two-factor authentication, and approve account actions that look legitimate to the platform receiving the code.

The phone number becomes a bridge between systems that should not trust each other so much.

Cryptocurrency accounts are especially attractive in SIM swap attacks because the attacker has a narrow window where speed matters more than stealth.

Once a number is moved to the attacker's device, the victim may lose service or stop receiving calls and texts. If the victim notices quickly, the carrier may be able to reverse the change. But in the minutes or hours before that happens, the attacker can try to reset passwords, intercept one-time codes, access email, approve withdrawals, and move assets through wallets or laundering channels.

Traditional banking fraud often has more reversal paths. Crypto transfers are different. Once assets move on-chain and are pushed through multiple wallets, exchanges, mixers, casinos, payment platforms, or mule accounts, recovery becomes harder and more time-sensitive.

That is why law enforcement cooperation matters. The Poland case involved Polish cybercrime officers, U.S. federal agencies, and an ongoing international component. SIM swap theft may start with a phone number, but the money movement rarely stays inside one country.

This is not an isolated technique.

In a 2022 public service announcement, the FBI's Internet Crime Complaint Center warned that SIM swapping was being used to steal money from fiat and virtual currency accounts. IC3 said it received 320 SIM swapping complaints with about $12 million in adjusted losses from January 2018 through December 2020. In 2021 alone, that jumped to 1,611 complaints and more than $68 million in adjusted losses.

The broader crypto-crime environment has only become more industrialized since then. The FBI's 2025 IC3 report said cryptocurrency investment fraud was the highest source of financial losses reported to Americans that year, with $7.2 billion in reported losses. Chainalysis estimated that crypto scams and fraud received at least $14 billion on-chain in 2025 and projected the figure could exceed $17 billion as more illicit wallet addresses are identified.

Not all of that is SIM swapping. But it explains why attackers keep returning to identity weak points around phone numbers. The payoff can be large, the workflow is repeatable, and criminals can combine SIM swaps with phishing, social engineering, stolen credentials, employee compromise, and money-laundering networks.

The attack has evolved from "steal the code" to "own the recovery path."

SMS two-factor authentication is better than having no second factor at all. But it was never designed to be a high-assurance security layer for people whose number is tied to serious financial, professional, or reputational risk.

The core weakness is structural: SMS proves control of a phone number, not control of the rightful user.

If a criminal can move that number to another SIM, port it out, or intercept messages through a compromised telecom workflow, the services relying on SMS may treat the attacker as the legitimate account holder. The same problem applies to account recovery flows that use phone numbers as backup proof of identity.

This is why high-value users should reduce their dependency on phone-number-based recovery wherever possible. That includes cryptocurrency holders, founders, executives, public figures, finance professionals, journalists, activists, creators, and anyone whose email, exchange accounts, or social profiles could become a high-value target.

1. Remove SMS from critical accounts where possible

Use phishing-resistant authentication such as hardware security keys or passkeys for primary email, cryptocurrency exchanges, password managers, banking, cloud accounts, and social platforms. If hardware keys or passkeys are not available, an authenticator app is generally stronger than SMS.

2. Harden your email first

Email is often the recovery hub for everything else. If an attacker controls your phone number and can reset your email password, the damage can spread quickly. Protect your main email with strong MFA, backup codes stored offline, recovery options that do not rely only on your phone number, and alerts for new sign-ins or recovery changes.

3. Lock down your carrier account

Ask your mobile provider what protections are available for SIM changes and number port-outs. Depending on the provider, this may include a port-out PIN, number lock, account takeover protection, in-store-only changes, or extra verification before a SIM replacement.

4. Reduce public exposure of your number

Do not use your primary mobile number as a public contact number if that same number protects financial accounts. The more widely a number is exposed, the easier it is for attackers to connect it to your identity, accounts, company role, and asset profile.

5. Separate communication from account recovery

For high-risk users, the number used for day-to-day calls and texts should not be the same weak recovery key for high-value accounts. Treat account recovery as a security architecture problem, not a convenience setting.

6. Monitor for early warning signs

Warning signs include sudden loss of cellular service, unexpected SIM change or port-out notifications, password reset emails you did not request, new-device login alerts, missing messages, or being locked out of accounts. If your phone suddenly shows no service in a place where it normally works, do not assume it is just a network issue.

7. Have an emergency response plan

If you suspect a SIM swap, contact your carrier immediately, lock or freeze financial accounts where possible, secure your email, revoke active sessions, change passwords from a trusted device, contact affected exchanges or banks, and file a law-enforcement report. For U.S. victims, IC3 is the FBI's reporting channel for internet crime.

The Poland case also matters for companies, not just consumers.

Any organization that uses phone numbers for employee identity, privileged access, help-desk verification, customer recovery, payment approval, or crypto-asset custody should assume that phone numbers can be compromised.

Security teams should review:

• Whether privileged employees can reset accounts using SMS.
• Whether finance, executive, and IT staff have stronger authentication than ordinary users.
• Whether help-desk workflows allow phone-number changes without high-assurance verification.
• Whether account recovery can be abused after a telecom event.
• Whether employee mailboxes are monitored for unusual forwarding rules, OAuth grants, new inbox rules, and suspicious logins.
• Whether high-risk customers receive extra scrutiny for SIM-change, device-change, withdrawal, and recovery events.
• Whether vendors and telecom-adjacent partners have access paths that could expose customer phone-number workflows.

The key lesson is not simply "use better MFA." It is that telecom identity, email identity, and financial identity are often chained together. Attackers only need one weak link to start the takeover.

The phone number has become more than a way to communicate. For many people, it is tied to banking, email, crypto exchanges, social media, business tools, and personal identity. That makes it valuable. It also makes it dangerous when treated casually.

SIM swapping works because too many systems still treat control of a number as proof of identity. The Poland arrests show how much criminal infrastructure can form around that assumption: social engineering, telecom-adjacent compromise, employee mailbox access, account takeover, crypto theft, and laundering through international financial channels.

For high-value users, mobile service should be designed with this reality in mind. The goal is not just to keep a phone connected. The goal is to protect the number as a critical identity asset.

That requires stronger account controls, stronger recovery design, faster response, and less reliance on SMS as a security layer. If your phone number protects your money, your email, or your public identity, it deserves the same level of attention as any other high-value credential.

Key Takeaways

• Polish authorities arrested four suspects in a SIM swapping and crypto-theft investigation involving FBI and HSI support.
• Investigators allege the group compromised telecom-adjacent infrastructure and employee email accounts to enable phone-number takeovers.
• The attackers allegedly used control of SMS and email channels to compromise cryptocurrency exchange accounts.
• Authorities estimate laundered proceeds exceeded several tens of millions of Polish zloty.
• The case shows why SMS-based authentication and phone-number-based recovery are dangerous for high-value users.
• Crypto holders, executives, founders, public figures, and security-sensitive users should move critical accounts to phishing-resistant MFA and harden carrier-level protections.

FAQ

What is SIM swapping?

SIM swapping is an account takeover technique where an attacker gains control of a victim's phone number by moving it to a SIM or device controlled by the attacker. Once that happens, calls and text messages meant for the victim can go to the attacker instead.

Why does SIM swapping help attackers steal crypto?

Many accounts still use SMS codes or phone-number recovery. If an attacker controls the victim's number, they may be able to reset passwords, intercept one-time codes, access email, approve withdrawals, and move funds before the victim regains control.

Did Polish authorities name the victims or exchanges?

No. CBZC said details about attack targets and secured accounts are not being disclosed at this stage because the case is ongoing and has an international component.

Is SMS two-factor authentication useless?

No. SMS 2FA can be better than no 2FA. But it is not strong enough for high-value accounts when stronger options such as passkeys, hardware security keys, or authenticator apps are available.

What should I do if my phone suddenly loses service?

Treat sudden unexplained loss of service as urgent. Contact your carrier, check for SIM change or port-out activity, secure your email and financial accounts, revoke suspicious sessions, and report confirmed fraud to the relevant platform and law enforcement.