SIM Swap Fraud: Lessons From the $373M Dallas Case

 A Dallas ring used SIM swaps and insiders to target $373M in accounts. Learn how SIM swap fraud works and why network checks beat SMS codes. 

This one hits close to home. Shush was originally founded in Dallas, and on November 3, 2026, federal prosecutors there unsealed charges against 14 people accused of using SIM swaps, spoofing and corrupt insiders to target nearly 3,000 bank customers holding more than $373 million.

We connect businesses to the mobile network signals that help catch this exact kind of attack, so we read the indictment closely. The headline is about one ring in North Texas. The lesson applies to every bank, fintech and app that still treats a text message code as proof of identity.

Below we cover what happened, how SIM swap fraud works, why SMS one-time passcodes fail when insiders are involved, and what you can do about it today.

What happened in the Dallas SIM swap case

A federal grand jury returned a 22-count indictment against 14 defendants, unsealed on November 3, 2026 by the U.S. Attorney's Office for the Northern District of Texas. The defendants are presumed innocent until proven guilty.

U.S. Attorney Ryan Raybould called North Texas "the financial services hub of America". That is why the case matters beyond Dallas: the same playbook works against any institution that relies on the phone number as a security key.

What is SIM swap fraud?

SIM swap fraud happens when a criminal gets a victim's phone number moved to a SIM card or eSIM they control. From that moment, every call and text meant for the victim, including login and payment codes, goes to the attacker.

A typical SIM swap attack runs in four steps:

1. Gather personal data. Names, dates of birth, addresses and account details come from breaches, phishing or data brokers.
2. Take over the number. The attacker impersonates the victim to the mobile carrier, uses a fake ID, or pays an insider to move the number.
3. Intercept the codes. The victim's phone loses service. The attacker now receives the one-time passcodes sent by text.
4. Drain the accounts. The attacker resets passwords, adds new devices or payees, and moves money before the victim notices.

The warning sign for victims is sudden "No Service" on a phone that normally works. By the time most people notice, the damage is done.

Why SMS one-time passcodes fail against SIM swaps

An SMS code proves only that someone received a text sent to a phone number. It does not prove who that person is, or that the number is still on the same device it was yesterday.

That weakness gets worse when insiders are involved, as alleged in the Dallas case:

• Carrier insiders can move a number without any customer interaction, so carrier-side identity checks never fire.
• Bank insiders can expose account data or bypass internal controls, giving attackers the details they need to pass knowledge-based questions.
• Spoofing lets attackers pose as the bank or the victim on calls, adding social engineering on top of the technical takeover.

When anyone in the chain can be bribed or fooled, the code alone proves very little. Banks need a second signal that does not depend on the code: the mobile network's own record of the SIM and the device. It cannot prove who is holding the phone, but a recent SIM change is a strong reason to step up verification or pause the transaction before money moves.

How to stop SIM swap fraud: check the network, not the text message

The strongest defense is to ask the mobile network directly, in real time, before you trust a phone number. Mobile operators now expose these checks as standard APIs through GSMA Open Gateway and the open-source CAMARA project.

Two checks matter most:

• SIM swap check. Before a login, password reset or high-value transfer, ask the operator whether the SIM behind the number changed recently. A swap in the last hours or days is a strong fraud signal, whether it came from a fake ID or an insider.
• Number Verify. Confirms silently, over the mobile data connection, that the device in use actually holds the SIM for the claimed number. Telefónica describes it as an alternative to SMS codes for sign-up, login and transaction approval. Nothing is typed, so there is no code to phish or intercept. On its own, though, it does not detect a SIM swap: once the number is moved, the attacker's device holds the SIM and passes the check. Use it to replace SMS codes, and pair it with a SIM swap check before high-risk actions.

Adoption is growing fast. Bridge Alliance now has its first enterprise customers on Number Verify, and operators in the Philippines, including DITO, are backing Open Gateway to fight scams. Shush is part of that momentum: One New Zealand has tested SIM Swap and Number Verify APIs end to end through Shush, and DITO has launched Silent Network Authentication commercially.

Shush connects businesses to these carrier signals through a single partner program. Live today are CAMARA SIM Swap and Number Verification, Silent Authentication and Number Lookup across the Philippines, the UK, and Guam and the Northern Mariana Islands, with access reviewed with each carrier. 

SIM swap prevention checklist for banks, fintechs and apps

Use this list to find the gaps in your own authentication flow:

• ☐ Run a real-time SIM swap check before password resets, new device enrollment and new payees.
• ☐ Add a SIM swap check before any high-value or first-time transfer.
• ☐ Replace SMS OTP with silent Number Verify where operator coverage allows, and keep a SIM swap check in front of it for high-risk actions.
• ☐ Hold or step up risky actions when a recent swap is detected, instead of blocking every user.
• ☐ Log every check so fraud teams can trace attacks, including insider-assisted ones.
• ☐ Limit which staff can change contact details or bypass authentication, and audit those actions.
• ☐ Tell customers what "No Service" can mean and how to report it fast.

FAQ

What is a SIM swap attack?
A SIM swap attack moves a victim's phone number to a SIM or eSIM controlled by a criminal, who then receives the victim's calls and text codes.

How can I tell if my SIM was swapped?
Your phone suddenly shows "No Service" or "SOS only" where it normally works, or you get alerts about account changes you did not make. Contact your carrier and your bank right away.

Is SMS two-factor authentication safe?
It is better than a password alone, but SMS codes can be intercepted after a SIM swap. Network-based checks and app-based authenticators are stronger.

What is a SIM swap check API?
It is a mobile operator service that tells a business, in real time, whether the SIM behind a phone number changed recently, so risky actions can be stopped before money moves.

Can insiders at phone companies cause SIM swaps?
Yes. The Dallas indictment alleges insiders at banks and telecom companies helped bypass authentication, which is why businesses need checks that do not depend on any single person.

The takeaway

When an insider can move a phone number, a text message code proves nothing. The Dallas case shows how far that gap can reach: nearly 3,000 people and more than $373 million in balances, run from the city where Shush was founded.

Better signals exist today. A live SIM swap check, straight from the mobile network, flags the risky moments SMS codes miss, so banks can step up verification or pause a transaction before money moves. Silent number verification removes the code attackers try to steal.

Talk to Shush about adding real-time SIM swap checks to your login and payment flows. Contact us!

Sources

• Federal grand jury indicts fourteen defendants in $370 million nationwide bank account takeover scheme, U.S. Attorney's Office, Northern District of Texas, Nov 3, 2026
• Number Verification API, Telefónica Open Gateway
• GSMA Open Gateway, GSMA