These processes are used legitimately to switch phone providers or activate a new SIM but keep an existing phone number. The same process is used by criminals to hijack the victim’s phone number, so they can receive verification codes for payments, or password resets for online banking.
The criminals normally start by harvesting personal information and contact details using a range of methods including social engineering, phishing and hacking emails or devices.
Mobile Porting: Once they've obtained the information, the criminal will then contact a different phone company to set up an account and have the mobile number ported over to that provider.
SIM Swapping: Once they've obtained the information, they will then contact the existing phone company and request that a new SIM is activated with the existing mobile number, swapping the SIM which, deactivates the old SIM.
The criminal can then receive all verification codes for payments, or password resets for online banking and access the customer's bank accounts.