Your phone lost service, and your Crypto.com account was drained — including your Visa card balance. A scammer SIM-swapped your number, intercepted SMS 2FA, and withdrew your crypto or spent it through the Crypto.com Visa card. Crypto.com is Singapore-headquartered (MAS-regulated) with a US subsidiary (FinCEN MSB). We trace the withdrawals, freeze the Visa card, and file with Crypto.com compliance team — leveraging MAS for regulatory pressure.
A SIM swap attack (also called SIM hijacking or port-out fraud) is when a scammer convinces your mobile carrier to transfer your phone number to a SIM card they control. Once they have your phone number, they intercept SMS-based 2FA codes and gain access to your Crypto.com account — bypassing SMS verification, changing the password, and withdrawing your crypto. The attack often happens at night, and victims discover it when they wake up to a dead phone and an empty Crypto.com account.
Why Crypto.com is targeted for SIM swap attacks: Crypto.com is unique: it issues a Visa card linked to crypto balances. In a SIM swap attack, the scammer can not only withdraw crypto but also spend it directly through the Visa card — buying goods at any Visa-accepting merchant. This creates two withdrawal paths: crypto withdrawals (traceable on-chain) and Visa spending (traceable through Crypto.com fiat records). Both are recoverable.
The attack sequence: First, the scammer gathers your personal information through data breaches, social media, or phishing. Then they contact your mobile carrier (or bribe an insider) to port your number to their SIM. Once they have your number, they intercept the Crypto.com SMS 2FA code, log into your account, change the password and 2FA settings, and withdraw your crypto to addresses they control. The entire attack takes 2-6 hours — usually while you sleep.
Regulatory structure: Crypto.com operates through multiple entities: Foris DAX Asia (Singapore, MAS-regulated), Foris DAX US (FinCEN MSB), Foris DAX AU (AUSTRAC). Response times: 5-14 business days. The MAS (Singapore) regulation provides a formal complaint channel — similar to CFPB for Coinbase.
Freeze capability: Crypto.com can freeze the scammer receiving account and the Visa card. Requires a police report or court order. Response: 5-14 business days. We file through the specific entity (Singapore, US, or Australia) based on the client jurisdiction.
KYC disclosure: Crypto.com discloses account holder information to law enforcement or through a court order. Crypto.com KYC includes: government ID, selfie verification, proof of address, and (for Visa card holders) a credit check. If the scammer has a Visa card, their credit information is also available.
The Visa card spending trace: If the scammer spent funds through the Crypto.com Visa card, the transaction records show: merchant names, locations, amounts, and timestamps. We obtain these through the legal request. If the scammer bought physical goods (electronics, luxury items), they may be recoverable from the merchant. The Visa fiat trail is a unique recovery path — not available on any other crypto platform.
A client woke up at 7 AM to find their phone had no service since 1 AM. When they restored service, they found their Crypto.com account had been accessed — the scammer had SIM-swapped their Singtel number, intercepted Crypto.com SMS 2FA, and logged in. The scammer found €40,000 in the account. They withdrew €25,000 in USDC to an external wallet and spent €15,000 through the Crypto.com Visa card at electronics stores, luxury boutiques, and online retailers over 5 hours.
Our response: We traced the withdrawal transactions on-chain, identified the destination addresses, and filed freeze requests with the receiving exchanges. We also filed a police report and coordinated with the mobile carrier's fraud department.
Outcome: 50% recovery (€20,000 of €40,000). Crypto.com (Singapore entity) froze the account in 6 business days — it held €0 (scammer had withdrawn/spent everything). We traced: €25,000 in USDC went to a Crypto.com account (frozen). The €15,000 in Visa spending was traced through Crypto.com fiat records — €8,000 was spent at a Singapore electronics retailer (goods recovered, still in packaging). €7,000 was spent online (unrecoverable — digital goods and gift cards). Recovery: €12,000 from frozen Crypto.com account + €8,000 in recovered goods = €20,000. The mobile carrier (Singtel) was found liable. The scammer KYC revealed a resident of Indonesia.
Details anonymized to protect client confidentiality. Swiss professional secrecy applies.
How does a SIM swap differ from phishing? In a SIM swap, the attacker takes over your phone number — you don't click any link. In phishing, the attacker tricks you into entering credentials on a fake site. See phishing on Crypto.com →
Warning: After a SIM swap, fake "recovery services" may contact you. Read our recovery scam warning.
Three differences: (1) Crypto.com issues a Visa card — the scammer can spend funds directly without withdrawing to a bank. (2) Crypto.com is MAS-regulated (Singapore) — we can file a MAS complaint for regulatory pressure. (3) The Visa card creates a fiat trail (merchant names, locations) that is unique to Crypto.com cases. Recovery rates are 40-60%, moderate among major exchanges.
Crypto.com issues a Visa card linked to crypto balances. The scammer can spend your funds directly at any Visa-accepting merchant — buying electronics, luxury goods, or gift cards. This is faster than withdrawing to a bank account. However, the Visa transaction records create a traceable fiat trail — we obtain these through the legal request and identify the merchants. If the scammer bought physical goods, they may be recoverable from the merchant.
No — the Crypto.com Visa card has daily spending limits (typically €5,000-€10,000 depending on tier). The scammer can spend up to the daily limit through the Visa card and withdraw the rest as crypto. We trace both paths: crypto withdrawals on-chain and Visa spending through Crypto.com fiat records. The combination gives us a complete picture of where the funds went.
Yes. Crypto.com Singapore entity is regulated by MAS. MAS has a formal complaint process for regulated entities. We file MAS complaints in parallel with legal freeze requests when Crypto.com compliance team is slow. This creates regulatory pressure — Crypto.com must respond to MAS. Similar to CFPB for Coinbase, the MAS complaint is a regulatory lever unique to Crypto.com.
5-14 business days. Crypto.com compliance team (Singapore, US, or Australia entity) processes legal requests. We file through the specific entity and escalate through MAS (Singapore), FinCEN/CFPB (US), or AUSTRAC (Australia) if needed. For Crypto.com SIM swap cases, early filing is critical — especially if the scammer has a Visa card and is actively spending.
Switch from SMS 2FA to the Crypto.com Authenticator app. Contact your mobile carrier and request a port-out PIN. Use a separate email for your Crypto.com account. Lower your Visa card daily spending limit to reduce potential losses. Enable withdrawal address whitelisting. These measures make SIM swap attacks much harder — even if the scammer gets your phone number, they cannot access your funds without the Authenticator code.
Describe what happened. Include your mobile carrier, when you lost service, Crypto.com withdrawal transaction hashes, and total amount lost. We respond within 6 hours.