Fake mobile carrier SIM swap / account takeover phishing — non-carrier sender impersonates AT&T, Verizon, or T-Mobile claiming an unauthorized SIM swap or port-out is in progress and demands account PIN or Social Security Number to "cancel" the transfer
fake-mobile-carrier-sim-swap-account-takeover-phish
What this tier means
High-confidence threat indicator — phishing, impersonation, BEC, or scam pattern. Strong contributor to the trash decision.
How Gorganizer detects this
Phishing emails impersonating AT&T, Verizon, T-Mobile, or a generic "mobile carrier" and falsely claiming that a SIM swap or port-out request has been initiated on the victim's account. The email creates urgency — "cancel within 24 hours or your number will be permanently transferred" — and directs the victim to verify their account PIN, provide Social Security Number digits, or call a callback number. The real goal is to harvest credentials so the attacker can complete the actual SIM swap and seize 2FA-protected accounts (email, bank, crypto). Key facts: (1) SIM swap fraud surged 400% from 2021–2024 per FCC, with losses exceeding $68M; (2) Real carriers AT&T, Verizon, and T-Mobile NEVER request account PINs or SSNs via email links — all legitimate account actions happen through the My AT&T / My Verizon / T-Life apps or verified carrier websites; (3) Legitimate carrier emails are sent from @att.com, @verizonwireless.com, or @t-mobile.com — lookalike domains (att-account-alerts.com, verizon-security-center.net) are always fraudulent; (4) If you receive a real port-out warning, call the number on the back of your SIM card — not any number in the email. Warning signs: non-carrier sender domain, request for PIN or SSN, urgency window, click-to-cancel link.
False-positive guard
Every signal in Gorganizer feeds a multi-module score — never a sole verdict. This is a threat-tier signal — it adds a strong contribution to the trash score. The full pipeline still requires convergence across multiple modules + a margin over the safety floor before deletion happens, and Gmail's trash (30-day recovery) is always used — never permanent delete.
About the scoring engine
Gorganizer's scoring engine emits 2,143+ signals across six modules — headers, sender, subject, body, attachments, and structural metadata. Every email is scored by every module independently; the final verdict requires multiple modules to agree and the trash score to beat the safety floor by a margin.
Sacred safety guards — never delete starred emails, replies, calendar invites, receipts/invoices, or attachments — apply unconditionally regardless of any signal.
Ready to clean your inbox?
Gorganizer scans your Gmail with this signal and 2,143+ others, then cleans everything in one click. $4.99 one-time, no subscription.
Get started