SIM-swap filings up 402% at Cifas: the recovery path is now the attack surface

Cifas recorded more than 220,000 filings to the UK National Fraud Database between January and June, the highest first-half total it has ever logged ^[1]. The composition matters more than the headline: identity fraud at nearly 130,000 cases and account takeover at nearly 40,000 together make up roughly 77% of the total ^[2][7][18], which puts the pressure on identity proofing and recovery flows rather than on payment controls.

The sharpest single movement is unauthorised SIM-swap, which Cifas says rose 402% year on year to 4,109 incidents ^[9]. Working backwards from that rate implies a base of roughly 820 cases in the same period last year ^[17]. Cifas describes SIM-swap as now representing 10% of all filings, up from 2% ^[19]; on the published totals that share can only be of takeover filings, since 4,109 is about 10% of nearly 40,000 account takeover cases but under 2% of the 220,000 overall ^[20]. The narrower reading is the more useful one anyway. On rounded figures, SIM-swap growth of about 3,300 cases exceeds the roughly 1,900-case growth in account takeover as a whole ^[16], so a category that was a rounding error a year ago is now the thing moving the line.

That reframes where the weak link sits. A swapped SIM is not the payday; it is a step into whatever downstream system treats control of a phone number as proof of identity. The number is issued, and reissued, by a carrier, on the strength of a retail process that the bank, retailer or IAM team relying on it does not run, cannot audit in real time and does not get told about when it changes. Cifas reports account takeover rising fastest in online retail (+84%) and card accounts (+59%) ^[8], both of which lean on SMS and phone-based recovery in practice.

The identity fraud numbers point the same way. Cases involving bank accounts and plastic cards accounted for 68% of identity fraud filings ^[3], and impersonation attempts using the victim's genuine address rose 12% ^[4]. Wholly "false identity" filings fell 35%, mainly in banking and telecoms ^[5], while Cifas says intelligence points to growing concerns about synthetic identities, AI-enabled impersonation and digitally manipulated documentation ^[6]. Fabricated people are being replaced by real people whose details are accurate. Address matching and document checks degrade accordingly.

There is a supply-side signal too. Money muling filings rose 69% to more than 13,000 and now account for 30% of all misuse-of-facility cases ^[12], though Cifas attributes part of that to better detection and a new filing reason introduced in 2025 ^[13]. Under-30s were 57% of muling cases, with 17% under 21 ^[11]. Most identity fraud victims were 61 or over, but the largest increase, 32%, was among 21-to-30-year-olds ^[10]. Cifas chief executive Mike Haley said identity fraud now accounts for three-fifths of database cases, and that stolen personal data "often provides the entry point" ^[14][15].

What to watch: whether SIM-swap holds its new share in the full-year figures or proves to be a detection artefact, as Cifas concedes some of the muling rise is ^[13]; whether the false identity decline continues while synthetic identity concerns grow ^[5][6]; and whether any UK bank or retailer moves number-based recovery out of the assurance path rather than adding another check on top of it.