An attacker gathers personal details about you — often through earlier data breaches, phishing, or social engineering — then contacts your mobile carrier impersonating you, claiming your phone was lost or stolen, and requests your number be transferred to a new SIM card they control.
Once the swap succeeds, your real phone loses service entirely, and the attacker's device starts receiving your calls and texts — including any SMS-based two-factor authentication codes for your email, exchange accounts, or wallet apps.
With those codes, the attacker resets passwords and takes over linked accounts one by one, often moving quickly to drain exchange balances or wallets before the victim even realises their phone has stopped working.