Your phone went silent. Your bank texted to confirm a transfer you did not make. Your email started rejecting your password. Within hours, the wallets were drained, the brokerage account was liquidated, and the email that anchored every other account in your life was being used by someone in another time zone. By the time you got the line back from the carrier, the damage was already cascading. This is the moment we step in.
Quinnlan Varcoe, Founder and CEO, oversees every SIM swap scam investigation and reviews every case before findings leave the practice. Jose Santana, Lead Technical Consultant, oversees the practitioner team executing the technical work. Engagements are confidential, NDA-protected, and structured to begin within 24 to 48 hours of the consultation because the cleanup window for cascading account compromise is short. Pricing is hourly at $550 per hour with a $5,500 starter retainer; a typical case runs 12 to 25 hours for a total range of $6,600 to $13,750. Optional fixed-fee tracks for well-bounded scope and sliding-scale pricing for individuals who lost retirement or operating funds are available on the first call.
What this is
A forensic SIM swap attack recovery engagement produces the documented evidentiary record that the FBI Internet Crime Complaint Center, the FBI Cyber Division and Secret Service Electronic Crimes Task Force, the Federal Communications Commission, your state public utilities commission, your wireless carrier's executive escalation channel, your cyber and crime insurance carrier, civil counsel pursuing the carrier under FCC Section 222 / 47 U.S.C. 222 and state-law negligence theories, and where applicable, plaintiff trial counsel and licensed crypto asset-recovery partners can act on. The investigation traces how the swap was authorized (in-store insider, call-center social engineering, online portal compromise, stolen carrier credentials), reconstructs the cascading account-takeover timeline across email, banking, brokerage, crypto exchanges, and corporate accounts, identifies any persistent criminal access, and produces the carrier-grievance and civil-action package that the institutions with subpoena power and recovery authority use to act on your case.
Who this is for
- Cryptocurrency holders whose hot wallet, exchange account, or seed-phrase storage was compromised in the cascading account-takeover that followed a SIM swap.
- Executives and senior employees whose carrier-side compromise unlocked corporate single-sign-on, email, and access to sensitive workplace systems, frequently triggering a parallel corporate cybersecurity incident.
- High-net-worth individuals and family-office principals whose phone number is the recovery factor on a substantial concentration of financial accounts and who lost meaningful sums in the cascading compromise.
- MFA-protected high-value account holders who believed SMS-based two-factor authentication was sufficient and discovered the limits of that assumption in the worst possible way.
- Anyone who lost access to email, banking, or workplace accounts after a sudden phone outage and needs a forensic investigator to determine the scope of the compromise and produce the case file for recovery.
How the engagement works
- Free confidential consultation by phone or video. NDA-protected. 30 to 60 minutes. Direct conversation with Quinn, the founder and CEO who oversees every engagement. We hear the timeline, identify the immediate triage actions (port-freeze, account-recovery sequence, evidence preservation), and tell you whether forensic investigation will materially help or whether the situation can be resolved by going straight to the carrier and your bank.
- Scoped engagement with a written proposal and pricing. $5,500 starter retainer covers intake, immediate identity-hardening triage, and the first round of account-takeover and carrier-side evidence preservation. Hourly with milestone caps for the full investigation; fixed-fee where scope is well-bounded.
- Forensic acquisition of relevant artifacts. Wireless carrier account history (CPNI request, port-history, account-change logs), email account login and device-fingerprint history, banking and brokerage account exports, cryptocurrency exchange account exports and transaction history, hardware security key and authenticator-app provisioning logs, and where applicable, corporate single-sign-on access logs (with employer authorization).
- Investigation and reconstruction. Source of the SIM swap (in-store insider, call-center social engineering, online portal compromise, stolen carrier credentials), full cascading account-takeover timeline mapped against the swap window, identification of any persistent criminal access (residual mail rules, OAuth tokens, recovery-factor pollution), and where crypto was stolen, off-ramp jurisdiction and exchange identification for coordination with licensed asset-recovery partners.
- Identity hardening. Migration off SMS-based authentication for every account that supports it, hardware security key deployment, recovery-factor rotation to clean accounts the criminal does not know about, carrier-side port-freeze and porting PIN configuration, eSIM transition where supported, data-broker scrub to reduce the public attack surface that enables the next swap.
- Written report to court-admissible standards, structured for the specific pathways that apply: FBI IC3 and Cyber Division referral, FCC and state PUC formal carrier complaints, civil action against the wireless carrier under FCC Section 222 / 47 U.S.C. 222 and state-law negligence theories, cyber insurance claim, and where crypto was stolen, evidence-package coordination with licensed asset-recovery partners.
- Coordination with the wireless carrier's executive escalation channel, FBI Cyber Division, Secret Service Electronic Crimes Task Force, FCC and state PUC, your insurance carrier, civil counsel, and where applicable, licensed asset-recovery partners.
What we will not do
- Recover crypto directly. Asset recovery is the domain of licensed counsel and law-enforcement seizure pursuit, not us. We coordinate the introduction and provide the forensic evidence package.
- Promise we will get your money back. We produce the case file that makes recovery materially harder for institutions to dismiss; recovery itself is controlled by your bank, the carrier, your insurance carrier, civil counsel, and law enforcement.
- Take fees contingent on recovery. That structure is reserved for licensed asset-recovery counsel and we are not that.
- Run a single automated scan and email a one-line result.
- Bill for work that was not scoped or approved in writing.
SIM swap protection is structural, not behavioral
The hardest lesson from a SIM swap is that the protections most people have are inadequate against a determined attacker. SMS-based two-factor authentication is not a meaningful defense against a criminal who can take over the phone number itself. Carrier-side port-freezes and porting PINs are useful but defeated by insiders. The defense that works is structural: every high-value account moved off SMS to a hardware security key or app-based authenticator, recovery factors rotated to clean accounts that no public profile or data broker connects to your name, the carrier account locked down to in-store-only authentication, and the public attack surface (data brokers, social media, professional profiles) reduced to make the next swap operationally harder. We deliver this hardening as the second deliverable of every SIM swap recovery engagement, after the timeline reconstruction. It is the work that prevents the second swap.
Related Witness services
- Crypto scam recovery: when the SIM swap was followed by crypto theft and asset-recovery coordination is needed.
- Account compromise recovery: for the cascading email, banking, and brokerage takeovers that follow a SIM swap.
- Wire fraud recovery: when the SIM swap was used to authorize a fraudulent wire after MFA was bypassed.
- Identity theft investigation: when the SIM swap was preceded or accompanied by synthetic identity or new-credit-line fraud.
- Privacy and exposure services: for the data-broker scrub and public-attack-surface reduction that prevents the next swap.
- Digital forensics for attorneys: for civil-suit and expert-witness support against the wireless carrier.
- Digital forensics in Naples, FL: local forensic engagement.
