Detecting a fraudulent subscriber identity module (SIM) swap may be performed by a mobile app executing on a mobile computing device. A network connectivity state is determined for the mobile computing device to a mobile telephony network provided by a mobile network operator. The mobile computing device is associated with a SIM which is associated with the mobile network operator. A signal strength is determined at the mobile computing device of the mobile telephony network provided by the mobile network operator. A likelihood is determined that a SIM swap has taken place involving the SIM based on the signal strength and the network connectivity state. In some embodiments, a probe request is transmitted to a remote server, requesting that the remote server programmatically call the telephone number associated with the SIM to confirm whether the SIM swap has taken place.