SIM Swap Attacks: How to Protect Your Phone Number

Your phone number may be the key to your email, bank, social media, and password recovery. In a SIM swap attack, a criminal convinces a mobile carrier to move that number to a SIM or eSIM they control. Your physical phone can remain in your hand while calls and texts suddenly go to the attacker.

Once the number is transferred, the criminal may intercept text-message verification codes, reset passwords, impersonate you, or attempt to drain financial and cryptocurrency accounts.

Emergency warning: If your phone unexpectedly loses cellular service and Wi-Fi still works, contact your carrier immediately from another phone. Do not wait for service to return on its own.

What Is a SIM Swap?

A SIM card or eSIM tells a mobile network which subscriber should receive calls, messages, and data service. Legitimate customers move their number when they replace a phone, activate an eSIM, or change carriers.

In a fraudulent SIM swap, an attacker impersonates the customer and persuades the carrier to activate the victim’s number on another device. A related attack called port-out fraud transfers the number to a different carrier.

The U.S. Federal Trade Commission explains that scammers may use the hijacked number to receive calls and texts, access accounts that rely on SMS verification, or open new mobile accounts in the victim’s name.

How Criminals Prepare a SIM Swap

Attackers rarely begin with the carrier. They first collect enough information to impersonate the victim. Sources may include:

• Data breaches containing names, email addresses, phone numbers, dates of birth, or account details
• Public social-media profiles
• People-search and data broker websites
• Phishing calls, texts, and emails
• Stolen mail or documents
• Malware that captures passwords
• Insider access or social engineering against carrier staff

The attacker may know your mobile provider, address, recent bill amount, security answers, or partial payment details. With that information, they request a replacement SIM, eSIM activation, or number transfer.

Warning Signs of a SIM Swap

• Your phone suddenly shows No Service, SOS only, or cannot make calls and send texts
• You receive a carrier notice about a SIM, eSIM, device, or number-port request you did not make
• Your carrier account password or PIN stops working
• You receive unexpected password-reset or two-factor authentication messages
• Your email, bank, social, or cryptocurrency account locks you out
• Friends receive messages from your number that you did not send
• Financial transactions or mobile account purchases appear without authorization

Temporary network outages happen, but a service loss combined with security alerts or account changes should be treated as an emergency.

12 Ways to Prevent a SIM Swap Attack

1. Add a strong carrier account PIN

Ask your provider for a dedicated account PIN or passcode that must be supplied before changes are made. Do not use your birthday, address number, or the last digits of your phone number.

2. Turn on a number lock or port-out lock

Many U.S. and European carriers offer a transfer lock, number lock, or extra verification for porting. Names differ, so search the provider’s security settings or contact support. Confirm what steps are required to remove the lock.

3. Protect the carrier account email

Your carrier may send password resets and transfer notices to email. Secure that email with a unique password and a passkey, authenticator app, or hardware security key.

4. Stop using SMS for high-value accounts

Text-message codes are better than no second factor, but they depend on control of the phone number. For email, banking, investments, cryptocurrency, cloud storage, and password managers, choose a passkey, security key, or authenticator app whenever available.

Our two-factor authentication guide explains the differences.

5. Create passkeys for critical accounts

A passkey is tied to the legitimate website and unlocked by your device. It does not rely on a text code and is resistant to phishing. Start with your primary email because it controls password recovery for many other services.

6. Use unique passwords everywhere

If your carrier password was reused on a breached site, an attacker may not need social engineering. Generate and store unique credentials in a trusted password manager.

7. Remove public personal information

Hide your full date of birth, home address, personal phone number, and security answers from public profiles. Search your name and number to identify exposed people-search listings, then submit opt-out requests.

8. Replace knowledge-based security answers

Answers such as a mother’s maiden name, first school, or pet name may be found online. If a service still requires security questions, use random answers stored in your password manager.

9. Enable account and transaction alerts

Turn on notifications for SIM changes, number-port requests, password resets, new devices, bank transfers, card purchases, and cryptocurrency withdrawals. Use email or app notifications in addition to SMS.

10. Separate public and recovery phone numbers

Where practical, do not use the number displayed on websites, advertisements, or social profiles as the only recovery number for sensitive accounts. A private recovery number should still be protected at the carrier.

11. Ask financial services for stronger controls

Some banks and exchanges offer withdrawal allowlists, security keys, transfer delays, or verbal passwords. High-risk users should ask what happens if their mobile number is compromised.

12. Prepare a printed emergency list

Keep carrier fraud support, bank fraud numbers, and account recovery addresses in a secure offline location. If your phone is taken over, you may not be able to read codes or search contacts normally.

What to Do During a SIM Swap Attack

Step 1: Contact the mobile carrier immediately

Call from another phone or visit a carrier store with identification. State clearly that you are reporting an unauthorized SIM swap or number port. Ask the carrier to:

• Freeze further account changes
• Return the number to your SIM or eSIM
• Invalidate the attacker’s SIM
• Reset the account password and PIN
• Add a number or port lock
• Provide a case number and written confirmation

Step 2: Secure your primary email

From a clean, trusted device, change the email password or use the provider’s recovery process. Sign out unknown sessions, remove unfamiliar recovery methods, and inspect forwarding rules, filters, delegates, connected apps, and sent mail.

Step 3: Protect financial and cryptocurrency accounts

Call banks, card issuers, payment apps, investment platforms, and exchanges. Freeze transfers and withdrawals, revoke unknown devices, replace exposed credentials, and document unauthorized activity.

Step 4: Reset other accounts in risk order

Prioritize:

1. Email and password manager
2. Banking, payments, investments, and cryptocurrency
3. Cloud storage and identity documents
4. Mobile carrier and utilities
5. Social media and messaging
6. Shopping and travel accounts with saved cards

Step 5: Preserve evidence and report the crime

Save carrier messages, account alerts, timestamps, transaction records, screenshots, and support case numbers. In the United States, create a recovery plan at IdentityTheft.gov and report internet-enabled fraud at IC3.gov. European victims should report to local police or the relevant national cybercrime authority and notify financial providers immediately.

Step 6: Check credit and identity records

U.S. victims should review reports from the three national credit bureaus and consider a credit freeze. In Europe, monitoring options vary by country; check bank records, national credit registers where available, and official identity or tax portals for suspicious activity.

Does the FCC Require Better SIM Swap Protection?

The U.S. Federal Communications Commission adopted rules requiring wireless providers to use secure authentication methods before redirecting a number and to notify customers about SIM change or port-out requests. These protections help, but they do not replace account PINs, number locks, and stronger authentication on your important services.

Carrier procedures and features vary across the United States, European Union, United Kingdom, and individual providers. Review your own carrier’s current security options rather than assuming a default lock is enabled.

SIM Swap vs. Phone Hacking

A SIM swap usually targets the mobile account and phone number, not the operating system of the physical phone. The device may be malware-free while the attacker receives your calls and texts elsewhere.

By contrast, phone hacking may involve a malicious app, stolen unlock code, spyware, or an operating-system vulnerability. Review our guide to the signs your phone has been hacked if you also notice unknown apps, overheating, data use, pop-ups, or changed settings.

SIM Swap FAQ

Can eSIM prevent SIM swapping?

No. eSIM prevents someone from physically removing your card, but a criminal may still manipulate an account or activation process. Protect the carrier account itself.

Is SMS two-factor authentication useless?

No. It is better than password-only protection, but it is weaker than passkeys, authenticator apps, and hardware security keys for accounts targeted by SIM swapping or phishing.

Will a carrier PIN stop every attack?

It reduces risk but cannot guarantee protection against insider abuse, poor procedures, or stolen account access. Use layered defenses.

How fast should I act?

Immediately. Attackers may begin resetting email and financial accounts within minutes of gaining the number.

The Bottom Line

Your phone number should not be the only key to your digital life. Lock the carrier account, enable port protection, move important services away from SMS verification, and secure your primary email with phishing-resistant authentication.

A few preventive changes can turn a sudden loss of cellular service from a financial disaster into a contained carrier problem.