SIM Swap Attacks: How Thieves Steal Your Number and How to Stop Them

What Is a SIM Swap Attack?

Your phone number feels like something only you control. A SIM swap attack breaks that assumption.

In a SIM swap, a scammer contacts your mobile carrier and pretends to be you—claiming a lost phone or a damaged SIM—and convinces the carrier to transfer your number to a SIM card in their hands. From that moment, calls and texts meant for you go to them. Your phone shows no signal bars while the thief's phone comes alive with your calls, messages, and verification codes.

Attackers usually pull this off through social engineering: piecing together your personal details from data breaches and social media to pass the carrier's identity checks. A birthdate from one breach, an address from another, and the last four digits of a card from a phishing email can be enough to sound convincing. In some cases, they get help from a corrupt employee inside the carrier, which is why even careful people get hit.

The prize is your number as a master key. With it, attackers can intercept SMS-based 2FA codes, request password resets that arrive by text, and read banking alerts—unlocking accounts that your password alone was supposed to protect. Email password resets often follow, chaining one compromise into many.

Why Attackers Want Your Phone Number

Your phone number is more than a way to call friends. Many services still use it as a security tool: banks, email providers, social networks, and crypto exchanges send SMS codes as a second factor or use your number to verify account recovery requests.

That makes your number a master key. If an attacker controls it, they can intercept those codes and log in as you. A hijacked number has been used to break into email inboxes, drain cryptocurrency exchange accounts, and take over social media profiles — often in a single evening.

The danger compounds because your email is the recovery path for almost everything else. Lose the inbox, and password resets for dozens of other accounts follow.

It also works in reverse: your number is often the recovery path for your email account. An attacker who ports your number can request a reset on your email first, then use that inbox to reset banking, social, and exchange accounts one by one — a domino chain that starts with a single phone call to your carrier.

Attackers also profit from reuse. People rarely change numbers, so a number leaked in an old breach still points to you years later.

In short: your number acts as a recovery key for your entire digital life, which is exactly why thieves target it.

How a SIM Swap Typically Unfolds

A SIM swap starts long before the thief calls your carrier. Attackers first collect personal details about you from data breaches, phishing messages, or information you share publicly on social media — your birth date, address, and the last digits of accounts you use. This is why those "harmless" details matter: carriers often accept them as proof of identity, so every piece you expose makes the impersonation easier.

Armed with these details, they contact your mobile carrier, often by phone or in a store, and pretend to be you. A common story is a lost, stolen, or broken phone that needs a new SIM card right away. Urgency is deliberate — a flustered employee handling an "emergency" is less likely to pause and verify carefully.

If the carrier's checks are weak, staff activate a new SIM in the attacker's device and transfer your number to it. Your phone suddenly loses signal — no calls, no texts. Because your number now lives on their SIM, every SMS code meant for you arrives on their phone instead. The attacker then moves quickly, resetting passwords on email and banking accounts before you notice. Some carriers send a confirmation text to the old SIM; it arrives too late to help, since the number has already moved.

Warning Signs Your Number Has Been Ported

A SIM swap usually announces itself through your phone behaving strangely.

• Sudden loss of signal with full bars elsewhere. Your phone shows "No Service" while people around you on the same carrier have coverage, and your carrier confirms no outage in your area. A common mistake: assuming it's a dead zone and waiting hours. If you're stationary in a place that normally has coverage, treat it as suspicious.
• Calls and texts fail. Outgoing calls drop immediately, texts won't send, and a reboot produces "No SIM" or "SIM not provisioned" errors. Edge case: after a legitimate replacement SIM activation, similar errors appear briefly — but that only happens when you changed the SIM. If you didn't touch it, it isn't you.
• Unexpected account alerts. Password reset emails or "new login" notifications arrive for accounts you didn't touch — someone may already be using your number to receive verification codes. These alerts sometimes lag behind the actual port by minutes or hours, so treat them as a late signal, not an early one.

Any one of these deserves attention. Signal loss combined with account alerts means act immediately: your number may have moved to a thief's SIM, and every SMS-based code is now landing in their hands. Check your phone against a second device on the same carrier if possible — it separates a local outage from a genuine port.

Set Up a Carrier PIN and Port-Out Protection

Your mobile account is the front door to your phone number, so lock it.

• Add a carrier PIN or passcode. Most carriers let you set a numeric PIN or verbal passcode required before anyone can make account changes, order a new SIM, or call support. Without it, a thief only needs your publicly known details—name, address, birthday—to impersonate you. Avoid obvious choices: no birthdays, anniversaries, or the last four digits of your own phone number, since attackers already have those. Pick something unlinked to your life and never reuse a banking or email password.
• Enable port-out protection. This blocks your number from being transferred to another carrier unless you approve it, typically in person with photo ID or through a verified request. It directly defeats the transfer step of a SIM swap.
• Find the settings yourself. Names vary by provider: look for "account PIN," "port-out freeze," or "number lock" in your carrier's app or website security section. If you cannot find them, call support and ask for both features. Never rely on a link or caller who contacts you first; go to the carrier's official app or the phone number printed on your bill.
• Write the PIN down securely. A PIN you forget is a PIN you cannot use when you actually need to freeze your account. Store it in a password manager or a safe place at home—just not in your phone's notes app next to your carrier login.

If you bank by SMS codes, consider a cheap second line used only for banking 2FA. It keeps your main number's exposure away from your most valuable accounts.

Reduce Your Reliance on SMS Codes

Text messages are the weakest common form of 2FA because the code travels through your carrier—the very channel a SIM swap attack compromises. Stronger options keep the code on your device or eliminate codes entirely.

Authenticator Apps

Apps like Google Authenticator, Microsoft Authenticator, or Authy generate codes locally on your phone. Nothing arrives over the network, so a swapped SIM reveals nothing. Enable these in each account's security settings and save any backup codes offline—printed or in a password manager, never in your SMS inbox. A common mistake: enabling an app on one account (say, email) but leaving SMS on everything else, which lets an attacker pivot from a weaker account into the stronger one. Also check that the app itself is locked behind a device PIN or biometric, so a stolen phone doesn't hand over your codes.

Hardware Security Keys

For email, banking, and other critical accounts, a physical security key (such as one supporting FIDO2) is the strongest option. The key verifies the legitimate website directly, so phishing sites fail automatically. Buy two: one for daily use, one backup stored safely. Register both with each service up front—losing your only key means a slow identity-recovery process, and some services offer none.

Passkeys and App Approvals

Where a service offers passkeys or in-app login approval, choose them over SMS. Passkeys are tied to your device and cannot be intercepted through your carrier at all. Watch the approval prompts carefully: attackers sometimes spam push requests hoping you tap "Approve" to silence the noise. Always deny and change your password if prompts arrive when you are not logging in.

General Habits That Shrink Your Attack Surface

A SIM swap usually starts with information, not technology. Attackers piece together details from social media, data breaches, and public records, then use them to convince your carrier they are you.

• Share less online. Skip posting your birthday, pet names, first school, or hometown. These are common security-question answers. Old posts can be as revealing as new ones. That anniversary photo from 2014 names your partner; a decade-old quiz result lists your first car. Attackers read archives, not just your feed.
• Use long, unique passwords. A password manager generates and remembers them for you, so one leaked password never unlocks several accounts. Common mistake: reusing a strong password everywhere. Length beats complexity—a four random-word passphrase outlasts a short symbol-stuffed one.
• Audit your recovery options. Check the security settings of your important accounts. Remove your phone number where it is not required, and prefer an authenticator app or passkey as your second factor. Fewer places that can reset a login by SMS means fewer doors a ported SIM can open. Edge case: some banks still require SMS—leave those numbers, but check whether an app-based option exists.
• Answer security questions with fiction. Store invented answers in your password manager; your real mother's maiden name is often public record.

Small habits, applied consistently, remove the raw material attackers rely on.

What to Do If You Are Hit

Act fast — every hour counts.

1. Call your carrier immediately. Use another phone or visit a store in person with ID. Ask them to deactivate the fraudulent SIM, restore your number to your device, and add or strengthen a carrier PIN and port-out protection on the spot. Get a reference number for the fraud report; you will need it later. If the store route is an option, take it — in-person ID checks are harder for an attacker to undo remotely.

2. Secure your accounts, starting with email. Your inbox is the master key to everything else. Change that password first, then banking, social media, and any account tied to the number. Where possible, revoke active sessions and sign out all devices, and update recovery phone numbers an attacker may have added. Check your email's forwarding rules and filters — a common trick is a rule that silently deletes password-reset messages. Do this from a device the attacker has never touched, ideally with a different network than your home Wi-Fi.

3. Report it. File a fraud report with your carrier, then with your national consumer-protection or cybercrime authority. This creates a paper trail if attackers opened accounts in your name. Also scan bank and card statements for charges you did not make, and dispute them in writing.

A SIM swap is disruptive but survivable. Carrier locks plus authenticator apps instead of SMS make you a far harder target next time.