SIM Swap Fraud: How It Works and How to Protect Your Number

Your phone is in your hand, fully charged, and suddenly it shows No Service or SOS only — while everyone around you has full bars. Minutes later, password reset emails start arriving. Nobody touched your phone. They took your number. That is a SIM swap: a criminal convinces or bribes your mobile carrier to move your phone number onto a SIM or eSIM they control, then uses it to receive your text-message login codes.

SIM swaps are dangerous precisely because so much security still relies on SMS. Below you’ll learn how the attack actually happens, the signs that one is underway, the carrier settings that block it, and how to cut your accounts’ dependence on text messages.

How a SIM swap works, step by step

Every mobile number is linked, in your carrier’s systems, to a particular SIM (its ICCID) or eSIM profile. Carriers legitimately move numbers all the time — when you lose a SIM, upgrade to eSIM or switch providers. A SIM swap abuses that process:

1. Reconnaissance. The attacker gathers your name, number, date of birth, address and sometimes the last digits of an ID or bank card — from data breaches, social media, phishing or a fake “delivery” text.
2. The swap. They contact your carrier pretending to be you (“I lost my phone, please activate my new SIM”), use a compromised carrier online account to request an eSIM, or work with a corrupt store employee. A variant, port-out fraud, moves your number to a different carrier entirely.
3. Takeover. Your SIM goes dead. Their device now receives your calls and SMS. They trigger “forgot password” on your email, then on banking, crypto and social accounts, approving each with the codes sent to “your” number.
4. Lockout. They change passwords and recovery options so you can’t get back in quickly.

Note the difference from phone theft: in a SIM swap your handset is untouched, and its IMEI is perfectly clean. The target is the number and everything it unlocks.

Warning signs an attack is happening

• Your phone suddenly loses all mobile service in a place where it normally works, and restarting doesn’t help.
• A text or email from your carrier about a SIM change, eSIM activation, new device, port-out request or account PIN change you didn’t make.
• You can still use Wi-Fi, but calls and texts to your number don’t arrive. Friends say your phone goes straight to an unfamiliar voicemail.
• Unexpected password reset or “new sign-in” emails for email, bank or exchange accounts.
• A call from “your carrier” or “your bank” asking you to read out a code you just received — that code is often the one authorizing the swap.

Lock down your carrier account

The single most effective defense lives at your carrier, not on your phone. Ask for or switch on each of these:

1. An account PIN or passcode

Most carriers let you set a PIN or passcode that must be given before any change to your account in store, by phone or in chat. Make it unique — not your birth year, not the last four digits of your number, and not a PIN you use anywhere else.

2. Port-out protection or a number lock

This blocks your number from being transferred to another carrier until you switch the lock off yourself. Names vary: Verizon offers Number Lock, T-Mobile offers Port Out Protection and SIM Protection, and AT&T has a Wireless Account Lock. Where a carrier requires a separate port-out PIN (sometimes called a Number Transfer PIN), generate it only when you are actually switching providers.

3. SIM change protection

Some carriers can block SIM and eSIM changes unless the request is made in person with ID, or until you disable the block in your secure account. Ask what yours offers.

4. A strong carrier app login

eSIM transfers are increasingly done inside carrier apps and websites. Use a unique password and the strongest sign-in option available for your carrier account — it’s now as important as your email password.

Features and names change, so confirm the current options on your carrier’s official site: Verizon, T-Mobile, AT&T. Outside the US, ask your operator about SIM replacement verification and port-out controls; many require in-person ID or biometric checks for a replacement SIM.

Stop relying on SMS for logins

Even with carrier locks, the best long-term fix is making your number worthless to an attacker. For every important account — email first, then banking, payment apps, crypto exchanges and social media:

After adding a stronger method, remove the phone number as a sign-in method where the service allows it, and check that the number isn’t also the only recovery option. Keep printed backup codes somewhere safe. Our guide to securing your Apple Account and Google Account covers those two in detail.

Explore the codes on your own phone

Knowing your phone’s identifiers helps when you talk to your carrier’s fraud team. Use the interactive terminal below: type help to see what it can do, then type dial and press Enter to list common dialer codes such as *#06# for your IMEI.

When you call your carrier after a suspected swap, have your account PIN, your IMEI and the ICCID printed on your SIM card (or shown in Settings for eSIM) ready. They make it faster to prove which SIM and device are genuinely yours.

If you’ve been SIM-swapped: what to do now

1. Call your carrier’s fraud line from another phone. Ask them to reverse the SIM or port change, lock the account and add a note requiring in-person ID for future changes.
2. Secure your email from a trusted device: change the password, sign out all other sessions, remove unknown recovery numbers and forwarding rules.
3. Call your banks and exchanges. Freeze transfers, report fraud and ask them to switch you off SMS verification.
4. Change passwords on every account that used your number for codes, starting with money-related ones.
5. Report it. File a police report. In the US, report identity theft at IdentityTheft.gov, which gives you a recovery plan and documentation for banks.
6. Keep evidence: carrier messages, timestamps of service loss, and account alerts.

If your handset was physically stolen as well, that’s a separate problem — read how to report a stolen phone and block its IMEI.

Buying a used phone after a SIM swap or theft

Victims often buy a replacement phone in a hurry — exactly when scammers sell blocked or locked devices. Before you pay:

• Run a GSMA blacklist check and, for US devices, the USA blacklist/barred check. A Verizon phone can also be checked with the Verizon clean/lost check.
• Confirm the phone will accept your carrier’s SIM with a carrier + SIM-lock check or a quick SIM-lock status check, especially if you plan to activate an eSIM.
• Read our carrier check guide for what each result means.

Verdict: you can’t stop criminals from knowing your phone number, but you can make it useless to them. A carrier PIN, a port-out lock and moving your key accounts to passkeys or an authenticator app turn a SIM swap from a disaster into an inconvenience.