SIM Swap Attacks: How to Protect Your Phone Number

Last updated: October 13, 2026

Your phone number has quietly become a master key. Banks, email providers and social networks send verification codes to it, and many "forgot password" flows end with a text message. If a criminal takes control of your number, those messages go to them instead of you. That is the idea behind a SIM swap, and it is one of the few attacks that can defeat an account protected by a password and SMS codes at the same time.

This guide explains how SIM swap and port-out fraud work, what US regulators now require from carriers, how to spot an attack in the first minutes, exactly what to do if it happens, and how to make your number a much harder target. It is based on guidance from the Federal Communications Commission (FCC), the FBI's Internet Crime Complaint Center (IC3) and the Federal Trade Commission (FTC).

What Is a SIM Swap?

A SIM card, or the eSIM profile built into newer phones, links your handset to your phone number. In a SIM swap, a scammer gets your number activated on a SIM or device they control. From that moment, calls and texts meant for you, including one-time codes, go to them.

The FCC describes two closely related tricks:

• SIM swapping: the scammer convinces your wireless carrier to move your number to a new SIM card or device that they hold.
• Port-out fraud: the scammer has your number transferred to a different carrier, using the same process a real customer uses to switch companies.

In both cases the attacker usually poses as you. The FCC notes that scammers collect personal details, often from data breaches, social media or phishing, and use them to pass the carrier's identity checks. The FBI has also warned that criminals sometimes bribe or trick carrier employees into making the change.

How Big Is the Problem?

In a February 2022 public service announcement, the FBI said IC3 received 320 SIM swapping complaints from January 2018 to December 2020, with adjusted losses of about $12 million. In 2021 alone, it received 1,611 SIM swapping complaints with adjusted losses of more than $68 million. Those figures only count people who reported to the FBI, so the real number of victims is likely higher. The FBI said criminals were using the stolen numbers mainly to empty bank and cryptocurrency accounts.

Why Attackers Want Your Number

Your number matters because many services still treat it as proof that you are you. With control of it, a scammer can try to:

• request password resets that send a code by text or voice call;
• receive two-factor authentication codes sent by SMS;
• take over email, social media, messaging, banking or crypto accounts;
• re-register messaging apps such as WhatsApp on their own phone;
• message your contacts as you and ask them for money.

Many attacks also need a username or password, which is why a strong, unique password on every account still matters. A SIM swap is most damaging when your phone number is the only thing standing between an attacker and your account, for example when an account can be reset by SMS alone. Our guide to creating a strong password you can remember covers the first layer.

What US Rules Now Require From Carriers

Most consumer guides skip this part, but it changes what you can ask for. On November 15, 2023, the FCC adopted rules aimed directly at SIM swap and port-out fraud. According to the FCC's order, published in the Federal Register on December 8, 2023, wireless providers must:

• use secure methods to authenticate a customer before moving a number to a new device or a new carrier;
• immediately notify customers whenever a SIM change or port-out request is made on their account;
• offer customers the option to lock their accounts to block SIM changes and number ports;
• train employees to handle these requests and stop staff from seeing customer account details before the customer is authenticated;
• keep a clear process for customers to report fraud, investigate it promptly and give customers documentation of fraud involving their accounts.

The compliance date for these rules was tied to a federal paperwork review, and the FCC later waived the original July 2024 date until that review was finished. Because carriers have rolled out these protections on different timelines, do not assume your account is locked by default. Ask your carrier directly which lock and notification options are switched on for you.

Warning Signs

The FCC says the first sign is usually a sudden loss of service: your phone shows no signal or "SOS only" when it normally works. Other clues include:

• You cannot make calls or send texts, but people near you have signal on the same network.
• Your carrier sends a message about a SIM change, new device or port-out that you did not request.
• You get verification codes or password-reset emails you did not ask for.
• You are suddenly signed out of accounts, or friends say they got odd messages from you.
• Your banking app shows transfers or new payees you do not recognize.

Loss of signal can have innocent causes such as an outage or a phone fault. Check quickly with Wi-Fi calling or another phone, but if any second sign appears, treat it as an attack and act at once.

What to Do If You Think It Has Happened

Speed matters, because an attacker with your number can reset several accounts within minutes. Work through these steps in order.

1. Contact your carrier immediately. Use another phone, Wi-Fi calling, a store or the carrier's official website. Say you believe your number was swapped or ported without permission, and ask them to restore it to your SIM and lock the account. Ask for a written record of the fraud; the FCC's rules require carriers to provide documentation.
2. Secure your main email account. From a trusted device, change the password, sign out all other sessions and check the recovery phone and email. Whoever controls your email can reset almost everything else. If your Google account is affected, follow our guide to recovering a hacked Gmail or Google account.
3. Call your bank and card issuers. Use the number on the back of your card or inside the official app. Tell them your number may be compromised and ask them to watch for transfers and changes to your contact details.
4. Change passwords and move two-factor authentication off SMS. Update the passwords of your most important accounts and switch their second step to an authenticator app, passkey or security key where possible.
5. Review account settings. Look for changed recovery details, email forwarding rules, new devices, new payees and unfamiliar transactions.
6. Report it. The FCC suggests filing a police report and a complaint with the FCC Consumer Complaint Center. You can also report to the FTC at ReportFraud.ftc.gov and to the FBI at ic3.gov, especially if money was stolen.
7. Protect your credit. If the attacker had enough of your personal information to fool your carrier, consider a fraud alert or credit freeze. Our guide to credit freezes and fraud alerts explains both.
8. Warn your contacts. Tell family and friends to ignore any message from your number that asks for money or codes until you confirm you are back in control.

How to Protect Your Phone Number

1. Add a PIN or passcode to your carrier account

The FCC recommends asking your carrier to add a PIN or password that must be given before any change is made to your account. Make it random, not your birthday or the last digits of your Social Security number, and store it in a password manager. Never share it with anyone who calls you, even if they say they work for your carrier.

2. Turn on SIM lock and port-out protection

Major US carriers offer free features for this. For example, T-Mobile describes SIM Protection and Port Out Protection, Verizon describes Number Lock and SIM Protection, and AT&T describes a Wireless Account Lock in its app. Names change over time, so search your own carrier's help pages for "SIM lock", "port-out protection", "number lock" or "account lock", or ask support. Turn it off only when you are deliberately switching carriers or phones, then turn it back on.

3. Know your real port-out PIN process

When you switch carriers, the new company asks for a number transfer PIN generated by your current carrier. Attackers try to get this PIN by phishing. A real carrier will never text or call asking you to read it out. Only generate one when you are switching yourself.

4. Share less personal information

The FCC advises keeping the details used to verify your identity off social media. Avoid posting your full date of birth, home address, phone number, pet names and similar details publicly, and tighten the privacy settings on old profiles.

5. Turn on account alerts

The FCC also suggests enabling email and text notifications for important accounts. An email about a SIM change or password reset you did not request may be your earliest warning, and email still reaches you when your phone service has been stolen.

6. Treat unexpected calls and texts with suspicion

If someone contacts you asking for personal details, account PINs or one-time codes, hang up and call the company back on a number you find yourself, such as the one on your bill. Our guide to spotting fake text messages shows common tricks.

7. Lock the phone and the SIM

Use a strong screen lock and set a SIM PIN if your phone supports it, so a thief cannot simply move a stolen physical SIM into another handset. Write the SIM's unlock code (PUK) down somewhere safe, because entering the wrong PIN too often locks the SIM.

Comparing Your Protection Options

Protection	What it stops	What it does not stop	Cost and effort
Carrier account PIN	Casual impersonation over the phone or in store	Insider fraud, or a PIN you were tricked into revealing	Free, 5 minutes
SIM lock / port-out lock	Unauthorized SIM changes and transfers while switched on	Phishing of your carrier login if the attacker can turn it off	Free where offered, 5 minutes
Authenticator app codes	Code theft through a stolen number	Real-time phishing pages that capture the code	Free, 10 minutes per account
Passkeys or security keys	Number theft and most phishing	Loss of every device or key without backups	Free (passkeys) or about the price of a key
Removing your number from recovery options	Account resets by SMS	Nothing on its own if no other recovery method is set	Free, but set a backup method first

Move Important Accounts Away From SMS

The single most effective step is to stop relying on text messages for your most valuable accounts. The FTC's SIM swap alert makes the same point: text codes may not protect you from a SIM swap, so use an authentication app or a security key for sensitive accounts. Codes from an app, or a passkey or hardware key, are tied to a device you hold rather than to your phone number.

Our articles on SMS vs app vs security-key two-factor authentication and on passkeys explain the differences in detail. Upgrade accounts in this order:

1. Your main email account.
2. Banking, payment, investment and crypto accounts.
3. Your password manager.
4. Your carrier account itself.
5. Social media and messaging accounts.

SMS codes are still much better than no second step at all. If a service only offers SMS, keep it on and rely on the carrier protections above. Once an account has a stronger method, remove the phone number as a sign-in or recovery option if the service allows it, and save backup codes in a safe place so a lost phone does not lock you out.

Frequently Asked Questions

Can someone SIM swap me with just my phone number?

Usually they need more, such as personal details that let them pass the carrier's checks, or help from an insider. A carrier PIN, a SIM lock and keeping personal details private all raise the bar.

Is an eSIM safer than a physical SIM?

An eSIM cannot be pulled out and stolen, but the account-level tricks described here still work, because the attacker asks the carrier to move the number. Protect the carrier account itself either way.

Will an authenticator app stop a SIM swap?

No. It cannot stop someone from taking your number, but accounts that use an app, passkey or security key no longer send their codes to that number, so the stolen number is far less useful.

How do I know if my number has been ported?

Your phone typically loses service, and under the FCC rules your carrier should notify you about port-out requests. Call your carrier from another phone right away to confirm.

Can I get my money back after a SIM swap?

It depends on the account type and how quickly you report. Contact your bank immediately, report to IC3 and keep the documentation your carrier gives you. Our guide on identity theft recovery steps explains how to report and track each step.

What if my carrier does not offer a lock feature?

Ask for a PIN on the account, request notifications for any SIM or port change, keep your personal details private and use non-SMS sign-in methods for important accounts.

Conclusion

A SIM swap depends on two weaknesses: a carrier that can be persuaded to move your number, and accounts that trust that number on its own. You can fix both. Add a PIN and turn on any SIM or port-out lock your carrier offers, share fewer personal details online, and move your key accounts to an authenticator app, passkey or security key. If your phone suddenly loses service for no clear reason, do not wait: call your carrier, secure your email and contact your bank.

By Safe Sign In Editorial Team