SIM-swap attacks: how they work and how to protect your number

A SIM swap is an attack in which someone convinces your mobile carrier to move your phone number onto a SIM card they control. From that moment, calls and text messages meant for you go to them, including the verification codes that many services use to protect your accounts. The attack does not require hacking your phone, which is why it surprises victims. This guide explains how SIM swaps and the related number port-out fraud work, how to notice one, and the practical steps that make your own number much harder to take.

What a SIM swap actually is

Your phone number is a record in your carrier's systems that points to the SIM card currently allowed to use it. Carriers need to move that record legitimately all the time, for example when you lose a phone, upgrade, or switch to an eSIM. A SIM swap abuses that process. The attacker contacts the carrier, pretends to be you, and asks for the number to be activated on a new SIM or eSIM they hold. If the request is approved, your own SIM stops working and theirs starts receiving everything.

Why the attacker wants your number

The number is valuable because it is used as a password recovery and login channel. Once they receive your texts, an attacker can request a password reset on your email, social media or financial accounts, and the confirmation code goes to them. Accounts holding cryptocurrency or money are the most attractive targets, but any account that falls back to SMS can be affected. The attacker often needs some details beforehand, such as your name, number and some personal data gathered from data leaks or social media.

How attackers get the carrier to agree

The common routes are social engineering and insider help. Social engineering means calling support or walking into a shop with partial personal information and a convincing story. In some cases criminals have bribed or recruited staff who have the access to make the change. A related attack is port-out fraud, where the number is transferred to a different carrier rather than a new SIM at the same one. Which of these is possible depends on the carrier and the country, and carriers keep adding checks, but none are perfect.

Warning signs

The most common first sign is that your phone suddenly loses service and shows no signal or an emergency-calls-only message, while others around you have normal coverage. You may also receive a text from your carrier about a SIM change or an eSIM activation that you did not request, or unexpected security emails saying your password was reset. If this happens, treat it as urgent. Use another phone or a friend's to call your carrier from a number you trust, and from a safe device start securing your key accounts.

Step 1: add a PIN or passcode with your carrier

Ask your carrier whether you can set an account PIN, passcode or password that is required before any change to your service or SIM. Many carriers offer this, sometimes under names such as account PIN, SIM lock or port-out protection. Choose something that is not a birth date or part of your number, and do not store it in an email or in your phone. A strong PIN will not stop an insider, but it stops the large majority of casual social engineering attempts at the counter or on the phone.

Step 2: turn on number lock or port-out protection

Some carriers offer a feature that blocks transfers of your number to another provider until you unlock it yourself, and some can also block SIM changes in a shop. Look in your online account, the carrier app or ask support. Where such a lock exists, enable it. Also ask whether eSIM activation requires extra confirmation, because eSIMs can be activated remotely. If you do not need to port or change SIMs often, leaving every lock enabled costs you nothing, and you can disable it briefly when you do need a change.

Step 3: reduce your reliance on SMS

The strongest defence is to make your number matter less. Move important accounts from SMS codes to an authenticator app or, better, a passkey or hardware security key, as described in our guide comparing these methods. Then a stolen number cannot be used to log in. Check each account's recovery options too, since a recovery phone number is often the weak link even when login is strong. Remove your phone number from accounts that no longer need it, and keep a separate, strong password on your email.

Step 4: protect the information attackers use

Attackers prepare by gathering facts about you. You cannot hide everything, but you can reduce what is easy to find: avoid posting your full birth date, address or number publicly, be careful with quizzes and forms that ask for personal details, and treat unexpected calls from your carrier with caution. Never read out a PIN or code to a caller who contacted you. If your carrier calls, hang up and call back on the official number printed on your bill or on its website.

If you think your number has been swapped

Contact your carrier immediately from another phone and ask them to restore service and lock the account. Then change the passwords on your email first, since it controls resets for everything else, and then on financial and social accounts, starting with the most valuable. Move off SMS authentication as you go. Contact your bank if money may be at risk, and check for new forwarding rules in your email. Report the incident to your carrier and, where it applies, to the police or your national consumer or cybercrime service.

What this means for public numbers

SIM swapping is a reminder that a phone number is a weak identity anchor even when you own it. A public receive-SMS number is weaker still, because no swap is needed: anyone can read its messages. Never attach one to an email, banking, exchange or other important account. Use public numbers for throwaway sign-ups and testing only, and keep your own number protected with the carrier-side lock and a PIN described above.

eSIM and remote activation

Many phones now support eSIM, which lets a carrier activate a line by sending a profile over the internet instead of handing over a plastic card. That is convenient, and it also means a swap can happen without anyone visiting a shop. Ask your carrier what verification it applies before an eSIM transfer, and whether it can require an extra code or in-person check. Be wary of unsolicited messages asking you to scan a QR code or approve an eSIM transfer; approve only transfers you started yourself.