SIM swap: how crooks steal your phone number — and the free way to lock it down
In a SIM-swap attack, criminals move your number to their phone, intercept your text codes, and drain your accounts. A carrier PIN and an authenticator app shut most of it down. Here is how to protect yourself.
A SIM swap turns your own phone number into the weapon. Criminals convince your mobile carrier to move your number onto their SIM, and from that moment your calls and texts — including the one-time codes that guard your accounts — go to them. The good news: the two strongest defenses are free, and you can set them up this week.
How the scam works
The attack chains a bit of social engineering to your carrier’s account system:
- They gather your info. Name, number, and security-question answers come from phishing, data breaches, or your own social media.
- They impersonate you. Posing as you — often claiming a lost or damaged phone — they ask the carrier to move your number to a new SIM they control.
- The number ports. Your calls, texts, and data are diverted to the criminal’s device.
- They drain accounts. With your texts in hand, they run “forgot password” and account-recovery flows to take over your bank, email, and crypto.
The fact to act on: the codes texted to you are only as safe as your phone number — and that number can be moved without your phone ever leaving your hand.
How to spot it
The tells are in the box below, but the clearest signal is sudden, unexplained loss of service: no signal or “SOS only” out of nowhere, then accounts you can’t log into. If your phone goes dark for no reason, treat it as urgent.
What to do instead
You don’t need to buy anything to close this door — the free moves come first (see the defense box). The habit here is Lock the Front Door: a carrier port-freeze, an authenticator app instead of SMS codes, and unique passwords in a manager. If your details have already leaked, pair this with the free credit freeze. For more, see our defense moves and the 60-second quiz.
- Your phone suddenly loses all service — no signal, calls and texts fail, or it switches to "SOS only".
- You can no longer log in to your bank, email, or other accounts, as if the passwords changed.
- You get an alert about a SIM change or number "port-out" request that you did not start.
- Set a carrier account PIN or "port freeze" so your number can't be moved without it. Ask your carrier to enable number-lock / port-out protection.
- Switch important accounts off SMS codes. Use an authenticator app or a hardware security key for banking, email, and crypto.
- Use a password manager and a unique password for every account, so one leak can't cascade into many.
- Act fast if you lose service for no reason: from another phone, call your carrier, then alert your bank — don't wait.
Most people guard their passwords and never think about the phone number those passwords fall back on — but that number is the master key to every 'text me a code' account you own. The half-hour I’d spend this week: add a port-out PIN at my carrier, and move my bank and email off SMS codes onto an authenticator app. It’s unglamorous, free, and it quietly closes the door this whole attack walks through.
Sources
Frequently asked
My phone suddenly lost all service for no reason. What do I do?
Treat it as a possible SIM swap. From another phone, call your carrier right away to check for an unauthorized SIM change or port-out and have them lock or restore your number, then contact your bank and key accounts to secure them. A phone that abruptly shows no signal or "SOS only" is a recognized warning sign.
Is SMS two-factor still better than nothing?
Yes — any second factor beats a password alone — but SMS is the weakest form, because a SIM swap diverts your texts to the attacker. For high-value accounts, upgrade to an authenticator app or a security key, which the FBI recommends over text-based codes.
How do I add a port-out PIN with my carrier?
Log in to your carrier account or call them, set an account PIN or passcode, and turn on port-out / number-lock protection. Carriers require this PIN to be verified before a number can be moved. The exact steps vary, so ask your specific carrier for their number-lock feature.