Short answer: A SIM swap attack is when someone convinces your mobile carrier to transfer your phone number onto a SIM card they control. Your phone loses service; their phone starts receiving your calls and texts — including every SMS two-factor code. They then reset your passwords one account at a time. The single best defence is calling your carrier and adding a port-out PIN, then removing SMS as a 2FA method wherever an authenticator app is available.
How the attack actually works
SIM swapping requires no technical skill. It is social engineering against a customer service agent.
- Reconnaissance. The attacker assembles your name, date of birth, address, and phone number — from data breaches, public records, and social media. This information is cheap and widely traded.
- The call. They contact your carrier claiming to have lost their phone or damaged their SIM, and ask to activate a new one. The agent asks verification questions. The attacker already has the answers.
- The port. Your number is moved. Your phone drops to “No Service” — often the only warning you get.
- The takeover. They go to your email provider, click “forgot password,” and receive the reset code by text. Email is the pivot: once they hold it, every account with a password-reset link becomes reachable.
- The cash-out. Crypto exchanges, banks, and payment apps are drained. Blockchain transfers cannot be reversed, which is why crypto holders are targeted disproportionately.
The whole sequence can take under an hour, and it frequently happens overnight while the victim is asleep.
Warning signs you are being swapped
- Sudden loss of cellular service with no outage in your area and Wi-Fi still working normally
- Unexpected notifications about SIM changes, number ports, or account updates from your carrier
- Password reset emails you did not request
- Being logged out of apps on your phone without explanation
If your phone loses service unexpectedly and stays dead for more than a few minutes, treat it as an emergency. Do not wait to see if it comes back.
What to do in the first ten minutes
- Call your carrier from another phone — borrow one, or use a VoIP app over Wi-Fi. Tell them you suspect an unauthorised port and ask them to freeze the number.
- Change your email password immediately from a device that is not affected. Email is what everything else depends on.
- Sign out all sessions on your email and any financial accounts.
- Move critical accounts off SMS to an authenticator app, using the account’s other recovery methods if needed.
- Contact your bank and any exchanges and ask them to freeze withdrawals.
- File a police report. You will need it for any dispute or insurance claim.
How to prevent it
1. Add a port-out PIN with your carrier
Every major carrier offers a number transfer PIN, port freeze, or account lock. It is free, takes one phone call, and means an agent cannot move your number without a code only you hold. This is the highest-value action on this page — do it today.
The FCC introduced rules requiring carriers to verify identity before porting numbers, but enforcement varies and agents still make mistakes. A PIN you control is stronger than a policy you hope is followed.
2. Get SMS off your important accounts
An authenticator app generates codes offline from a secret stored on your device. No phone number is involved, so hijacking your number achieves nothing. Prioritise email, password manager, crypto exchanges, domain registrar, and banking. Registrars deserve particular attention, as our guide to securing your domain name with 2FA explains.
Crucially, remove SMS as a fallback, not just as the primary method. Leaving it enabled preserves the attack path entirely. Our SMS 2FA vs authenticator app comparison covers which accounts to migrate first.
3. Use passkeys or hardware keys where offered
Passkeys are bound to a specific website and cannot be phished or intercepted. A hardware security key is a physical object an attacker in another country simply cannot obtain. See passkeys vs 2FA for how they compare.
4. Reduce what is publicly known about you
Carrier verification questions draw on exactly the details people post freely — birthday, hometown, pet names, family members. Tighten your social media privacy and remove your listing from data broker sites.
5. Do not use your real phone number as a recovery method
Where a service insists on a number, consider a VoIP number that is not tied to a SIM and therefore cannot be swapped. Note that some banks reject VoIP numbers. It also sidesteps the roaming problems we cover in our guide to using 2FA while travelling.
Frequently asked questions
Can a SIM swap happen without me doing anything wrong?
Yes. The attack targets your carrier’s verification process, not you. You can have perfect password hygiene and still be swapped if an agent is convinced.
Does an eSIM prevent SIM swapping?
Not by itself. An eSIM is still a number your carrier can reassign. Some carriers apply extra verification to eSIM changes, but the fundamental weakness — a human agent who can be persuaded — remains.
Are authenticator apps completely safe from SIM swaps?
Yes, from the swap itself. TOTP codes are computed on your device from a stored secret, with no phone number involved. Explained further in how TOTP codes work.
Will I get my money back?
Bank losses are often recoverable through fraud protections. Cryptocurrency almost never is, because blockchain transactions are irreversible. Report to your carrier, your bank, and law enforcement immediately regardless.
How do I know if my carrier already has a PIN on my account?
Call customer service and ask specifically about a port-out PIN or number transfer PIN — it is separate from your voicemail PIN and your account password. Many people assume they have one and do not.
The bottom line
SIM swapping works because your phone number was never designed to be an identity document, yet the entire internet started treating it as one. You cannot fix your carrier’s training, but you can make your number irrelevant to your security: set a port-out PIN, move your accounts to an authenticator app or passkey, and delete SMS as a recovery option. If you are just starting, our guide to two-factor authentication is the place to begin.
14 Responses