How to Protect Your Phone Number From a SIM Swap Scam

Your phone suddenly shows "No service" in the middle of a normal day, and a few minutes later your bank emails to say a new device has been added. That is how a SIM swap scam often looks from the victim's side. Someone has convinced your mobile carrier to move your number to their SIM card, and now every text code meant for you goes to them.

The attack is not technically clever. It relies on persuading a customer service agent, and it works because so many accounts still use your phone number as the key to the front door. The defences, though, are cheap and mostly take less than an hour to set up.

How a SIM swap scam works

A SIM swap, sometimes called SIM hijacking or a port out attack, follows a predictable pattern:

1. The attacker collects personal details about you: your full name, date of birth, address, the last digits of a card, sometimes your account number. Much of this comes from old data breaches, social media and phishing messages.
2. They contact your carrier, pretending to be you, and claim the phone was lost or broken. They ask for the number to be moved to a new SIM or eSIM, or ported to a different carrier.
3. Once the swap goes through, your phone loses signal. Their phone now receives your calls and texts.
4. They go to your email, bank or crypto exchange, click "forgot password", and receive the reset code by text.

The whole process can take under an hour. The damage depends on how many of your accounts trust a text message as proof of identity.

Warning signs to act on immediately

• Your phone shows no signal or "SOS only" in a place where it normally works, and restarting does not fix it.
• You get a text or email from your carrier about a SIM change, eSIM activation or port request you did not make.
• Password reset emails arrive for accounts you were not trying to log into.
• Friends say they received odd messages or calls from your number.

If any of these happen, use another phone or a computer to call your carrier straight away. Ask them to reverse the swap and freeze any further changes. Then change the password on your main email account first, because it is usually the key to resetting everything else. Our checklist on what to do after a data breach email covers the follow up steps in the right order.

Five steps to protect yourself from a SIM swap scam

1. Add a carrier PIN or port out lock

Almost every major carrier now offers an account PIN, passcode or "number lock" that must be given before a SIM change or port request is processed. In the US, many carriers have a dedicated number lock toggle in their app. In the UK, you can ask for a security password on the account and request that SIM changes require it. Use a PIN that is not your birthday, your card PIN or the last four digits of your phone number. Six random digits stored in a password manager is ideal.

2. Move important accounts off text message codes

This is the step that actually removes the payoff. Switch two factor authentication on your email, bank, cloud storage and social accounts from SMS to an authenticator app or a hardware key. Even if someone takes your number, they cannot generate the codes. Most services list this under "Security" or "Sign in options", and the switch takes two or three minutes per account once the app is installed.

3. Remove your phone number as a recovery option

Many accounts let you reset a password with only a text code. Check the security settings of your Google, Apple or Microsoft account and remove the phone as a recovery method if you have a backup email and printed recovery codes instead. Keep it as a contact detail if you like, but not as a way to reset the account.

4. Use a password manager with a strong master password

A SIM swap gets an attacker the reset codes, but they still need to know where your accounts are. Unique passwords for every site, kept in a password manager you set up safely, stop one account becoming a route into all the others.

5. Share less identity data publicly

Your full date of birth, home town and pet's name are exactly the details a fraudster uses to pass carrier checks. Hide your birthday year on social profiles and treat unexpected calls "from your carrier" with suspicion. A real carrier will not ask you to read out a code they just texted you.

Why "just use an eSIM" is not a complete answer

Some articles suggest that switching to an eSIM protects you because there is no physical card to steal. That misses how the attack works. A SIM swap does not involve stealing your card. It involves convincing the carrier to activate a new one, and an eSIM can be activated remotely just as easily, sometimes more easily, through an app or a phone call.

An eSIM is still a fine choice for convenience and for travel. Just do not treat it as security. The protection comes from the carrier PIN and from removing SMS as a login factor, not from the SIM format.

How much protection each step gives

If you only do two things today, set the carrier PIN and switch your main email account to an authenticator app. Those two steps cover most of the real risk.

Then put a reminder in your calendar for six months from now. Carriers change their apps, banks add new login options, and it is easy to sign up for a new service that quietly defaults to text codes. A ten minute review twice a year keeps the setup honest without turning it into a hobby.

Frequently asked questions

How do I know if my SIM has been swapped?

The most common sign is that your phone suddenly loses all signal and shows "No service" or "SOS only" where it normally works. You may also get a carrier message about a SIM change you did not request. Call your carrier from another phone right away to confirm.

Can a SIM swap happen without my phone?

Yes, that is the usual way it happens. The attacker never touches your phone. They persuade your carrier to move your number to a SIM card or eSIM they control, often using personal details from old breaches.

Does a carrier PIN stop SIM swapping completely?

It makes it much harder, but no single step is perfect, because a determined attacker may still trick a staff member. That is why switching important accounts away from text message codes matters just as much. With both in place, a swap becomes far less useful to anyone.