SIM Swap Attacks: What They Are and How to Protect Your Number

Your phone number feels like a permanent part of your identity, but it is easier to move than most people realise. Carriers transfer numbers between SIM cards every day for legitimate reasons, such as upgrading a phone or switching networks. A SIM swap attack abuses that ordinary process: a scammer convinces your carrier to move your number onto a SIM card they control. Once they own the number, they can receive your calls and texts, including the security codes that guard your accounts.

This guide is defensive. It explains how the attack works so you can recognise it and shut it down, not so anyone can perform it.

Why your phone number is a target

For years, the standard advice was to protect accounts with a text-message code. That helped, but it also made your phone number a master key. If a login sends a one-time code by SMS, then whoever controls your number can request that code. A SIM swap turns your own security feature against you.

The accounts most at risk are the ones that fall back to SMS for recovery or two-factor: email, banking, and sometimes social media. That is why understanding which type of two-factor authentication is safest is such an important companion to this topic. SMS is better than nothing, but it is the weakest common option precisely because of attacks like this one.

How a SIM swap usually unfolds

You do not need the technical details to protect yourself, but a rough picture helps you spot it. A typical SIM swap follows a pattern:

• Information gathering. The scammer collects details about you from data breaches, social media, or phishing. Your name, number, date of birth, and address are often enough.
• Impersonation. They contact your carrier pretending to be you, claiming a lost or upgraded phone, and ask to move the number to a new SIM.
• The takeover. If the carrier is convinced, your real SIM goes dead and the number activates on the scammer's device.
• Account raids. With your number in hand, they trigger password resets and intercept the codes, working quickly before you notice.

The uncomfortable truth is that much of this depends on information that may already be exposed. Checking whether your email or password has been leaked in a breach is a sensible starting point, because leaked data is the fuel for impersonation.

The warning signs

SIM swaps often reveal themselves suddenly. Watch for:

• Your phone loses all service for no reason, showing no signal or "SOS only" while others around you have coverage.
• You stop receiving calls and texts, or friends say your number reaches someone else.
• Unexpected notifications about a SIM change, a number transfer, or password resets you did not request.
• You get locked out of email or banking apps without warning.

If your phone abruptly loses service in a place where it normally works, do not assume it is a network glitch. Treat it as possible until proven otherwise.

How to protect your number

You cannot control your carrier's internal checks, but you can make your number a hard target and reduce what a takeover can reach.

Add a carrier PIN or port-freeze. Most carriers let you set a separate PIN or passcode that must be provided before any SIM change or number transfer. Some offer a "port freeze" or "number lock" that blocks transfers entirely until you lift it. This is the single most effective step, so set it today.

Move away from SMS two-factor where you can. For your most important accounts, switch to an authenticator app or, better still, passkeys and hardware security keys. Our guide to passkeys for beginners explains why these methods are not tied to your phone number and therefore cannot be intercepted by a SIM swap. Keep SMS only where nothing better is offered.

Do not use your phone number as an account recovery method for critical logins if the service offers alternatives like backup codes or a secondary email. Every place your number can reset a password is a place a SIM swap can strike.

Reduce what is public. Scammers assemble impersonation kits from oversharing. Be cautious about posting your full date of birth, and limit the personal details visible on social profiles.

Stay alert to phishing. Some SIM swaps start by tricking you into confirming account details. If a message pressures you to verify information urgently, slow down and check it against our guide on how to check if an email, text, or link is a scam.

What to do if it happens to you

Act quickly and in order:

1. Contact your carrier immediately from another phone. Tell them you suspect a SIM swap and ask them to restore your number and lock the account.
2. Secure your email first, since it is the reset point for everything else. Change the password and check recovery settings.
3. Check your bank and payment apps for unauthorised activity and alert the provider directly.
4. Reset passwords on any account that used SMS codes, and switch those accounts to a stronger two-factor method.
5. Report it. File a report with the police and, if money moved, with your bank's fraud team.

The bigger lesson

A SIM swap is a reminder that phone numbers were never designed to be identity documents. The more you can detach your important accounts from your number, using app-based codes, passkeys, and backup codes, the less a hijacked SIM can accomplish. Set a carrier PIN, move your key accounts off SMS, and you turn a frightening attack into a minor inconvenience.