A SIM swap attack happens when a criminal convinces your mobile carrier to move your phone number onto a SIM card they control. Once they have your number, they receive your calls and text messages, including one-time login codes, and can reset passwords on your email, bank and crypto accounts. You can protect yourself by adding a carrier account PIN, moving away from SMS codes and removing your phone number as a recovery option where possible.
Key takeaways
- Criminals use personal details to impersonate you to your mobile carrier.
- Sudden loss of mobile signal is the main warning sign.
- A carrier account PIN or port-out lock makes the swap much harder.
- Move important accounts from SMS codes to an authenticator app or passkey.
What is a SIM swap attack?
A SIM swap attack is a form of account takeover in which a criminal transfers your mobile number to a new SIM card. They usually do it by calling or visiting your carrier while pretending to be you, using personal details from data breaches or social media, or by bribing an insider.
Because many services send login and password-reset codes by text, controlling your number can mean controlling your accounts. That is why SMS is the weakest two-factor method.
How do you know if you are a victim of a SIM swap attack?
The clearest sign of a SIM swap attack is that your phone suddenly shows “No service” or “SOS only” in an area where it normally works. Other signs include texts from your carrier about a SIM change and password-reset emails you did not request.
- No signal, while Wi-Fi still works.
- A message saying your SIM or eSIM was changed.
- Alerts about new logins or password resets.
- Friends receiving odd messages from your number.
How do you prevent a SIM swap attack?
You prevent a SIM swap attack by locking down your carrier account and reducing how much your accounts depend on your phone number. Five steps give strong protection.
- Add a carrier PIN or passcode and ask for a port-out or SIM lock if your carrier offers one.
- Use an authenticator app or passkeys instead of SMS codes for email, banking and crypto.
- Remove your phone number as a password recovery option where an alternative exists.
- Limit personal details online, such as your date of birth and address.
- Use a separate number for high-value accounts if your bank or exchange allows it.
The US National Institute of Standards and Technology lists SMS as a restricted authenticator in NIST SP 800-63B, partly because of SIM swapping.
Which accounts are most at risk from SIM swapping?
The accounts most at risk from SIM swapping are those that send password-reset or login codes by text: email, banking, cryptocurrency exchanges, social media and mobile payment apps. Email matters most because it can reset almost everything else.
| Account | Why it is targeted | Best protection |
|---|---|---|
| Resets all other passwords | Passkey or authenticator app | |
| Crypto exchange | Irreversible transfers | Security key; withdrawal allow-list |
| Banking | Direct access to money | App-based approval; carrier PIN |
| Social media | Used to scam your contacts | Authenticator app; recovery codes |
What should you do if your number was swapped?
If your number was swapped, contact your carrier immediately from another phone to regain the number, then secure your email account, change passwords and review your bank and crypto accounts for activity. Speed matters because attackers act quickly.
Then report the fraud to the police and, in the US, the FBI Internet Crime Complaint Center. Follow our post-breach checklist to work through the rest.
Related reading
SIM-Jacking Countermeasures for Activists: How to Secure Your Mobile Identity
Best Authenticator Apps for iPhone and Android, Compared
Frequently asked questions
Can eSIMs be SIM swapped?
Yes. Criminals can request an eSIM transfer just as they request a physical SIM. Carrier PINs and port-out locks protect against both.
Is a SIM swap the same as phone cloning?
No. A SIM swap moves your number to a new SIM through your carrier. Cloning copies SIM data and is far rarer with modern SIM cards.
Will my carrier tell me if someone requests a SIM swap?
Many carriers send a text or email when a SIM change is requested. Treat any unexpected notice as urgent and call your carrier from a different phone.
Should I stop using my phone number for 2FA completely?
Where better options exist, yes. Use passkeys or an authenticator app for email, banking and crypto. Keep SMS only for services that offer nothing else.
Next steps
A SIM swap attack turns your phone number into a master key for your accounts. A carrier PIN and moving away from SMS codes close most of that risk in about twenty minutes. Set up both today, and read our guide to passkeys for the strongest sign-in option.
