SIM swap fraud: how criminals hijack a phone number, and how to lock yours

Privacy · Published 2026-10-25

Illustration of a SIM card outline with a padlock in front of it, on a warm cream background — Your number is a key to other accounts. A carrier PIN and stronger sign-in methods keep it from being copied onto someone else's SIM.

A phone number was never designed to prove who you are, yet banks, email providers and social networks send their login codes to it. SIM swap fraud exploits that gap: the criminal does not need your phone, only your number.

What a SIM swap is

Your number is tied to a SIM, physical or eSIM, through your operator's systems. When you lose a phone or upgrade, the operator moves the number to a new SIM. That is a legitimate and very common operation. In a SIM swap attack, someone convinces the operator, in a shop, on the phone or through a hijacked online account, to move your number onto a SIM they control. From that moment, your calls and text messages go to them, and your own phone loses service.

A close relative is port-out fraud: instead of a new SIM at the same operator, the criminal asks a different operator to port your number away, using the same number-porting process that lets you change provider while keeping your number. We explain how legitimate porting works in our guide to keeping your number and caller ID; the fraud uses the same rails with stolen or invented details.

Why criminals want your number

The number itself is rarely the prize. It is a key to other accounts. With your texts redirected, an attacker can:

receive the one-time codes that banks and payment apps send by SMS;
use "forgot password" flows on email and social media accounts that reset through a text message;
once inside your email, reset the passwords of other services, one after another.

The scale is documented. In a February 2022 public service announcement, the FBI's Internet Crime Complaint Center reported that it had received 320 SIM swapping complaints with adjusted losses of about $12 million from January 2018 to December 2020, and 1,611 complaints with adjusted losses of more than $68 million in 2021 alone (IC3, PSA I-020822-PSA). The announcement singles out people who talk publicly about cryptocurrency holdings as frequent targets.

In Europe, the EU cybersecurity agency ENISA surveyed mobile operators for its December 2021 report Countering SIM-Swapping. It describes how the attack works, recommends that operators strengthen detection and train their own and third-party staff, and describes a check that lets banks ask an operator whether a SIM was swapped recently before approving a sensitive transaction.

How the attacker gets through

Operators verify customers before swapping a SIM, so the attacker needs answers to their questions. The usual sources are:

Personal data you published: name, date of birth, address and phone number collected from social networks or data breaches.
Phishing: a fake message from "your operator" or "your bank" asking you to confirm details or read back a code.
Insiders and retail staff: both the FBI and ENISA mention employees who are bribed or deceived, which is why their recommendations to operators focus on staff training and strict identity checks.
Your operator account: if the online account that manages your line uses a weak or reused password, the attacker may be able to order a replacement eSIM without speaking to anyone.

Warning signs

The clearest sign is sudden loss of service: your phone shows "No service" or "SIM not provisioned" in a place where it normally works, and restarting does not help. Other signs include a text or email from your operator about a SIM change or port request you did not make, and login alerts or password reset emails you did not trigger. Coverage gaps happen for innocent reasons, but if no service coincides with security emails, treat it as urgent.

Lock your number: steps that work

1. Add a carrier PIN or port-out protection

Most operators let you set a separate PIN or passcode on your account, required before sensitive changes such as a SIM replacement or a port-out. Some also offer a "number lock" or port freeze that blocks porting until you lift it. The US Cybersecurity and Infrastructure Security Agency calls the telco PIN "a critical step in countering" SIM swapping and recommends adding both a PIN and multi-factor authentication to your mobile account (CISA, Mobile Communications Best Practice Guidance, December 2024). Ask your operator what it offers; the names differ.

2. Secure the operator account itself

Give the online account that manages your line a long, unique password, stored in a password manager, and turn on its strongest sign-in option. An attacker who can log in there may be able to transfer an eSIM directly.

3. Move important accounts off SMS codes

This is the step that limits the damage if a swap happens anyway. CISA's guidance puts it bluntly: "Do not use SMS as a second factor for authentication", noting that SMS messages are not encrypted and are not phishing-resistant. In order of strength:

Security keys and passkeys (FIDO): the only methods CISA describes as phishing-resistant. Your email, Apple, Google and Microsoft accounts are the priority, since they can reset everything else.
Authenticator apps that generate six-digit codes on your device: better than SMS, because the code never travels over the phone network, but still open to phishing.
SMS codes: keep them only where nothing else is offered.

The US standards body NIST takes the same line in its digital identity guidelines, where using the telephone network for out-of-band codes is a "restricted" authenticator and services are encouraged to check for risk signals such as a SIM change or recent number porting (NIST SP 800-63B). One catch worth knowing: adding an authenticator app does not always remove SMS from an account. CISA notes that you often have to disable SMS separately, otherwise it remains a weak fallback.

4. Share less

The FBI's advice to individuals includes not posting details of financial assets, limiting the personal information you put online, never giving a password or PIN to someone who calls you, and using a different password for each account. If a caller claims to be your operator or bank, hang up and call the number printed on your bill or card.

Where regulation stands

In the United States, the Federal Communications Commission adopted rules on 15 November 2023 requiring wireless providers to use secure methods to authenticate a customer before moving their number to a new device or provider, to notify customers of SIM change and port-out requests, and to offer a clear process for reporting fraud (FCC 23-95, WC Docket No. 21-341). The compliance date depended on a later federal paperwork review, so check the FCC's site for the current status. In the EU there is no single SIM swap regulation; ENISA's report sets out recommendations for operators, banks and national authorities, and national telecom regulators handle complaints.

If it happens to you

Call your operator from another phone straight away, say you suspect a fraudulent SIM swap or port-out, and ask them to restore the number and lock it.
Call your bank and card issuers using the numbers on your cards; ask them to freeze transfers and review recent activity.
From a trusted device, change the password of your main email account first, then of the accounts that reset through it, and remove any devices or recovery numbers you do not recognise.
Report the fraud to the police and, in the US, to the FBI's IC3. Under the FCC rules, US operators must provide documentation about the incident on request, which helps with banks and insurers.

A quick checklist

Carrier PIN or number lock set? Operator account password unique and stored?
Email, Apple, Google and Microsoft accounts on a passkey or security key?
Banking app protected by the app itself rather than SMS, where the bank allows it?
SMS removed as a fallback on accounts that now use an authenticator?
Recovery email and phone number on each account up to date?

A stolen number is mainly a sign-in problem. For the privacy of the calls themselves, see what calling apps actually encrypt, and for a related question of consent, our guide to recording phone and internet calls.