How to protect your number from a SIM swap attack

A SIM swap is not a hack of your phone. Nobody breaks into your device, your operating system or your apps. Someone contacts your mobile carrier, claims to be you, and asks for your number to be moved to a SIM they control — a new plastic card in a shop or, increasingly, an eSIM profile activated in seconds from an app. The carrier obliges, your handset drops off the network, and from that moment every call and every text meant for you arrives on their phone instead.

The number is the prize because so much is anchored to it. Banking one-time codes, exchange withdrawals, password-reset links, work chat, delivery confirmations — all of it flows to whoever holds the line right now. The attacker usually has your password already, from a breach or a phishing page; the swap is the last step that turns a stale password into a live account takeover.

There are only three ways a number moves, and all three run through a human being:

• The retail counter: a walk-in with a convincing story and a borrowed or forged ID.
• The support line: an agent whose script accepts a date of birth, an address and the last four digits of a card — details that sit in old data leaks.
• The insider: a shop or call-centre employee paid a few hundred dollars to run the transfer, which is why even a perfect account PIN is not an absolute defence.

You will see the same attack called SIM swapping, SIM jacking, port-out fraud or SIM splitting. The mechanics are identical; only the paperwork differs, depending on whether your number moves to a new SIM at the same carrier or to a different operator entirely.

A SIM swap announces itself, but quietly, and the window between the transfer and the first emptied account is often under an hour. The most reliable symptom is silence: your phone shows No Service or SOS only while Wi-Fi still works perfectly. Data over Wi-Fi keeps flowing, so a handset on a home network can look entirely normal until you try to place a call.

Watch for these, and treat any two of them together as an emergency rather than a coincidence:

• Sudden loss of mobile service with no outage in your area and no change of location.
• A carrier notification confirming a SIM change, an eSIM activation or a transfer request you did not make.
• Password-reset emails for accounts you never touched, above all for your primary mailbox.
• Being signed out of messengers — a re-registered number kicks the old device off WhatsApp, Telegram or Signal.
• Login alerts from unfamiliar places, or a two-factor prompt for an app you are not opening.
• Small unexplained transactions that test whether a card still works before something larger is attempted.

Attackers often start the transfer late in the evening or over a weekend, when carrier fraud desks are thin and a dead phone is easy to mistake for a flat battery. If your handset goes silent at an odd hour, check it instead of assuming a network glitch: switch airplane mode on and off, and if service does not come back, call your carrier from another line straight away.

Everything else on this page limits the damage. Only one measure stops the swap from happening at all: telling your carrier in advance that this number may not move without a proof an attacker cannot produce.

The feature exists almost everywhere but carries a different name in every market — number lock, port freeze, port-out PIN, SIM protection, transfer PIN. Ask for it by describing what you want: no SIM replacement and no transfer to another operator without this passcode, in person, with ID. Then tighten the account around it:

• Set a dedicated passcode you use nowhere else, and never a birthday, a postcode or the last four digits of anything printed on a card.
• Delete the security questions or answer them with random strings kept in your password manager. Your mother's maiden name is public record; your first pet is on your own social feed.
• Ask what an agent can override, and whether shop staff can bypass the lock. The honest answer tells you what the lock is actually worth at your carrier.
• Check the notification address on the account. If confirmations go to an old mailbox you no longer read, you have lost your only early warning.
• Get your number off people-search sites so you are not on the list of easy targets to begin with — our guide to keeping your real number private walks through the opt-outs.

Regulation has helped. In the United States, carriers have been required since 2024 to authenticate the account holder properly before moving a number to a new SIM or a new operator, and to notify them when such a request is made. Several European and Asian operators apply comparable rules. None of it closes the insider route, which is why the next two sections matter.

Assume for a moment that the swap succeeds. What can the attacker actually do with your number? Exactly as much as you have allowed it to unlock. The point of this step is to make a stolen line boring.

Rank your second factors and move every account you can up the list:

• Passkeys and hardware security keys — nothing about them touches the phone network, so a swapped number is worthless against them.
• Authenticator apps (TOTP) — codes are generated on the device rather than delivered to the number. Keep the recovery codes offline, on paper.
• Push approvals in a provider's own app — bound to the app installation, not to the SIM.
• SMS codes — a last resort, and only where the service offers nothing better.

Then close the trap that catches almost everyone. Moving to an authenticator app changes nothing if the same account still offers lost access? we will text you a code as a recovery path: the attacker walks through the back door and ignores the front one you reinforced. In every account's security settings, remove the phone number from account recovery, not only from login.

Work through your accounts in the order an attacker would. Primary email first, because it resets everything else, then your password manager, then banking and any crypto exchange, then cloud storage, domain registrar and social accounts. Our guide to receiving one-time codes online covers the practical side of moving codes away from your personal SIM.

Some services genuinely refuse to drop SMS — many banks, most delivery platforms, a surprising number of government portals. That residue is exactly what the next defence is for.

An attacker cannot swap a number they cannot identify. Before anything else happens they need your number, the operator it sits on, and enough about you to sound plausible at a support desk. Every one of those facts comes from the same place: the number you have been handing out for a decade, sitting in breach dumps, marketplace listings, delivery apps and data-broker profiles next to your name, your address and your carrier.

So split the roles. Keep your personal SIM for family, your employer and the two or three institutions that genuinely need it, and give a separate dedicated line to everything that sends you codes. That second line does not live at a retail carrier at all, which removes the attack path instead of defending it:

• No shop counter and no consumer support desk that can be talked into a transfer with a birthday and an address.
• No identity on the account to research or impersonate — PrivacyNumber asks for no ID and bills in crypto, so there is nothing to social-engineer against.
• Not in the leak beside your name. The number criminals correlate with you is the old one, and it no longer receives anything worth stealing.
• Real, dialable lines in 47 countries — mobile ranges banks and messengers accept, not the throwaway VoIP ranges most services now reject.
• Long-term, not disposable — the same line still works next year, which is the whole point when it is on file at your bank.

Be clear about what this does not do. Any provider with humans in the loop has some social-engineering surface, interception at the network level is a separate and real problem, and a dedicated line only helps once you have actually changed the number on file at the accounts that matter. What it removes is the specific, cheap, industrialised attack described on this page — the one that starts at a mobile shop. Lines start at $3.58/month and activate in under 60 seconds.

Speed matters more than completeness. Work down this list from another phone or a computer, and do not stop to investigate — investigate afterwards.

1. Call your carrier from any other line and say the words: my number has been transferred without my authorisation. Ask for the transfer to be reversed and the account frozen against further changes.
2. Secure your primary email next: new password, sign out of every session, then check for forwarding rules, filters and recovery addresses the attacker added. An unnoticed forwarding rule keeps them inside long after you get the number back.
3. Lock the money. Call your bank's fraud line and your exchange's support, freeze withdrawals, and reverse anything still pending.
4. Rotate and revoke — password manager, cloud storage, domain registrar, social accounts, in that order, signing out of all sessions as you go.
5. Re-register your messengers once the number is back, and check each one for linked devices you do not recognise.
6. File the reports: carrier fraud department, your national telecom or consumer regulator, and a police report, which banks generally require before they will even discuss reimbursement.
7. Write down timestamps as you go — when service died, when each notification arrived, who you spoke to. That record is what disputes are decided on.

Afterwards, treat the number as burned for anything sensitive. It has proven it can be moved, and it now sits on a list of numbers that were successfully targeted once. Move your codes to a line the attacker has never seen — and if you want to know what you are moving to before you commit, read how traceable a virtual number really is.