What is a SIM swap scam, and how do you protect your accounts?

Your phone stops working. No bars, no calls, no texts — but wifi is fine. Half an hour later, someone else is reading your password reset emails.

Quick answer

A SIM swap is when a criminal convinces your mobile carrier to move your phone number onto a SIM card they control. Your phone loses service. Their phone starts receiving your calls and text messages, including the verification codes banks and email providers send by SMS.

The number is not the target. The codes are.

How a SIM swap works

Everything about your phone number lives with the carrier, not the plastic card. A number can be reassigned to a new SIM or eSIM in minutes — which is the feature that makes replacing a lost phone easy, and the feature criminals abuse.

The FBI's public service announcement on SIM swapping describes three routes in:

1. Impersonating you. Calling the carrier and answering the security questions using details gathered from data breaches, social media, or an earlier phishing message.
2. Paying a carrier employee. The FBI describes criminals who "pay off a mobile carrier employee to switch a victim's mobile number".
3. Attacking the carrier's systems, by phishing staff into installing malware that gives access to internal tools.

Only the first depends on anything you did, which is worth saying plainly. The other two happen entirely inside a company you do not control.

What happens next

Once the number moves, the attacker works fast:

1. Go to your email provider and click forgot password.
2. Receive the SMS code — on their phone now.
3. Reset the email password and lock you out.
4. Use that email to reset everything else: bank, exchange, social media, cloud storage.
5. Move money, or sell the accounts on.

This is why email comes first in the response below. Email is not one account among many; it is the reset route into all of them.

Warning signs

• Sudden loss of cellular service — "No Service", "SOS Only" or "Searching" where you normally have signal, while wifi still works
• A message from your carrier saying a SIM or eSIM was activated, a port-out was requested, or account details were changed
• Password reset emails or codes you did not ask for
• Being locked out of an account that worked yesterday
• Calls and texts stopping while data continues, or the other way round
• A friend saying they got a strange message from you and it never appeared on your phone

What to do in the first hour

1. Use a different phone or a laptop. Yours cannot make the call.
2. Call your carrier's fraud line. Say you believe your number has been moved without authorisation and ask for it to be returned and the account locked. Ask what changes were made and when.
3. Secure your email first. New password, then sign out of all devices — that second step is what removes an attacker who is already inside. Check for forwarding rules, filters and recovery addresses you did not create.
4. Then banks and financial accounts. Call the number on your card. Ask them to review recent activity and flag the account.
5. Change any account that used SMS codes, and switch it to an authenticator app while you are there.
6. Report it — in the US, to IC3.gov and ReportFraud.ftc.gov. Elsewhere, your national cybercrime body. How to report an online scam covers what each agency does.

The sequence for locking down an already-compromised account, including the sign-out step people skip, is in I gave a scammer my password.

How to prevent a SIM swap

1. Lock the carrier account

The FCC's rules require wireless providers to authenticate customers properly before transferring a number, notify you when a SIM change or port-out is requested, and offer a free account lock and port freeze. Two separate protections are worth asking for by name:

• SIM change lock — blocks moving your number to a new SIM or eSIM
• Port-out freeze — blocks moving your number to a different carrier

Set them both. They are found in the account security section of most carrier apps, or by calling customer service.

2. Set a real account PIN

Add a PIN or passcode required for account changes. Do not use your date of birth, house number, or the last four of anything — those are the details an impersonator already has. Store it in your password manager.

3. Make the number worthless

This is the part that actually ends the problem. A stolen number is only valuable because of what it unlocks:

Move your email, bank, and any cryptocurrency accounts off SMS. NIST's digital identity guidelines have discouraged SMS as an authentication channel for years for exactly this reason. Which second factor to use compares them all in detail.

4. Remove the phone number as a recovery method

Adding an authenticator app is not enough if the account will still send a code to your number when someone clicks "try another way". Check the account recovery settings and remove the number where the service allows it.

5. Reduce what is public about you

The FBI's guidance includes not publicising financial holdings — particularly cryptocurrency — on social media, and not posting personal identifying information that could answer a carrier's security questions. Public detail is what makes impersonating you possible. Protecting personal information online covers the wider cleanup.

6. Use unique passwords

A SIM swap gets someone the codes. Reused passwords get them the other half. The FBI lists unique passwords among its SIM-swap recommendations for that reason, and password reuse explains how one leaked password becomes many break-ins.

Who gets targeted

SIM swaps are more targeted than most fraud. Effort goes where the return is, which historically has meant people with visible cryptocurrency holdings, high-value social media handles, or public roles that make them identifiable. IC3's reporting showed SIM swap complaints jumping from 320 across 2018 to 2020 to 1,611 in 2021, with losses above $68 million in that single year.

That does not make it a celebrity problem. Anyone whose bank uses SMS codes is reachable by the same method, and the carrier lock costs nothing whether or not you are a target.

Key takeaways

• A SIM swap moves your phone number to someone else's device so they receive your codes.
• The first symptom is your phone losing service while wifi keeps working.
• US carriers must offer a free account lock and port-out freeze. Turn both on.
• SMS codes are the weak factor. An authenticator app or a passkey is not affected.
• If it happens, call the carrier from another phone, then secure email before banking.
• Remove your phone number as a recovery option once a stronger factor is in place.