What Is SIM Swapping? How the Scam Works and How to Stop It

SIM swapping is a scam in which a criminal convinces your mobile carrier to move your phone number onto a SIM card the criminal controls, then uses that hijacked number to intercept the one-time codes and "forgot password" links that banks, email providers, and crypto exchanges send by text. It works because SMS-based two-factor authentication (2FA) assumes whoever holds your phone number is you — and once a scammer owns that number, every account tied to it is exposed. Carriers and regulators call it "SIM swap fraud" or "port-out fraud," and the FBI's Internet Crime Complaint Center (IC3) logged more than 1,600 complaints about it in a single year, with reported losses topping $68 million.

What is SIM swapping?

A SIM is the small chip that tells a cell network which phone number belongs to which device. Carriers let customers move that number to a new SIM all the time — it's how you get a replacement SIM after losing your phone, or activate a new phone when you upgrade. SIM swapping abuses that normal process: a criminal impersonates you (or pays off a carrier employee) and asks the carrier to activate your number on a SIM the criminal holds. If the carrier agrees, your phone goes dead — no calls, texts, or data — while the attacker's device starts receiving everything meant for you.

Wikipedia's entry on the technique notes that it's also called a port-out scam or "simjacking," and that it specifically targets account security built on SMS or voice-call verification, since whoever holds the number also holds the "second factor" those systems rely on.

How attackers pull off a SIM swap

According to an FBI IC3 public service announcement, criminals use a handful of overlapping methods to get a victim's number moved:

• Impersonating the victim. The attacker calls or messages the carrier's support line pretending to be you, often claiming your phone was lost, stolen, or damaged, and asks for your number to be activated on a "new" device. This usually requires some personal information gathered beforehand — a full name, address, date of birth, or the answers to security questions — which attackers collect through data breaches, social media oversharing, or phishing texts sent directly to the target.
• Bribing or recruiting insiders. The FBI's PSA on the scheme specifically flags insider threat as one of the three main methods, alongside social engineering and phishing — some attackers pay carrier employees or retail-store staff to process the swap directly.
• Phishing carrier employees. Rather than targeting you, some crews go after the carrier itself, phishing staff with malware or fake internal tools to gain the access needed to reassign numbers at scale.

Once the swap goes through, the attacker's phone starts ringing and buzzing with your texts and calls. They then run through "Forgot password" flows on your email, banking, and social accounts, intercepting the SMS codes or voice calls those services send to verify the request — effectively using your own phone number as the master key to everything secured behind it.

A related but distinct threat is signaling-level interception — attacks that exploit weaknesses in SS7, the decades-old protocol mobile networks use to route calls and texts between carriers. Security researchers have described SS7 weaknesses being used to intercept SMS messages in transit without ever touching a carrier's customer-support process. It's a narrower, more technical attack than the social-engineering-driven SIM swap described above, but it leads to the same outcome: someone else receiving the text message meant to verify it's really you.

Why SIM swapping is so dangerous

The damage isn't that someone can read your texts — it's what those texts unlock. SMS-based 2FA and phone-based account recovery are built into the login flow for most major banks, email providers, social networks, and cryptocurrency exchanges. A hijacked number lets an attacker:

• Take over your email using "forgot password" links sent by text or an SMS code, then use that inbox to reset every other account linked to it.
• Drain bank and investment accounts by intercepting the one-time codes banks send to approve logins, transfers, or new payees.
• Empty cryptocurrency wallets — a frequent target, since crypto transfers are largely irreversible once sent, and many exchanges historically relied on SMS verification.
• Lock you out entirely, changing passwords and recovery details on compromised accounts before you even realize your phone has gone dead.

This is precisely why security guidance increasingly treats SMS 2FA as a weak baseline rather than a strong protection: it secures your account only as well as your phone number is secured against your carrier's own support desk.

Real-world warning signs you've been SIM-swapped

SIM swaps tend to announce themselves quickly, because your phone genuinely stops working. Watch for:

• Sudden loss of service — no calls, texts, or mobile data, with no outage reported in your area, especially if it happens out of nowhere and doesn't resolve with a restart.
• An unexpected "SIM activated" notification from your carrier telling you your SIM or number was just activated on a different device.
• Account alerts you didn't trigger — "here's your login code," "your password was changed," or "a new device was added" emails and push notifications for accounts you weren't actively using.
• Unsolicited calls or texts asking you to confirm personal details, which can be reconnaissance for a swap attempt rather than the swap itself — a pattern that overlaps heavily with ordinary phishing and smishing campaigns.
• Being unable to log in to email, banking, or social accounts that you could access normally the day before, with password-reset emails you never requested.

SMS codes vs. authenticator apps vs. passkeys vs. hardware keys

Not every form of two-factor authentication is equally exposed to a SIM swap. The further a method is from "something a phone carrier controls," the harder it is for this particular scam to defeat:

This is the core reason security teams keep pushing people toward passkeys and authenticator apps instead of text-message codes: moving your second factor off the phone network removes the one thing a SIM swap actually controls.

How to prevent SIM swapping: lock down your carrier account

Because the attack happens at your carrier, carrier-side protections are your first and most direct line of defense. The three major U.S. carriers each offer a free way to block unauthorized SIM changes and port-outs:

• Verizon — Number Lock. A free setting that blocks any port-out request on a line until it's turned off. It's managed in the My Verizon app or website under Account Settings → Security Settings, and Verizon sends a text confirming it's active. Verizon also offers a Number Transfer PIN, a six-digit code that's required before a line can actually be ported to a new carrier.
• T-Mobile — Port-Out Protection and a port validation passcode. T-Mobile lets customers set a separate account passcode (created by calling 611 from a T-Mobile phone, or 1-877-575-7420 from any phone) that reps must verify before processing account or SIM changes — distinct from your regular account password.
• AT&T — wireless account passcode. AT&T attaches a numeric passcode to every account that can be required before staff make changes over the phone or in a store, with an "extra security" option that also requires it to sign in online.

If you're on a smaller carrier or a prepaid plan, ask explicitly for a "port-out PIN," "number lock," or "port freeze" — the FCC's 2023 rules (more on those below) now require every wireless provider to offer some version of this at no charge.

Move beyond SMS-based two-factor authentication

A port freeze protects the front door, but you should also assume any single defense can eventually fail and plan for what an attacker gets if they do move your number:

• Switch sensitive accounts to an authenticator app (which generates codes on your device rather than over text) or a passkey wherever the service supports it. Banking, primary email, and cryptocurrency accounts should be the priority, since the FBI specifically calls out crypto holdings as a common target.
• Use unique, strong passwords for every account rather than reused ones, ideally generated and stored in a password manager — a SIM swap combined with a reused password is a much faster route into your accounts than a SIM swap alone.
• Remove your phone number as a recovery method where you can, in favor of a backup email or recovery codes stored offline, especially on your primary email account.
• Don't publicize what you'd rather keep private — the FBI's guidance specifically warns against posting cryptocurrency holdings or other financial details on social media, since that information tells attackers who's worth targeting.
• Treat unsolicited "verify your identity" calls or texts as suspicious by default, and call your carrier or bank back using the number printed on your bill or card rather than one given to you in the message — the same rule that applies to smishing applies here.

What the FCC's SIM-swap rules mean for you

SIM swapping got common enough that it became a formal rulemaking priority at the FCC. In November 2023, the Commission adopted a Report and Order (FCC 23-95) updating its Customer Proprietary Network Information and Local Number Portability rules specifically to address SIM swap and port-out fraud. The new rules require wireless carriers to:

• Use secure methods to authenticate a customer before transferring a phone number to a new device or a new carrier — the order specifically disallows relying only on information that's easy for an attacker to already have, like basic biographical details.
• Notify customers immediately when a SIM change or port-out request is made on their line, so a legitimate customer has a chance to catch and stop a fraudulent request in progress.
• Offer a free lock or freeze option that customers can turn on to block SIM changes and port-outs on their account until they choose to disable it.

The order gives carriers flexibility in exactly how they authenticate customers rather than mandating one specific method, which is why Verizon, T-Mobile, and AT&T each implement the protection slightly differently. The practical upshot for you: if your carrier doesn't already offer a port-out PIN or number lock, you're entitled to ask for one.

What to do if you think you've been SIM-swapped

Speed matters here more than almost anywhere else in consumer security, because every minute an attacker holds your number is a minute they can use it to reset something else. If you suspect a swap:

1. Contact your carrier immediately from another phone or device — a friend's phone, a landline, or online chat — and report that you believe your number was ported or your SIM was changed without authorization. Ask them to lock the line and reverse the change.
2. Change passwords on your most important accounts — primary email first, since it's usually the recovery path for everything else, then banking, and any cryptocurrency exchanges — from a device you know is clean.
3. Check financial accounts for unauthorized transactions or new linked payees, and call your bank or exchange directly using the number on your card or statement, not any number sent to you by text.
4. Turn on an authenticator app or passkey on the accounts you just secured, so a second swap attempt can't repeat the damage.
5. Report it to the FBI's Internet Crime Complaint Center at ic3.gov and to your local police department — IC3 reports feed directly into the statistics the FBI uses to track and respond to these schemes.

A SIM swap is unnerving precisely because it happens to something you assumed only you could control. The good news is that the fix is mostly a half-hour of settings changes: a port-out PIN with your carrier, a password manager for unique logins, and authenticator apps or passkeys in place of text-message codes on anything that actually matters.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage