SIM-Swapping Attacks: How They Work and How to Stop Them

SIM-swapping is a scam where criminals take control of your phone number without ever touching your physical SIM card. Once they control your number, they can receive your calls, texts, and one-time verification codes, which they use to break into your bank accounts, email, and social media. It sounds technical, but the underlying trick is simple: convincing your mobile carrier that they are you.

How the attack actually works

Criminals usually start by gathering personal information about you from data leaks, social media, or phishing messages: your full name, date of birth, address, and maybe the last digits of an ID or account number. With enough details, they contact your mobile carrier — or use an insider, or exploit a weak online account system — and request that your number be moved to a new SIM card, supposedly because you "lost your phone" or "got a new device."

Once the swap is approved, your real phone loses signal, and the criminal's device starts receiving your calls and texts. They then use "forgot password" or two-factor authentication features on your email, banking, or crypto accounts, intercepting the verification codes sent by SMS. In many cases they've already collected your passwords through phishing beforehand, so the phone number is the last piece they need to fully take over an account.

Warning signs to watch for

SIM-swapping often happens quickly, but there are usually some signals beforehand or during the attack:

• Your phone suddenly shows "no service" or "emergency calls only" with no clear reason, especially outside a known network outage.
• You can't make calls or send texts, but the issue isn't tied to your location or a known network problem.
• You receive a message from your carrier confirming a SIM change or new device activation that you didn't request.
• You get login alerts, password-reset emails, or one-time codes for accounts you didn't try to access.
• You suddenly can't log into your email, bank app, or social media, and password-reset attempts fail or go to an unfamiliar device.
• You receive unexpected calls or messages from your carrier asking to "confirm" a SIM swap or device change.

Why criminals want your number

Your phone number has become a kind of master key. Many banks, email providers, and apps use SMS codes as a second layer of security, assuming that only you can receive texts sent to your number. If someone controls your number, that entire safety layer collapses. It also lets them impersonate you when contacting your bank, since they can "receive" verification calls or texts meant to confirm identity.

What to do if you suspect a SIM swap

• Contact your mobile carrier immediately through an official channel — customer service line, in-store visit, or verified app — and ask if a SIM change or port request was made on your account.
• If you still have signal but see suspicious account alerts, change your most important passwords right away, starting with email and banking, from a device you trust.
• Contact your bank using the number printed on your card or statement, not a number from a text or call you received, and ask them to flag your account for suspicious activity.
• Report the incident to your national consumer-protection or anti-fraud authority so there is an official record.
• Ask your carrier to add extra security to your account, such as a PIN or password required for any SIM or account changes.

How to protect yourself in advance

Most protection against SIM-swapping comes down to reducing how much a stranger can find out about you and how easily they can impersonate you to your carrier.

• Set up a PIN, passcode, or additional verification with your mobile carrier so that SIM changes require more than basic personal details.
• Where possible, move away from SMS-based two-factor authentication for important accounts and use an authenticator app or a physical security key instead.
• Avoid sharing your full date of birth, address, or phone number publicly on social media; these are the details criminals use to sound convincing to a carrier's support staff.
• Be cautious with phishing emails and texts that try to collect your passwords or personal details — SIM-swapping usually pairs stolen credentials with a hijacked number.
• Check your accounts periodically for unfamiliar devices, login locations, or recovery email addresses that don't belong to you.
• If your carrier offers alerts for SIM or plan changes, turn them on so you're notified immediately if something changes.

A layered defense works best

No single step guarantees safety, but combining a few habits makes SIM-swapping much harder to pull off: a carrier PIN, an authenticator app instead of SMS codes, careful handling of personal information online, and quick action if your phone suddenly loses service. Treat any unexpected loss of signal or unfamiliar account alert as worth checking immediately rather than waiting it out — the sooner you notice a swap, the sooner you can lock criminals out before real damage is done.