PeregrinoTech

Security tips / Scams & Fraud / Account Security

SIM Swap Attacks: How Criminals Steal Your Phone Number and How to Stop Them (2026)

Posted by PeregrinoTech · October 28, 2026 · 5 min read

Imagine your phone suddenly shows No Service. You assume it is a network glitch. Twenty minutes later your email password has been changed, your bank has sent a transfer confirmation, and your crypto exchange has approved a withdrawal. You did none of it.

That is a SIM swap. It is one of the most damaging attacks an ordinary person can suffer, and it does not involve hacking your phone at all. It involves hacking your phone company.

How a SIM swap works

  1. The criminal collects details about you. Full name, date of birth, address, the last four digits of your Social Security number, your carrier. Most of this comes from data breaches and social media.
  2. They contact your carrier pretending to be you. “I lost my phone and need my number moved to a new SIM.” Sometimes they bribe or trick a store employee instead.
  3. The carrier moves your number to a SIM card the criminal controls. Your phone goes dead.
  4. They reset your passwords. Every service that sends a text-message code (bank, email, PayPal, Coinbase) now sends it to them.
  5. They drain what they can in the hour or two before you notice.

The whole thing can take less than an hour. Losses in individual cases have run from a few thousand dollars to tens of millions.

Warning signs you are being SIM swapped

  • Your phone shows No Service, SOS only, or Emergency calls only in an area where it normally works.
  • You receive a text saying a SIM change or port-out request has been made, and you did not make it.
  • You get password reset emails you did not ask for.
  • You cannot log in to accounts that worked an hour ago.
  • Friends tell you they received odd messages from your number.

If you see these signs, act in this order: call your carrier from another phone, then lock your bank and email. Minutes matter. The full recovery steps are below.

How to protect yourself: five steps

Step 1: Add a port-out PIN at your carrier

Every major carrier lets you set a PIN or passcode that must be given before a number can be moved. Ask your carrier for it by name:

Carrier What to ask for
AT&T Wireless account passcode, plus turn on Extra security
Verizon Account PIN, plus turn on Number Lock
T-Mobile SIM Protection and Port Out Protection (in the T-Mobile app under Account)
Others and non-US carriers “Port-out PIN”, “SIM lock” or “account security PIN”

Pick a PIN that is not your birth year or the last four digits of your Social Security number.

Step 2: Stop using text messages for important codes

A text-message code is only as safe as your phone number. Move your important accounts to an authenticator app (Microsoft Authenticator, Google Authenticator, Authy) or a hardware security key (YubiKey). Do it in this order:

  1. Your main email account. It is the master key that resets everything else.
  2. Banking and investment accounts.
  3. Crypto exchanges.
  4. Password manager.
  5. Social media.

Then go back into each account and remove your phone number as a recovery option wherever the service allows it.

Step 3: Get a second number for anything that insists on SMS

Some banks still force text codes. For those, use a number that cannot be SIM swapped, such as a Google Voice number, which has no SIM and is protected by your Google account (with an authenticator app, per Step 2).

Step 4: Lock down the information criminals use

  • Set your social media profiles to private and remove your birthday and phone number.
  • Freeze your credit at all three bureaus (Equifax, Experian, TransUnion). It is free and takes ten minutes each.
  • Never answer a call or text that asks you to “confirm” your account PIN. Your carrier will not ask.

Step 5: Set up alerts

Turn on login alerts at your email provider and bank, and transaction alerts for any transfer above a small amount. The faster you know, the less you lose.

If it has already happened: recovery checklist

  1. Call your carrier immediately from any other phone. Say “I am the victim of a SIM swap, reverse it and lock my account now.” Ask for the fraud department.
  2. Lock your money. Call your bank’s fraud line and have cards and transfers frozen.
  3. Take back your email. From a computer, use the provider’s account recovery. Once in, change the password, enable an authenticator app, and remove the attacker’s recovery options.
  4. Change passwords on every account that used that email or phone number, starting with financial ones.
  5. Check for new forwarding rules in your email. Attackers add a rule that silently copies your mail to them.
  6. Report it. In the US: IdentityTheft.gov (FTC) and the FBI IC3. Elsewhere, your national cybercrime reporting site. Keep the report number, banks will ask for it.
  7. Tell your contacts so they ignore messages “from you”.

Common mistakes

  • Thinking a strong password is enough. Password resets go through your phone number. The password never gets typed.
  • Using the same phone number for recovery everywhere. One number compromised, everything compromised.
  • Setting a carrier PIN that is on your Facebook profile. Birthdays and anniversaries are the first guesses.
  • Ignoring the “No Service” moment. Most victims lose the first critical hour waiting for the signal to come back.

FAQ

Does an eSIM protect me?

Partly. A criminal cannot physically swap an eSIM, but they can still convince the carrier to transfer your number. The carrier PIN and port-out lock matter just as much.

Is this only a US problem?

No. SIM swapping happens worldwide. The carrier names above are US examples; ask your carrier for the equivalent lock.

Will my carrier reimburse me?

Rarely. Banks often will, if you report quickly and have a police or FTC report. Prevention is far cheaper than the argument.

Final thoughts

The uncomfortable truth is that your phone number is now one of your most valuable possessions, and it is protected by a customer-service representative having a busy day. The five steps above take about an hour and move the real security back into your own hands.

Useful resources

Know the attack. Own the defense.

Tagged:SIM swapPhone security2FAIdentity theft

Need this done for your organization?

I run security and compliance programs for a living. I can review, set up, or train your team.

Work with me →