SIM swap scams: how criminals take over your phone number, and how to stop them

What a SIM swap actually is

Your phone number is not really tied to your phone. It is tied to a SIM (the small chip, or the digital eSIM that does the same job), and your mobile provider decides which SIM that number belongs to. A SIM swap, also called SIM hijacking, is when a criminal persuades your provider to move your number onto a SIM that they control.

The US Federal Trade Commission describes it this way: a fraudster contacts your provider, says your phone was lost or damaged, and asks for a new SIM to be activated for your number. Once that is done, your calls and texts go to the criminal’s device instead of yours.

Nothing on your phone has to be hacked for this to work. You did not click anything. The attack happens entirely at the provider, which is why it catches careful people out.

Why criminals want your number

Many services still send a six-digit code by text message when you log in or reset a password. If the criminal receives your texts, they receive those codes too. With your number in hand they can:

• Click “forgot password” on your email, receive the code, and take the account.
• Reset your bank, card and payment-app logins using the same trick.
• Take over social media, messaging and cryptocurrency accounts.
• Open new accounts, or buy phones, in your name, according to the FTC.

Email is usually the first target, because every other reset message ends up there. Our guide to securing your email account explains why it deserves the most protection of anything you own. For more on how text codes get stolen by other routes, see our OTP interception checker.

How they get your number moved

Providers verify who you are before changing a SIM, so the criminal’s job is to get past that check. The usual routes are:

1. Collect personal details first. Names, addresses, dates of birth and phone numbers come from data breaches, from phishing, and from what people post publicly. These are often the very details a provider asks for.
2. Impersonate you. They phone the provider, or walk into a shop with a fake ID, and say they are you with a lost or broken phone.
3. Pressure or bribe staff. In some cases criminals target provider employees. This is rarer, and it is the part you cannot control, which is why the steps below do not depend on it.
4. Activate the new SIM. Your phone loses service. The criminal’s device now receives everything.

A real example: in January 2024 a man used a fake ID at a phone shop in Alabama to get a new SIM for the number linked to the US Securities and Exchange Commission’s X account. The group then posted a fake announcement from the official account. We cover it in our round-up of the biggest scams and hacks. If it can happen to a government account, it can happen to anyone’s.

Warning signs that it is happening

The FTC lists two clear signs, and there are a couple more worth knowing:

• Your phone suddenly loses service. No calls, no texts, no mobile data, and restarting does not help.
• You get an unexpected message or email from your provider saying your SIM was activated on a new device.
• You receive password reset or login codes you did not ask for.
• You are suddenly logged out of accounts, or your passwords stop working.

Do not wait to see whether the signal “comes back”. Loss of service combined with any of the other signs is an emergency. Minutes matter, because the criminal is usually already working through your accounts.

How to protect yourself

You cannot stop a criminal from phoning your provider, but you can make it much harder for the call to succeed, and make a successful swap far less useful.

1. Put a PIN or lock on your mobile account. The FTC recommends setting a PIN or password on your cellular account to block unauthorised changes. Different providers call this different things (account PIN, number lock, port-out protection, SIM lock). Ask yours what it offers, then turn it on. Use a PIN that is not your birthday or the last digits of your number.
2. Stop relying on text-message codes for important accounts. An authenticator app or a passkey cannot be taken by moving your number. The FTC makes the same point: text codes may not stop a SIM swap, so an authenticator app or security key is safer. Our two-factor setup walkthrough shows how, step by step.
3. Protect your email first. Make sure your email account uses an app or passkey, not texts, and that its recovery phone number is not your only fallback.
4. Share less about yourself. The FTC advises limiting what you post publicly. Avoid putting your full name, date of birth, address or phone number on social media. Our digital footprint quiz shows what a stranger could find.
5. Ignore unsolicited requests for personal details. If someone calls, texts or emails claiming to be your provider, do not reply. Contact the provider using a number or website you already know is genuine.
6. Use a strong, unique password on your mobile account. A password manager makes this painless.

What carriers are now supposed to do

In November 2023 the US Federal Communications Commission adopted rules aimed at SIM swap and port-out fraud (where your number is moved to a different provider). In summary, wireless providers, including smaller providers that resell network access, must use secure methods to verify a customer before changing a SIM or moving a number, and must alert customers when such a request is made. They must also keep records of these requests and train staff to spot this kind of fraud.

Rules take time to roll out and providers vary in how well they follow them, so treat them as a safety net and not a substitute for your own PIN and your own authenticator app. Outside the United States, rules differ by country, but the same protections (a PIN on the account, and not relying on text codes) work everywhere.

If your number has already been taken

Act in this order. Speed matters more than perfection.

1. Use another phone or computer to contact your provider. Say your number has been taken in a SIM swap and ask them to restore it and lock the account. The FTC’s advice is to do this immediately.
2. Secure your email. Change the password from a device you trust. Check for new forwarding rules or recovery details the criminal may have added.
3. Move to the banks and payment apps. Call your bank using the number on your card, tell them what happened, and ask them to watch for transfers. Change passwords on any account you use for money.
4. Change the rest. Social media, messaging, shopping and cloud storage. Switch each one to an authenticator app or passkey while you are in there.
5. Check for damage. Look through bank and card statements for transactions you do not recognise. The FTC says to report anything you find and, if sensitive numbers may be exposed, to follow the steps at IdentityTheft.gov.
6. Report it. Use our Report a Scam page to find the right agency in your country.

Our first 24 hours checklist covers the wider recovery in more detail, including what is realistically recoverable.

Sources

• FTC: What to know about SIM swap scamsAccessed October 12, 2026
• Sheppard Mullin: FCC adopts rules to crack down on SIM swapping and port-out fraudAccessed October 12, 2026
• US Department of Justice: man sentenced over the SEC X account hackMay 16, 2025

Published October 12, 2026. We check every claim against the sources above and say clearly when something is advice rather than fact. This guide is general information, not legal or financial advice. Dollar amounts are in US dollars, as reported.