How SIM Swap Attacks Work and How to Protect Yourself

A SIM swap (also called SIM hijacking or a port-out scam) is an attack where a criminal convinces your mobile carrier to move your phone number to a SIM card they control. From that moment, your calls and texts, including login codes, go to them. Security agencies and regulators in several countries have warned about it, because it can lead straight to emptied bank and crypto accounts.

How the attack works

1. Research. The attacker collects your name, number, address and date of birth from data leaks, social media or phishing.
2. The swap. They contact your carrier pretending to be you ("I lost my phone"), or they bribe or trick an employee, and get your number moved to a new SIM or ported to another carrier.
3. The takeover. They press "forgot password" on your email, bank or exchange accounts and receive the reset codes by SMS.

Warning signs

• Your phone suddenly shows "No service" or "SOS only" where it normally works.
• You get a message from your carrier about a SIM change or port request you didn't make.
• You receive password-reset emails or login alerts you didn't trigger.

If this happens, contact your carrier immediately from another phone, then secure your email and financial accounts.

How to protect yourself

1. Add a carrier PIN or port-out lock. Most carriers offer an account PIN or a setting that blocks number transfers without extra verification. Turn it on.
2. Move important accounts off SMS 2FA. Use an authenticator app, a passkey or a hardware key for email, banking and crypto. Then a stolen number alone isn't enough.
3. Remove your phone number as a recovery option where a stronger method is available.
4. Limit who knows your number. The fewer databases it's in, the less material an attacker has to target you. Use a separate number for low-value sign-ups.
5. Be careful what you share publicly. Birthdays, addresses and phone numbers on social profiles make impersonation easier.

Why a separate sign-up number helps

SIM swaps are targeted. Attackers need to know that a specific number belongs to a specific person with valuable accounts. Keeping your personal number out of shopping sites, forums and app trials reduces how often it appears in leaks. For one-off sign-ups, a rented verification number from telly.cat receives the code without exposing your own number. For important accounts, the real protection is a strong second factor that doesn't depend on any phone number.

FAQ

What is a SIM swap attack?

A criminal convinces your carrier to move your number to their SIM so they receive your calls and codes.

How can I protect myself from SIM swaps?

Add a carrier PIN or port-out lock and move important accounts from SMS codes to authenticator apps or passkeys.