SIM Swap Protection: What SIM Swapping Is and How to Stop It

Your phone number has quietly become a master key. Banks, email providers, social networks and crypto wallets have all used it for login codes and password resets. That makes the number itself a target. In a SIM swap, also called SIM hijacking or a port-out scam, an attacker takes control of your number without touching your phone, and then uses it to reset passwords and drain accounts. This guide explains how the attack works, the signs to watch for, the specific protections available from carriers in the US, UK and Canada, and how to reduce the damage a stolen number can do.

What is a SIM swap?

A SIM swap moves your phone number from your SIM card or eSIM to one controlled by someone else. Carriers do this legitimately every day when customers lose a phone or upgrade. Criminals abuse the same process by impersonating you, using personal details from data breaches and social media, or by bribing or tricking carrier employees.

A related attack is a port-out scam, where the criminal transfers your number to a different carrier entirely. Either way, once they control the number, every SMS code and voice call meant for you goes to them, and your own phone shows no service.

What are the warning signs?

The clearest sign is your phone suddenly showing no service or emergency calls only in a place where it normally works. Other signs often appear together.

• Your phone loses mobile service without explanation.
• You receive a text or email from your carrier about a SIM change, eSIM activation or port request you didn't make.
• You get password reset or login alerts from services you didn't use.
• Friends say they received odd messages from your number.
• You can't log in to accounts that send codes to your phone.

How do you lock down your number with your carrier?

Start with the carrier, because that's where the attack happens. Set a strong account PIN or passcode that isn't your birthday or the last digits of your number, and ask for any extra protection available on your account. Feature names change, but most major carriers offer something like a SIM protection, number lock or port-out lock that blocks SIM changes and transfers until you turn it off.

In the US, the FCC adopted rules in 2023 requiring wireless carriers to use secure methods to authenticate customers before SIM changes and port-outs and to notify customers about these requests, which has pushed carriers to improve their protections. In the UK, switching to a new provider generally needs a PAC code, which you request from your current provider, often by texting PAC to 65075, so watch for any PAC message you didn't ask for. In Canada, carriers also offer account PINs and authentication checks; ask yours what's available.

Step by step

1. Set a carrier PINCreate a strong account PIN or passcode with your mobile carrier.
2. Turn on SIM and port-out locksEnable any number lock or port protection your carrier offers.
3. Upgrade your 2FASwitch email and key accounts to an authenticator app, passkey or security key.
4. Save backup codesStore them offline or in a password manager.
5. Know your emergency planIf service drops unexpectedly, call your carrier from another phone right away.

How do you protect your accounts if the number is stolen?

The best defense is making your number less useful. Move important accounts, starting with email, password manager and anything financial, from SMS codes to an authenticator app, passkey or security key. Where a service lets you remove the phone number as a recovery method after adding stronger ones, consider doing so. Keep backup codes in a safe place.

Use a separate email address for account recovery that isn't widely shared, and protect it with strong 2FA. Many takeovers chain together: number, then email, then everything else. Breaking the first link limits the damage.

It also helps to share your main number less. Using a different number for sign-ups to apps you don't fully trust, such as a private temporary number for verifying your own accounts, reduces how many databases connect your number to your identity. Just remember that a temporary number is recycled and should never become your recovery number.

What to do if it happens to you

Act fast. Call your carrier from another phone, tell them your number was taken, and ask them to restore it and add a lock. Then secure your email first, since it's the key to resetting other accounts: change the password, sign out other sessions and check recovery settings. Next, go through financial, social and messaging accounts in order of importance.

Report the incident: in the US to the FTC at IdentityTheft.gov and the FBI's IC3 if money was lost; in the UK to your provider and the national fraud reporting service; in Canada to the Canadian Anti-Fraud Centre. Contact any affected financial institutions directly through their official numbers.