Mobile Fundamentals · SIMs & Identity · Lesson 3 of 4

SIM Swapping

How attackers steal phone numbers, and how to stop them.

Stealing a number

Your phone number belongs to your SIM only because your carrier's records say so. In a SIM swap, an attacker gets the carrier to move your number onto a SIM or eSIM they control. Usually they contact the carrier pretending to be you, using personal details taken from data breaches, social media or phishing. Sometimes they bribe or trick a carrier employee.

The first sign is often your own phone suddenly losing service. From then on, calls and texts meant for you go to the attacker's phone. The swap itself doesn't copy anything off your phone. Your photos and files stay where they are.

That number is valuable because so many accounts send one-time login or reset codes by text message. With your texts arriving on their phone, an attacker can reset your email password, then use your email to get into banking, crypto and social media accounts.

The FBI has warned that criminals use SIM swaps to steal money this way. In the US, the FCC now requires carriers to use secure identity checks before moving a number to a new SIM and to notify customers about these requests.

Protect yourself

You can't control your carrier's security, but you can make your number harder to steal and less useful if someone does steal it.

The biggest step is moving important accounts off text message codes. An authenticator app creates login codes on your own device, and a security key or passkey proves who you are with hardware you hold. Neither depends on your phone number, so a SIM swap doesn't hand them to an attacker. A longer text code doesn't help, because it still goes wherever your number goes.

Then protect the carrier side too:

• Set a PIN or password on your carrier account
• Turn on your carrier's SIM-swap or number-transfer lock if it offers one (names vary by carrier)
• Keep your phone number, birthday and address off public profiles where you can

If your phone suddenly shows no service while phones around you are fine, contact your carrier right away from another phone. Then change your email password, since email is often the key to resetting everything else, and check your bank and other financial accounts.