SIM Swap Scams: How Criminals Hijack Your Phone Number and How to Lock It Down

A SIM swap scam is when a criminal takes control of your mobile phone number by getting your carrier to move it to a SIM card or phone they hold. From that moment, your calls and texts go to them, including the one-time codes banks and email providers send, so they can reset your passwords and get into your accounts. The first sign is usually your phone losing service for no obvious reason. By the time you notice, they may already be in.

One of our community members described it as the strangest ten minutes of his life: his phone dropped to No Service on an ordinary Tuesday afternoon, and while he was still restarting it, password reset emails for his accounts and a login alert from his bank started arriving on his wife’s phone. That is a SIM swap from the inside, and it’s the reason I now think of my phone number as a key rather than just a number.

How a SIM swap works

The criminal needs only one thing: for your carrier to believe they are you, or to have someone inside who will act as if they do. The FBI describes three main routes: social engineering, where the criminal impersonates you to customer service; insider help, where a carrier employee is paid to move the number; and phishing, where carrier staff are tricked into installing malware that opens up the carrier’s systems¹.

The personal details needed to impersonate you are rarely hard to find. Your name, address, date of birth and the last digits of a Social Security number often sit in old data breaches, which is why how scammers find and target you is the companion piece to this one.

A close cousin is the port-out scam, where instead of moving your number to a new SIM with the same carrier, the criminal uses your personal information to transfer it to a different carrier entirely. The FCC describes both: once the request succeeds, the number is ported to a device controlled by the scammer².

What they do with your number

They use it to receive your text message codes and reset the passwords on your most valuable accounts. Once the swap goes through, the FBI says your calls, texts and other data are diverted to the criminal’s device, and they start account recovery on your email and other accounts using the codes sent by text¹.

Email usually comes first, because whoever controls your email can reset almost everything else. Bank accounts, payment apps and cryptocurrency wallets follow. The FCC warns that successful attacks can drain bank accounts or let criminals sell or ransom access to social media accounts².

The scale has grown fast. The FBI’s Internet Crime Complaint Center received 320 SIM swap complaints from January 2018 to December 2020, with adjusted losses of about $12 million. In 2021 alone it received 1,611 complaints with adjusted losses of more than $68 million¹.

Warning signs

The sign that matters most is your phone suddenly losing service where it normally works, and staying that way. The FBI’s advice includes watching for unexpected changes in your text and call connectivity¹.

Other signs that tend to follow:

• Emails or app notifications about password changes or new logins you didn’t make.
• Your bank or email account suddenly not accepting your password.
• Messages from friends saying they’ve had strange texts or calls “from you”.
• A notice from your carrier about a SIM change or a port request you didn’t ask for.

If your phone drops to No Service and you also see any of these, assume it’s a SIM swap until proven otherwise and act immediately.

How to protect your number

The two most effective steps are locking your number at the carrier and moving important accounts off text message codes. Neither takes long.

• Add a port-out PIN, account PIN or number lock. Most major US carriers offer one, sometimes under names like “number lock” or “SIM protection”. It means a port or SIM change can’t go through without the PIN.
• Move your key accounts to an authenticator app or security key. The FBI recommends stronger forms of multi-factor authentication, such as biometrics, physical security tokens or standalone authentication apps, rather than relying on text codes¹. Text codes are still far better than nothing, the FTC notes, but they are the weak link here³. The detail is in two-factor authentication explained.
• Never give your carrier PIN or a code to someone who calls you. If a call claims to be your carrier, hang up and call the number on your bill or the carrier’s website¹.
• Share less. The FBI advises limiting the personal details you put online, such as your phone number and address, and not posting about financial assets, including cryptocurrency¹.
• Use a different password for every account. If one leaks, it shouldn’t open the others; how to create strong passwords covers how to manage that without a notebook.

An eSIM helps a little, because it can’t be physically stolen, but the FCC is clear that port-out scams remain a security concern with eSIMs too². The lock at the carrier still matters.

If it happens to you

Speed matters more than anything: get the number back, then lock down email and money. In order:

1. Contact your carrier from another phone or a computer. Tell them your number has been moved without your permission and ask them to restore it and add a PIN or lock.
2. Call your bank and any payment apps. Tell them your phone number was hijacked and ask them to watch for or freeze unusual activity.
3. Secure your email. From a device you trust, change the password, sign out of all sessions, check the recovery phone and email, and switch to app-based codes.
4. Report it. Report it to the FTC at IdentityTheft.gov, which will give you a recovery plan⁴, and to the FBI’s IC3⁵. The FCC also suggests a police report and a complaint to the FCC².
5. Protect your credit. A fraud alert with one credit bureau is passed on to the other two², and a freeze goes further, as explained in how to freeze your credit and by the FTC⁶.

Then work through everything else connected to the number. Identity theft: what to do covers the longer tail of accounts and records to check.

---

This article is general information about how scams operate, not legal, financial or security advice for your situation. If your number or accounts have been taken over, contact your carrier, your bank and the official reporting channels directly.