SIM Swap Attacks: Warning Signs and Carrier Locks

A SIM swap happens when someone persuades or pays your mobile carrier to move your phone number onto a SIM card or eSIM they control. From that moment every call and text sent to your number reaches their phone, including password reset codes. Your own phone drops to no service. The attacker then works through every account that lets a text message reset the password, starting with email, because the email inbox can reset most of the rest.

How does a SIM swap work?

Carriers move numbers between SIMs every day for ordinary reasons: a lost phone, a broken SIM, a switch to eSIM. The attacker uses the same process with your details instead of theirs.

1. They collect your details. Name, address, date of birth, the last digits of an ID number and the number itself turn up in data breaches and on data-broker sites. A phone number that appears on many sign-up forms is easier to match with the rest.
2. They ask the carrier for a new SIM. By phone, in a shop or through your online carrier account, they claim the old SIM is lost and answer the security questions with what they collected. Some cases involve a carrier employee who is bribed or tricked into skipping the checks.
3. The number moves. The carrier activates the new SIM or eSIM, and the network stops sending your traffic to your phone. This takes minutes.
4. They request codes. On your email, then your bank, crypto exchange or social accounts, they choose “forgot password” and receive the code by text.

A port-out works the same way with a different step 2. The attacker opens an account at another carrier and asks to transfer your number to it, using your account number and transfer PIN if they have them.

Which accounts are exposed?

Any account where a text message alone can reset the password or approve a login. That usually includes email providers that keep a recovery phone, many banks and payment apps that send one-time codes by SMS, crypto exchanges, social networks, and messaging apps where the number is the account itself.

An account with SMS two-factor authentication is also exposed if the attacker already has the password from a breach. The code was the only thing missing, and the swap supplies it. The post on two-factor authentication without a phone number compares SMS with authenticator apps and hardware keys against this attack.

What are the warning signs?

• Your phone shows “No service” or “SOS only” while other phones in the same place have signal, and restarting does not help.
• Your carrier texts or emails you about a SIM change, an eSIM activation or a number transfer you did not request. Some carriers send this to the old SIM in the moments before it goes dead.
• Password reset emails or “new sign-in” alerts arrive for accounts you did not touch.
• Your email gains a forwarding rule or a new recovery address that you did not add.

The first sign is the most reliable and the easiest to dismiss as a network fault. If you lose service suddenly in a place where you normally have it, check from another device whether your accounts are still yours.

How do you lock your number with the carrier?

Carriers now offer settings that block SIM changes and transfers until you switch them off yourself. In the US, the FCC adopted rules in 2023 that require carriers to authenticate customers before moving a number to a new SIM or another carrier, and to notify them when such a change is requested.

Carrier (US)	Setting	What it blocks
T-Mobile	SIM Protection	SIM and eSIM changes on the line
T-Mobile	Port Out Protection	Transfers to another carrier
Verizon	SIM Protection	SIM and eSIM changes on the line
Verizon	Number Lock	Transfers to another carrier
AT&T	Wireless Account Lock	SIM changes, number transfers and other account changes

Names and coverage change, so check your carrier’s account settings or ask support what exists for your line. Outside the US, ask for the same three things by name.

1. A lock on SIM and eSIM changes, so a replacement SIM needs you to unlock it first.
2. A port-out or transfer PIN that differs from your account PIN and from any number connected to you. Write it down offline.
3. A strong password and an authenticator app on your carrier account. Online carrier accounts can often issue an eSIM, so the account itself needs the same protection as your email.

How do you limit the damage if a swap succeeds?

The carrier lock lowers the chance of a swap. Taking SMS out of your important accounts limits what a swap can reach.

1. Turn on an authenticator app or a hardware key for your email, password manager, bank and any crypto account.
2. Remove the phone number as a recovery option on those accounts once the authenticator works. Leaving it in place keeps the text-message route open.
3. Save each account’s backup codes offline.
4. Give your personal number to fewer services. A store, forum or app that only needs a code at sign-up does not need your real line. A rented number answers that check, and recovery then goes to your email instead.

The last step leaves a swap possible, but it cuts how many accounts can be reset through your number and how often the number shows up next to your name in breach data. The phone number privacy guide covers the wider cleanup.

What should you do in the first hour?

1. Call your carrier from another phone and report the swap. Ask them to return the number to your SIM, then turn on the SIM lock and set a new transfer PIN. If they offer a fraud reference number, note it.
2. Secure your email first from a device that is still signed in. Change the password, sign out every other session, and delete any forwarding rules or recovery addresses you did not add.
3. Change passwords on your bank, payment and crypto accounts, and call the bank’s fraud line if anything moved.
4. Check other accounts for sign-in alerts and sign out unknown sessions.
5. Report the fraud. Your bank may ask for a police or national fraud-agency report. In the US, IdentityTheft.gov records the report and gives you a recovery plan.

Once you are back in, move the accounts above off SMS and remove the phone number as their recovery option.

Common questions

Does an eSIM protect against SIM swaps?

No. An eSIM can be reissued to a new device by the carrier just like a plastic SIM, and sometimes from the online carrier account without visiting a shop. The carrier lock and a secure carrier account protect both kinds.

Can a SIM swap happen without my details?

It usually needs some of them, which is why breaches matter. In insider cases a carrier employee skipped the checks entirely, and no setting on your side stops that. Accounts that use an authenticator app or a hardware key, with the phone number removed as a recovery option, stay out of reach even then, because no code travels by SMS.

Is SMS two-factor still better than nothing?

Yes. It stops someone who only has your password from logging in. For email, banking and crypto, an authenticator app or a hardware key covers the SIM swap case as well.