Your phone number is not just a way to get calls. For a lot of accounts, it is the key. A SIM swap hands that key to a stranger, and the stranger never has to touch your phone.
What SIM swap fraud is
SIM swap fraud is a form of account takeover. An attacker gets a mobile provider to move your number onto a SIM card the attacker controls. After that, calls and texts meant for you land on the attacker's device.
The Federal Trade Commission describes it as a way to take over a number by convincing the provider to make the move, either through a bribed employee or through social engineering. Dry summary. Ugly result.
Why does the number matter so much? Many online accounts use it to verify who you are. With your number, an attacker can request a password reset and receive the code. The FTC warns that someone holding your login details could reach your bank account, take over email or social media, change passwords and lock you out.
A close cousin is port-out fraud. The number goes to a different carrier instead of a new SIM at the same one. For the victim, the outcome looks the same. The codes go somewhere else.
How attackers get the access they need
The scam usually starts with homework. Attackers collect details through phishing emails, fake texts, unsolicited calls, data breaches or things people post publicly. A full name, date of birth, address and part of a Social Security number can be enough to sound convincing.
Then comes the call or store visit. The attacker poses as you. The story is usually simple: a lost phone, a trip abroad, or a move to a new provider. The FTC lists three main routes on the inside:
- Bribing or blackmailing a mobile store employee.
- Employees misusing their access.
- Employees tricking colleagues at other stores into making the swap.
So part of the defense sits with the carrier, not you. One source says the FCC now requires wireless providers to meet certain obligations for verifying customers before a SIM change or port. The sources do not give the rule's text, so check FCC guidance directly for specifics.
Warning signs to watch for
The classic sign is a phone that suddenly shows no service. Calls and texts stop. Nothing obvious changed. Dead zones happen, so this alone proves nothing. It is still a reason to move fast instead of waiting until tomorrow.
- Sudden loss of service with no clear cause.
- Password reset or login alerts you did not request.
- Unsolicited calls, emails or texts asking for personal information.
The FTC advises not replying to those messages. If someone claims to be your carrier or bank and asks for a code, end the contact. Reach the organization through a number you already trust.
If the signs add up, do this first: contact your carrier from another phone or a trusted line. Then check your bank and email for activity you do not recognize.
Settings and habits that raise the barrier
Start with the carrier account. The FTC recommends setting a PIN or password on it. A carrier that asks for that credential before a SIM change makes life harder for someone who only has your personal details. Keep the PIN somewhere safe and do not share it.
Next, look at the codes themselves. A text message can be intercepted once the number moves. For accounts that hold sensitive financial or personal information, sources suggest moving two-factor authentication to an authenticator app or a hardware security key.
Then ask your carrier two questions. Does it offer a port-out PIN? Does it offer a do-not-port lock? Sources describe both as options, but availability and setup vary by provider.
Last, make a short list of your financial and email accounts that still use SMS codes. One pass is enough. The list shows which accounts would be exposed first if your number were taken.
What the sources do not cover
Some gaps are worth stating plainly. The sources do not walk through carrier PIN setup for specific providers. Your account settings or customer support will have the real steps.
They also say little about what to do right after a suspected swap. Reasonable early moves include calling your carrier, notifying your banks and reporting the incident to the FTC or the FBI's Internet Crime Complaint Center. Confirm current reporting channels on those agencies' own sites.
Whether losses are covered by consumer protections is also unclear. The answer likely depends on the type of account and the facts. Check the rules for your accounts with the relevant regulator, such as the CFPB, rather than assume.
Finally, treat statistics with care. One source cites FBI complaint data showing 982 SIM swap complaints and about $25.98 million in losses in 2024. Another reports sharp percentage jumps in swaps. Those figures come from commentary pages and are hard to verify. For current guidance, go to the FTC's consumer pages.
