How SIM Swapping Steals Your Phone Number
A criminal can move your number to another phone, intercept your codes, and take over your accounts.
Your phone number can be stolen — without anyone touching your phone. That is the core of a SIM swap: a bad actor convinces your wireless carrier to transfer your mobile service from your phone to a phone in the bad actor's possession, according to the Federal Communications Commission (FCC).
How the attack works
In the typical version, the attacker calls your carrier, claims your phone was lost or damaged, and asks the provider to activate a new SIM connected to your number — on a phone the attacker owns (FTC).
Before making that call, the scammer does homework. They gather personal information through phishing calls, emails, or texts, and from public online posts, and use those details to impersonate you and pass the carrier's identity checks (FTC). This is also why breaches of other companies' databases matter: the FCC notes that data breaches can make SIM-swap scams easier by exposing the personal information attackers use to take over cell phone accounts. The phishing tricks covered in the briefing Spot the phish before you touch the bait feed directly into this — the details you hand over to a phisher can become the answers an attacker gives your carrier.
The warning signs
The attack is quiet, but the phone tells on it. The Federal Trade Commission lists the warning signs: your phone suddenly stops working — no data, no texts, no calls — or your carrier sends you a notification that a new SIM was activated on your number. If your phone goes dead for no reason while your account should be active, call your carrier right away.
What the attacker gets
Once the swap succeeds, the attacker — not you — receives all of your calls, text messages, and data (FTC). That includes the SMS verification codes your accounts send for two-factor authentication (FTC). With your login details plus those intercepted codes, the attacker can log into bank accounts and steal money, take over email or social media accounts, and change your passwords to lock you out (FTC).
A related scam works a little differently. The FCC distinguishes "port-out fraud": the bad actor, posing as you, opens an account with a different carrier and arranges for your number to be ported out to that new account, which the attacker controls. Same target — your number — different route.
Regulators have moved on this. In November 2023 the FCC adopted rules requiring wireless providers to use secure authentication methods before redirecting a customer's number to a new device or provider, and to immediately notify customers whenever a SIM change or port-out request is made (FCC).
Why text-message codes are the weak link
Here is the part worth sitting with: text-message verification may not stop a SIM swap. If you are concerned about SIM swapping, the FTC advises using an authentication app or a security key instead of SMS codes.
The technical standards point the same way. NIST's digital-identity guidelines (SP 800-63B, Revision 4) classify sending one-time codes by SMS or voice call — the public switched telephone network — as a "restricted authenticator," the only restricted authenticator in the guidelines (NIST). NIST also states that one-time-password authentication is not phishing-resistant, and that services at Authenticator Assurance Level 2 must offer a phishing-resistant option (NIST).
This does not mean two-factor authentication is pointless. It means the text-message version has a known hole, and SIM swappers aim straight at it. It is also why the briefing One unique password for every door matters: your login credentials are half of what the attacker needs (FTC), and unique passwords for every account keep that half from being handed over.
If you suspect a SIM swap
The FTC's recovery steps are direct:
- Contact your cellular provider immediately to take back control of the number.
- Change your account passwords — start with email and banking.
- Check your credit-card, bank, and other financial accounts for unauthorized activity.
For the longer job of reclaiming locked accounts, see the briefing Take back a compromised account.
Protect yourself in three steps
- Set a PIN or password on your cellular account.The FTC's advice starts here: a PIN or password on the account helps block unauthorized changes — and the call to your carrier is where this attack starts (FTC).
- Switch from text-message codes to an authentication app or security key.Text-message verification may not stop a SIM swap (FTC).
- Shrink the information attackers can find.Never reply to calls, emails, or texts requesting personal information — they may be phishing — and limit the personal details you share online (FTC).
A dropped call now and then is normal; none of this calls for paranoia. But a SIM swapper depends on two things: your carrier trusting them, and your number carrying the codes. A PIN on the account and an authentication app instead of texts each close one of those two paths.