SIM Swapping: How Number Hijacking Works and How to Prevent It

In SIM swapping, a criminal gets your carrier to move your phone number to a SIM in their hands. From that moment they receive your calls and — far worse — the texted verification codes from your bank. Here is how they do it, what gives it away, and how to lock yourself down.

Unlike the scams you already know, here nobody tricks you on a call. The hit lands on your carrier. That is what makes it so dangerous: you can do everything right, never answer an unknown number, and still lose control of your line. The good news is that there are concrete defences, and most are free.

What exactly is SIM swapping?

Your phone number does not live inside the plastic SIM card. It lives in your carrier's systems, which bind that number to a particular SIM. When you lose your phone or the card fails, the carrier deactivates the old SIM and activates a new one with the same number. A legitimate, necessary service.

SIM swapping — a fraudulent SIM swap, or port-out fraud when the number is moved to a different carrier — happens when a criminal requests that transfer while impersonating you. If it goes through, your real SIM goes dead within minutes and your number starts working on the attacker's phone.

From there, everything tied to your number falls into their hands: texted verification codes from your bank, email, and social accounts; confirmation calls placed before operations; and password-recovery texts for dozens of services. With the code that arrives by text, the attacker can log into your online banking or authorize transfers — all without your password ever leaking.

How do they impersonate you to the carrier?

The SIM swap is not the first step of the fraud — it is the last. Beforehand, the criminal must gather enough of your data to persuade the carrier, an employee, or an automated porting flow that they are the account holder. That preliminary phase is pure social engineering: data breaches, phishing and smishing asking you to "verify" details, vishing calls impersonating your bank or carrier, and public information scraped from social media.

So SIM swapping is almost always preceded by another scam attempt. If you recently received a call or text asking for personal data, treat it as an early warning — and never hand details to someone who contacted you first.

Why texted codes stopped being a safe second factor

For years, receiving a code by text to confirm an operation was considered good enough: only you have your phone, so only you receive the code. SIM swapping destroys that premise at the root. If the attacker controls your number, the code reaches them.

The takeaway is not "texted codes are useless" but that SMS is the weakest factor available. Wherever you can choose another verification method, choose it.

The signs of an ongoing SIM swap

Your big defensive advantage is that SIM swapping leaves a highly visible trail: your phone stops working. The problem is that many people mistake it for a technical glitch and wait hours to react. Every minute counts.

The queen of signals is the inexplicable loss of service. If you are somewhere you always have signal and it suddenly vanishes, and restarting the phone does not fix it, do not leave it for later. Grab another phone and call your carrier to confirm your SIM is still active and nobody requested a swap.

What to do in the first minutes

1. Call your carrier from another phone and ask them to freeze any swap or port and reactivate your SIM. Say you suspect fraud.
2. Contact your bank through its official channel and ask them to freeze online access and operations.
3. Change the passwords of your main email and banking from a trusted device — not from the affected phone.
4. Review your accounts for transfers or changes you did not make.
5. Report it to the police and your national fraud reporting centre, and keep every reference number.

How to protect yourself before it happens

The carrier PIN and port lock: your best shield

Most carriers let you set a security PIN or password on your account, plus a lock against unauthorised ports and swaps. It is not enabled by itself — you must ask for it expressly: call your carrier or open your account settings, set a code that is not guessable (no birthdays), and store it separately from everything else. It is usually free, and it is the single most effective barrier against fraudulent swaps.

Move off SMS for verification wherever you can

Even if someone swaps your SIM, if your critical accounts do not depend on texts, the attacker is left without the key piece:

Migrate the second factor of your bank, email, and social accounts to an authenticator app or passkeys wherever allowed; keep SMS only where there is no alternative.

Shrink the data trail and harden your email

Never give personal details to someone who contacted you, distrust manufactured urgency, review what you post publicly, and act on breach notices. And remember your email account is the master key — protect it with the strongest verification available and a non-SMS second factor, and switch on your bank's notifications for every login or movement as an early-warning system.

The bottom line

1. Set your carrier PIN and port lock today.
2. Take SMS out of your 2FA for banking, email, and social accounts.
3. Treat a sudden loss of service as an emergency, not a glitch.
4. Protect your email above all and switch on bank alerts.

SIM swapping is frightening because it attacks a service you believed untouchable: your own number. But it is one of the frauds best prevented by timely action — one call to your carrier and half an hour changing settings.