SIM Swapping: How Criminals Hijack Your Number to Raid Your Bank

In SIM swapping, a criminal persuades your mobile network to move your number to a SIM in their hands. From that moment they receive your calls and — far worse — the texted security codes from your bank. Here is how they do it, what gives it away, and how to lock yourself down.

Unlike the scams you already know, here nobody tricks you on a call. The hit lands on your network. That is what makes it so dangerous: you can do everything right, never answer an unknown number, and still lose control of your line. The good news is that there are concrete defences, and most are free.

What exactly is SIM swapping?

Your phone number does not live inside the plastic SIM card. It lives in your network's systems, which bind that number to a particular SIM. When you lose your phone or the card fails, the network deactivates the old SIM and activates a new one with the same number. A legitimate, necessary service.

SIM swapping — a fraudulent SIM swap, and port-out fraud when the number is moved to a different network — happens when a criminal requests that transfer while impersonating you. If it goes through, your real SIM goes dead within minutes and your number starts working on the attacker's phone.

From there, everything tied to your number falls into their hands:

• Texted security codes from your bank, your email, and your social accounts.
• Confirmation calls some institutions place before an operation.
• Password-recovery texts for dozens of services.

With the code that arrives by text, the attacker can log into your online banking, authorize payments, or empty an account. All without your password ever leaking: intercepting that second factor you believed was safe is enough.

The PAC-code angle

In the UK there is an extra path worth knowing: number porting with a PAC (Porting Authorisation Code). Anyone can request a PAC by texting PAC to 65075 from the number — so if a criminal has gathered enough of your details, or has briefly accessed your phone or account, they can trigger a port of your number to a SIM they control on another network. Ofcom's switching rules made legitimate switching fast and easy; the same speed helps fraudsters. A port you never asked for is one of the Reddest of red flags — treat any unexpected "your number is moving" message as an emergency.

How do they impersonate you to the network?

The SIM swap is not the first step of the fraud — it is the last. Beforehand, the criminal must gather enough of your data to persuade the network, an employee, or an automated flow that they are the account holder. That preliminary phase is pure social engineering: data breaches, phishing and smishing asking you to "verify" details, vishing calls impersonating your bank or network, and public information scraped from your social media.

So SIM swapping is almost always preceded by another scam attempt. If you recently received a call or text asking for personal data, treat it as an early warning — and never hand details to someone who contacted you first.

Why texted codes stopped being a safe second factor

For years, receiving a code by text to confirm an operation was considered good enough. The logic was simple: only you have your phone, so only you receive the code. SIM swapping destroys that premise at the root. If the attacker controls your number, the code reaches them.

The takeaway is not "texted codes are useless" but that SMS is the weakest factor available. Wherever you can choose another verification method, choose it. More on that below.

The signs of an ongoing SIM swap

Your big defensive advantage is that SIM swapping leaves a highly visible trail: your phone stops working. The problem is that many people mistake it for a technical glitch and wait hours to react. Every minute counts.

Signs you must not ignore:

The queen of signals is the inexplicable loss of service. If you are somewhere you always have signal and it suddenly vanishes, and restarting the phone does not fix it, do not leave it for later. Grab another phone and call your network to confirm your SIM is still active and nobody requested a swap or port.

What to do in the first minutes

Speed is everything. If you believe a SIM swap is happening right now:

1. Call your network (EE, O2, Vodafone, or Three) from another phone and ask them to freeze any swap or port and reactivate your SIM. Say you suspect fraud.
2. Contact your bank through its official channel (the app or the number on the back of your card) and ask them to freeze online access and payments.
3. Change the passwords of your main email and your banking from a trusted device — not from the affected phone.
4. Review your accounts for payments or changes you did not make.
5. Report it to Action Fraud and to the police on 101, and keep every reference number for later claims.

How to protect yourself before it happens

Prevention has two fronts: making it harder for the attacker to gather your data, and making it harder for the network to hand a swap to someone who is not you. The star measure is the account security PIN and port lock.

The network PIN and port lock: your best shield

All major UK networks let you set a security PIN or password on your account, and most can flag the account against unauthorised SIM swaps and ports:

• Ask EE, O2, Vodafone, or Three for an account security password required for any SIM or porting change.
• Ask for a port-out block / transfer lock so the number cannot be moved without extra verification.
• Choose a code that is not guessable (no birthdays) and store it separately from everything else.

It is not enabled by itself — you must ask for it expressly. It is free, and it is the single most effective barrier against fraudulent swaps and ports.

Move off SMS for verification wherever you can

Even if someone swaps your SIM, if your critical accounts do not depend on texts, the attacker is left without the key piece. Compare the options:

The practical recommendation: migrate the second factor of your bank, your email, and your social accounts to an authenticator app or passkeys wherever the service allows it. Keep SMS only for services with no alternative.

Shrink the data trail and harden your email

The SIM swap begins with your data: never give personal details to someone who contacted you, distrust manufactured urgency, review what you post publicly, and act on breach notices. And remember your email account is the master key — protect it with the strongest verification available and a non-SMS second factor, and switch on your bank's notifications for every login or payment as an early-warning system.

The bottom line: your anti-SIM-swap plan

1. Set your network PIN and port lock today. Free, and the most effective barrier.
2. Take SMS out of your 2FA for banking, email, and social accounts.
3. Treat a sudden loss of service — or any unexpected PAC/port message — as an emergency.
4. Protect your email above all and switch on bank alerts.

SIM swapping is frightening because it attacks a service you believed untouchable: your own number. But it is one of the frauds best prevented by timely action — one call to your network and half an hour changing settings.