SIM Swapping: How Criminals Steal Your Phone Number to Rob Your Bank

In SIM swapping, a criminal convinces your carrier to move your phone number to a SIM in their hands. From that moment they receive your calls and — far worse — the texted verification codes from your bank. Here is how they do it, what gives it away, and how to lock yourself down.

Unlike the scams you already know, here nobody tricks you on a call. The hit lands on your carrier. That is what makes it so dangerous: you can do everything right, never answer an unknown number, and still lose control of your line. The good news is that there are concrete defences, and most are free.

What exactly is SIM swapping?

Your phone number does not live inside the plastic SIM card. It lives in your carrier's systems, which bind that number to a particular SIM. When you lose your phone or the card breaks, the carrier deactivates the old SIM and activates a new one with the same number. A legitimate, necessary service.

SIM swapping — also called a fraudulent SIM swap or port-out fraud when the number is moved to another carrier — happens when a criminal requests that transfer while impersonating you. If it goes through, your real SIM goes dead within minutes and your number starts working on the attacker's phone.

From there, everything tied to your number falls into their hands:

• Texted verification codes (2FA/OTP) from your bank, your email, and your social accounts.
• Confirmation calls some institutions place before an operation.
• Password-recovery texts for dozens of services.

With the code that arrives by text, the attacker can log into your online banking, authorize transfers, or drain an account. All without your password ever leaking: intercepting that second factor you believed was safe is enough.

How do they impersonate you to the carrier?

The SIM swap is not the first step of the fraud — it is the last. Beforehand, the criminal must gather enough of your data to persuade the carrier (or an employee, or an automated porting flow) that they are the account holder. That preliminary phase is pure social engineering.

They assemble the dossier from several sources:

• Data breaches: company leaks exposing names, addresses, phone numbers, and account details.
• Phishing and smishing: emails and texts asking you to "verify" your data.
• Vishing: calls impersonating your bank or your carrier to fish out your date of birth, account number, or PIN.
• Social media: public information you shared yourself without thinking twice.

With that file assembled, they contact your carrier by phone, web, or even in a store, and request the swap or port. So SIM swapping is almost always preceded by another scam attempt. If you recently received a call or text asking for personal data, treat it as an early warning — and never hand details to someone who contacted you first.

Why texted codes stopped being a safe second factor

For years, receiving a code by text to confirm an operation was considered good enough. The logic was simple: only you have your phone, so only you receive the code. SIM swapping destroys that premise at the root. If the attacker controls your number, the code reaches them.

The takeaway is not "texted codes are useless" but that SMS is the weakest factor available. Wherever you can choose another verification method, choose it. More on that below.

The signs of an ongoing SIM swap

Your big defensive advantage is that SIM swapping leaves a highly visible trail: your phone stops working. The problem is that many people mistake it for a technical glitch and wait hours to react. Every minute counts.

Signs you must not ignore:

The queen of signals is the inexplicable loss of service. If you are somewhere you always have signal and it suddenly vanishes, and restarting the phone does not fix it, do not leave it for later. Grab another phone and call your carrier to confirm your SIM is still active and nobody requested a swap.

What to do in the first minutes

Speed is everything. If you believe a SIM swap is happening right now:

1. Call your carrier from another phone and ask them to freeze any swap or port and reactivate your SIM. Say you suspect fraud.
2. Contact your bank through its official channel (the app or the number on the back of your card) and ask them to freeze online access and operations.
3. Change the passwords of your main email and your banking from a trusted device — not from the affected phone.
4. Review your accounts for transfers or changes you did not make.
5. Report it: file with the FTC at reportfraud.ftc.gov and the FBI's IC3 at ic3.gov, and keep every reference number for later claims.

How to protect yourself before it happens

SIM-swap prevention has two fronts: making it harder for the attacker to gather your data, and making it harder for the carrier to hand a swap to someone who is not you. The star measure is the carrier account PIN and port lock.

The carrier PIN and port lock: your best shield

All major US carriers let you set a security PIN or passcode on your account, plus a lock against unauthorized ports:

• Verizon: set an account PIN and enable Number Lock on each line, so the number cannot be ported out without unlocking it first.
• T-Mobile: add a PIN/passcode and turn on Account Takeover Protection (including the port-out block) in your account or the app.
• AT&T: set a wireless account passcode; extra-transfer protection options are available on request.

It is not enabled by itself — you must ask for it expressly. Call your carrier or open your account settings, set a code that is not guessable (no birthdays), and store it separately from everything else. It is free, and it is the single most effective barrier against fraudulent swaps and ports.

Move off SMS for verification wherever you can

Even if someone swaps your SIM, if your critical accounts do not depend on texts, the attacker is left without the key piece. Compare the options:

The practical recommendation: migrate the second factor of your bank, your email, and your social accounts to an authenticator app or passkeys wherever the service allows it. Keep SMS only for services with no alternative.

Shrink the data trail they can steal

The SIM swap begins with your data. The less of it circulating, the harder you make it:

• Never give personal data by phone or text to someone who contacted you. The golden rule stands: hang up and verify through the official channel.
• Distrust urgency. Pressure to act "now" is the hallmark of fraud.
• Review what you post publicly. Your birthday, hometown, or pet's name can be answers to security questions.
• Watch breach notices. If a service you use reports a breach, change that password and enable robust 2FA.

Harden your email and turn on alerts

Your email account is the master key: nearly every other password can be reset from it. Protect it with the strongest verification available and a non-SMS second factor. Also enable your bank's notifications for every login or movement: they are your early-warning system, because push alerts reach your device even if the attacker already controls your number.

The bottom line: your anti-SIM-swap plan

If you keep four ideas, make them these:

1. Set your carrier PIN and port lock today. It is free and it is the most effective barrier.
2. Take SMS out of your 2FA for banking, email, and social accounts. Use authenticator apps or passkeys.
3. Treat a sudden loss of service as an emergency, not a technical glitch.
4. Protect your email above all and switch on bank alerts.

SIM swapping is frightening because it attacks a service you believed untouchable: your own number. But it is one of the frauds best prevented by timely action. You do not need to be a security expert; you need one call to your carrier and half an hour changing settings.