Imagine waking up one morning to find your phone has no service. You can't make calls, you can't receive texts, and when you finally get through to your mobile carrier, they tell you someone walked into a store, claimed to be you, and transferred your phone number to a new SIM card. This isn't a hypothetical scenario — it's called a SIM swapping attack, and it's one of the most devastating identity theft tactics used today.
Here's everything you need to know about SIM swapping and how to protect yourself.
What Is a SIM Swap Attack?
A SIM swap (or SIM hijacking) occurs when a scammer convinces your mobile carrier to transfer your phone number to a SIM card they control. Once they have your number, they can intercept SMS messages, including one-time passcodes sent to your phone for two-factor authentication. This gives them access to your email, banking, social media, and cryptocurrency accounts.
Attackers typically gather your personal information through phishing, data breaches, or social engineering before contacting your carrier.
Signs You've Been SIM Swapped
- Your phone suddenly loses all service (no bars, no data).
- You receive unexpected messages about a SIM change from your carrier.
- You can't log into accounts that send SMS verification codes.
- You notice suspicious activity on your accounts.
- Friends or family tell you they've received strange messages from you.
How to Protect Yourself from SIM Swapping
- Use app-based authenticators (not SMS): Switch to Google Authenticator, Authy, or Microsoft Authenticator for 2FA. These generate codes without relying on SMS.
- Use hardware security keys: YubiKeys and similar devices are the most secure form of two-factor authentication.
- Set up a PIN or password with your carrier: Many carriers allow you to add an extra security layer to your account.
- Limit personal information online: Scammers use public data to impersonate you. Be careful about what you share on social media.
- Don't answer verification calls without verifying the source: Scammers may call you pretending to be your carrier, asking you to "confirm" a PIN they've actually just guessed.
- Use strong, unique passwords: Even if someone gets your number, they'll still need your passwords.
What to Do If You've Been SIM Swapped
- Contact your mobile carrier immediately and confirm your identity to regain control of your number.
- Log into your critical accounts (banking, email, social media) and change passwords.
- Remove any unknown devices from your accounts.
- Add a PIN or passcode to your carrier account.
- Monitor your financial accounts for unauthorized transactions.
- Report the incident to your country's cybercrime authority.
- Consider switching to a different carrier if yours was not responsive or helpful.
Final Thoughts
SIM swapping attacks are increasing because they work. The good news is that the most effective protection is simple: stop using SMS for two-factor authentication and switch to an authenticator app. The extra minute it takes to scan a QR code is significantly more secure than relying on a text message that can be intercepted by a determined attacker.