How to protect your accounts from SIM swapping

How a SIM swap works

In a SIM swap, an attacker convinces your mobile carrier to move your number to a SIM card they control. They call customer support pretending to be you, use personal details found in a data leak, bribe an employee, or request a “port-out” of your number to another operator.

The moment it works, your phone loses signal and the attacker starts receiving your calls and texts — including every login and password-reset code sent by SMS. From there, they reset passwords one account after another: email first, then exchanges, social media and cloud storage.

People who hold crypto are frequent targets, because a single email or exchange account can be worth a lot and crypto transfers can’t be reversed. But anyone whose accounts rely on SMS codes is exposed.

The attack is common and growing. In 2021 alone, the FBI’s Internet Crime Complaint Center received 1,611 SIM-swap complaints, with losses of more than $68 million — against 320 complaints and about $12 million over the three previous years combined.

Warning signs

• Your phone suddenly shows no service or emergency calls only where it normally works.
• You receive messages about a SIM change, a port request or a new eSIM you didn’t ask for.
• Password-reset emails arrive for accounts you didn’t touch, or you are suddenly logged out everywhere.

What to do in the first hour

1. Call your carrier from another line, report the fraudulent SIM change and ask them to reverse it and lock the account.
2. Secure your email first. Change the password, sign out every other session and remove any recovery phone or forwarding rule you didn’t create.
3. Protect your money. On exchanges, lock withdrawals if the option exists, check the withdrawal address whitelist and review recent activity.
4. Revoke sessions on your other important accounts, then switch them to a passkey or an authenticator app.
5. Keep records — times, messages from the carrier, screenshots — for the carrier, your bank and the police report.

Lock your main number at the carrier

Most carriers now offer extra protection against SIM changes and port-outs — a port-out PIN, a “number lock” or an account-level passcode. Turn on everything they offer:

1. Set a unique account PIN or passcode that isn’t your birthday or the last digits of your number.
2. Enable the port-out lock or number lock, if your carrier has one.
3. Ask whether SIM changes can require an in-store check, and turn it on if possible.
4. Remove personal details from the places attackers look first: public profiles, old listings, marketplace accounts.

In the United States, rules adopted by the FCC in November 2023 require carriers to use secure methods to authenticate a customer before moving their number to a new device or provider, and to notify customers immediately when a SIM change or port-out is requested.

These steps help. But they all rely on the carrier’s staff following the rules every time, under pressure from a convincing caller.

Move away from SMS codes

The strongest fix is to make your phone number worthless to an attacker:

• Passkeys and hardware security keys can’t be redirected by a SIM swap, and they resist phishing. Use them wherever they are offered.
• Authenticator apps (time-based codes) are the next best option. Back up the secrets or the recovery codes somewhere safe.
• Remove the phone number as a recovery method on accounts that allow it — starting with your main email, since it can reset everything else.
• Lock your messaging apps. Turn on Registration Lock in Signal and two-step verification in WhatsApp and Telegram, so a new SIM alone isn’t enough to take over the account.

Use a private number for account recovery

Some accounts still insist on a phone number. For those, don’t use the number everyone knows. Use a separate number that exists only for sign-ups and recovery, is never printed anywhere, and can’t be moved by a phone call to a support desk.

A Numonym number fits that role:

• There is no SIM card to reissue and no shop to walk into.
• Transfers and port-outs require your PIN and your 2FA. Our support team has no procedure to move a number for you — by design.
• Your account has no email and no name attached, so there is nothing for a caller to “verify” on your behalf.
• Numbers are never recycled straight away: a missed renewal gets 30 days at the normal price, then a quarantine before any reuse.

Choose a real mobile number for the best acceptance by the services you protect, and a 12- or 24-month rental so it stays yours. Read more about how we keep numbers safe and accounts without email.

Your 15-minute checklist

1. Add a port-out PIN or number lock on your main mobile line.
2. Switch your email account to a passkey or an authenticator app, and remove SMS recovery if you can.
3. Do the same for your exchanges and wallets that support it.
4. Replace your personal number with a private recovery number where SMS is still required.
5. Turn on Registration Lock or two-step verification in your messaging apps.
6. Store backup codes offline, away from your phone.