Skip to content

SIM swapping attack

A SIM swap attack occurs when a fraudster convinces your mobile carrier to transfer your phone number to a SIM card in their possession. Because many online services send login verification codes by text message, the attacker can use your stolen number to bypass security and access your email, banking, and social media accounts.

Do this now

  1. Call your mobile carrier from another phone immediately: Use a landline, a family member's phone, or visit a local carrier retail store. Inform customer service that you are the victim of an active SIM swap attack.
  2. Request an account lockdown and SIM swap rollback: Ask the representative to invalidate the unauthorized SIM card, issue a new SIM card or eSIM for your device, and place a verbal security PIN on your carrier account.
  3. Log into primary email accounts: Change your email passwords immediately and select the option to log out of all active devices and sessions.
  4. Switch authentication methods: Move your two-factor authentication settings away from text messages and toward an authenticator app or hardware security key.
  5. Check your financial accounts: Contact your banks and credit card issuers to report potential compromise. Ask them to monitor for unauthorized transfers or password changes.

Warning signs of a SIM swap

  • Sudden loss of cellular service: Your phone unexpectedly displays "No Service" or "SOS Only" in an area where you normally have strong coverage.
  • Inability to make calls or send texts: You cannot send or receive calls or text messages, but Wi-Fi connectivity still works.
  • Notifications about account changes: You receive email alerts that your passwords, PINs, or security questions were updated without your knowledge.
  • Locked out of online accounts: You are suddenly logged out of your email or banking app and your existing password is no longer accepted.

Protecting your carrier account

  • Set up an account PIN or passphrase: Contact your carrier to establish a high-security PIN that must be provided before any changes to your SIM or line can occur.
  • Disable online SIM transfers: Ask your carrier if they support a SIM lock feature in their mobile app or website that prevents number transfers without biometric or in-person verification.
  • Be cautious with personal information: Avoid posting full dates of birth, pet names, or maiden names publicly on social media, as attackers use this data to answer carrier security questions.

Reporting the crime

File an official complaint with local police and the FBI Internet Crime Complaint Center (IC3) at ic3.gov. Keep copies of all police reports, carrier ticket numbers, and correspondence, as financial institutions will require documentation to reverse unauthorized transfers.