How to Protect Yourself From SIM Swapping: 10 Steps

How a SIM Swap Works, and Where to Break the Chain

A SIM swap never touches your phone. The attacker works on the link between your phone number and your carrier account, and once that link belongs to them, your number follows. Laid out step by step, the attack is a chain with four links, and each of the 10 steps in this guide is designed to break at least one of them:

1. Research. The attacker gathers enough about you to answer a carrier's questions: your name, address, date of birth, account details, or the answers to security questions.
2. Impersonation. They contact your carrier by phone, in a store, or through your online account, and ask for your number to be moved to a SIM they control or transferred to a different carrier.
3. Capture. Your phone loses service. Calls and texts meant for you now arrive on the attacker's device.
4. Cash-out. They request password resets that send codes by text, then use those codes to get into your email, bank, and social media accounts.

The FTC's SIM swap alert walks through the impersonation link: the scammer tells your provider the phone was lost or damaged and asks for a new SIM tied to your number to be activated on a phone the scammer owns. The alert also lists the fallout, from logins to accounts that rely on text-message codes to new phones and cellular accounts opened in your name.

The FCC's page on cell phone fraud covers the transfer version, port-out fraud, in which a scammer armed with enough personal details persuades a carrier that a request to move your number came from the account holder. In both versions, according to the FCC, the scammer gains control of your private texts and calls and may then try to reset the credentials on your financial and social media accounts. The FCC also explains why the prize is worth the trouble: your mobile number may be the key to your most important financial accounts, since banks, businesses, and payment services often use text messages to verify your identity.

This guide is about prevention. If you want the background first, including the symptoms of a swap in progress, start with our explainer on SIM swapping and its warning signs. Here is how the 10 steps map onto the chain:

If you only get through a few, do steps 1 to 4, starting with your carrier account and your main email account.

Steps 1 to 3: Lock Down Your Carrier Account

The impersonation link is where SIM swap protection does the most good, because it stops the attack before your number moves. Carriers offer three kinds of protection here, and they're easy to confuse:

• An account PIN or passcode is a secret you give when you contact your carrier. It proves you're the account holder.
• A SIM-change lock blocks your number from being moved to a new SIM or device until the lock is switched off.
• A number-transfer lock, sometimes called port-out protection, blocks your number from being transferred to another carrier until the lock is switched off.

A PIN depends on the carrier's staff following their process every time. The locks go further: while one is on, the protected change can't be completed until an authorized person on the account turns it off.

Step 1: Put a PIN or passcode on your carrier account

The FTC recommends setting up a PIN or password on your cellular account to help protect it from unauthorized changes, and suggests checking your provider's website for how to do it. Many accounts already have one from the day you signed up, so the real job is often making sure the existing PIN is a good one.

A carrier PIN should be something an attacker can't look up or guess. Avoid birth dates, anniversaries, street numbers, any part of your phone number, and simple sequences like 123456. Don't reuse the PIN from your bank card or your phone's lock screen, either. Generate a random one, store it in your password manager, and share it only with the people on the account who genuinely need it.

If your carrier also uses security questions, treat the answers as passwords rather than facts. Your mother's maiden name and the name of your first school may be discoverable. A random answer saved in your password manager is not.

Step 2: Turn on the SIM-change lock

A SIM-change lock stops the classic swap: a new SIM or eSIM being activated for your number. Verizon calls its version SIM Protection. According to Verizon's support article on SIM Protection and Number Lock, numbers with it turned on are blocked from any transaction that requires a new SIM, including SIM swaps, upgrades, and bringing your own device. After you turn it off, SIM changes and upgrade orders stay blocked for 15 minutes.

AT&T takes a single-switch approach. Its Wireless Account Lock is a free feature in the AT&T app that disables specific transactions and account changes for every device and line on the wireless account, and those options appear grayed out while the lock is on. AT&T says the lock covers smartphones, tablets, watches, hotspots, and laptops on the account, and that only users with primary or secondary access can turn it on or off, using the AT&T app on a device that's active on the account.

If you're with T-Mobile or another carrier, look in the app's security or profile settings for a SIM-related lock, or ask support whether your plan has one. Menu names change, so searching the app for "SIM" is often faster than browsing.

Step 3: Turn on the number-transfer lock

A number-transfer lock stops the port-out version of the attack. T-Mobile's Account Takeover Protection page describes a free feature that blocks unauthorized users from transferring your lines to another wireless carrier. Two details matter: it has to be added to each line on your account individually, and turning it off requires the account's billing-responsible party to contact T-Mobile. T-Mobile lists it as available to postpaid, prepaid, business, and Metro by T-Mobile customers.

Verizon's equivalent is Number Lock, which its support article says protects your number from an unauthorized transfer. The same article explains how the lock interacts with the number transfer PIN, a temporary PIN you give a new carrier when you move your number: while Number Lock is on, that PIN can't be generated, and the lock has to be turned off before a port-out can go through. The lock stops a thief from ever obtaining the one-time credential a transfer needs.

AT&T's documented protection remains the single Wireless Account Lock switch covering the whole wireless account, so there's no separate setting to hunt for there.

Steps 4 and 5: Move Two-Factor Codes Off Text Messages

Steps 1 to 3 make the swap harder. Steps 4 and 5 make it pointless. A stolen number is only worth the effort if it unlocks something, and what it usually unlocks is the text-message code a service sends to prove it's you. The FTC is direct about the limits of that approach: if you use multi-factor authentication, text message verification may not stop a SIM card swap, and if the risk concerns you, the FTC suggests an authentication app or a security key instead.

That doesn't make text codes worthless. CISA's multifactor authentication page lists text and voice messages among the popular forms of MFA and says any MFA is better than no MFA, while urging people toward stronger methods. Its hierarchy puts phishing-resistant MFA at the top and names FIDO/WebAuthn authentication, the standard behind security keys and passkeys, as the only widely available phishing-resistant option. The goal is to keep text codes as a last resort rather than your first line of defense.

Step 4: Upgrade your most important sign-ins first

You don't need to change everything in one sitting. Work down this list, since each account can often reset the ones below it:

1. Your main email account. It receives password-reset links for almost everything else, so it comes first.
2. Your password manager, if you use one.
3. Banks, brokerages, payment apps, and any cryptocurrency accounts.
4. Your carrier account's own login, since that's where the locks from steps 2 and 3 can be switched off.
5. Social media and work accounts, especially any tied to a business or a public profile.

For each, open the security settings and look for an authenticator app, passkey, or security key option. An authenticator app generates codes on your device, so a thief who takes over your number doesn't receive them. Passkeys and hardware security keys go further. As CISA explains, when an attacker tricks someone into signing in on a fake website, the FIDO protocol blocks the attempt, so these methods protect you from phishing pages as well as SIM swaps. Before you finish with each account, save the backup or recovery codes it offers and store them somewhere you can reach if your phone is lost.

Step 5: Close the text-message back door

Adding a stronger method doesn't always remove the weaker one. Many services keep your phone number as a backup sign-in or recovery option, and a thief holding your number will use whichever door is still open. After step 4, go back through the same accounts and look for settings labeled "recovery phone," "backup method," or "text message." If you have a stronger method set up and your backup codes saved, remove text messages as a way in wherever the service allows it.

There are two sensible exceptions. Where a service offers nothing but text codes, keep them, because any MFA still beats none. You can also ask that company to add stronger options, the same kind of request CISA suggests sending to companies that don't offer MFA at all. And keep at least one recovery route you'll really have access to, since being permanently locked out of your own email is a disaster of its own.

One tempting workaround doesn't help: moving your codes to a masking app or a secondary number. Ghost, for instance, is designed for sending texts with your number hidden, not for receiving verification codes or opening accounts. The aim of steps 4 and 5 is to lean on phone numbers less, not to spread your codes across more of them.

Steps 6 and 7: Make Yourself Harder to Research

Every impersonation starts with homework. The attacker needs enough of your details to sound convincing on the phone or to get past an online identity check, and much of that can be found without breaking into anything. The FTC advises limiting the personal information you share online and, where possible, not posting your full name, address, or phone number on public sites, because an identity thief could use those details to answer the security questions that verify who you are.

Step 6: Take personal details out of public view

Start with what's easiest to control:

• Social profiles. Hide your birth date, phone number, and hometown, or limit them to people you know. Old posts about pets, schools, and first cars can answer common security questions.
• Listings and bios. Marketplace ads, résumés, club rosters, and business pages often show your number next to your name. Replace it with platform messaging or a contact form where you can.
• People-search sites. These sites compile addresses, relatives, and phone numbers into a single profile. Many offer an opt-out process, and it's worth checking back, since listings can reappear.
• Breach notices. If a company tells you your data was exposed in a breach, assume the details it names are known to strangers, and make sure none of them double as your carrier PIN or security answers.

Our guide to the phone number privacy mistakes people make most often walks through where numbers typically leak and how to close each gap.

Step 7: Give your real number to fewer people

A phone number does two jobs: it reaches you, and it works as an identifier that ties your accounts, listings, and records together, and every new place it's stored next to your name is another place it can leak from. The fewer strangers who hold it, the less material there is for the research link.

That matters most for short-lived contacts: a buyer on a marketplace, a contractor quoting a job, a match you haven't met yet, a sign-up sheet at a community event. For those, keep the conversation inside the platform's own messaging, or send texts from a masked sender. With Ghost, the recipient sees a protected sender ID instead of your number, and Reply Links let them answer without ever seeing it. If you're unsure where to draw the line, the signs it's time to stop sharing your number offer a practical test.

Masking has a narrow job, and it helps to know its edges. It keeps your number off a stranger's phone and out of their contact list, but it doesn't change anything about your carrier account, and it doesn't hide your number from the masking service, the carriers involved, or lawful legal process. It shrinks the research link, while the locks from steps 1 to 3 still do the heavy lifting.

Steps 8 and 9: Turn On Alerts and Refuse Code Requests

Step 8: Route alerts somewhere a thief can't intercept

The FTC lists two early signs of a swap: your phone suddenly stops working, with no data, texts, or calls, and an unexpected notification from your provider that your SIM card has been activated on a new device. The catch is that once your number has moved, any alert sent to it by text goes to the attacker. The alerts that matter most are the ones that reach you another way.

• Carrier alerts. Keep the email address on your carrier account current, and protect that inbox with step 4. AT&T says that whenever a user turns Wireless Account Lock on or off, it emails the primary account holder and texts each active number on the account. An email you didn't expect about your lock is a reason to act immediately.
• Bank and card alerts. Turn on transaction and sign-in alerts, and choose email or app notifications over text messages where you have the option.
• Email security alerts. Many email providers can notify you of new sign-ins and changes to recovery settings. Read those notices instead of swiping them away.

Step 9: Refuse every unsolicited request for a code, PIN, or lock change

The FTC's advice is simple: don't reply to calls, emails, or texts that ask for personal information, and if you get such a request, contact the company using a phone number or website you know is real. For SIM swap protection, extend that rule to three things. Never read out a verification code, never confirm your carrier PIN to someone who contacted you, and never turn off a lock because a message told you to.

These requests usually arrive dressed as help. A text claims a SIM change is underway and offers to cancel it if you reply with a code. A caller says they're from your carrier's fraud team and need to "verify" you with your PIN. A message says your account lock is holding up a delivery or a refund. In each case, the code or PIN is the piece the attacker couldn't get from your carrier on their own.

A code in a message like this may be completely genuine. That's the trick: the attacker starts a sign-in or account change on their end, which makes the real service send you a code, and then asks you for it. Replying completes their request, not yours. If you've already responded to something similar, our guide to what happens if you reply to a scam text covers the next steps, and the everyday habits that keep you out of these traps are in how to protect yourself from SMS scams.

Step 10: Plan for the Day Your Phone Goes Dark

If a swap gets past the first nine steps, what's left is speed. The FTC's first instruction for victims is to contact your cellular provider immediately to take back control of your number, and every hour your number sits on someone else's device is an hour they can spend requesting password resets. The best time to prepare for that call is while your phone still works.

A good dead-phone plan answers four questions:

1. How will I reach my carrier without my phone? Know how to contact support from another phone or a computer, and where the nearest store is. Keep your account number and PIN somewhere you can open from another device.
2. How will I get into my email? Make sure you can sign in from a laptop or tablet using backup codes or a security key, not only from your phone.
3. Which accounts do I secure first? Email first, then money: bank, cards, payment apps, and any crypto. Decide the order in advance so you aren't deciding under stress.
4. Who else needs to know? If you share a family plan, make sure another adult knows where the account details are kept.

A sudden loss of service can also have innocent causes, such as a network outage or a weak signal. Our explainer on the warning signs of SIM swapping covers how to tell the difference quickly.

It's also worth being realistic about eSIMs. The FCC notes that eSIMs are built into the phone and can't be removed, which eliminates some of the risk of physical SIM swaps, but port-out scams remain a security concern. The swap the FTC describes happens at the carrier, which activates a new SIM on the scammer's phone, so having an eSIM in yours doesn't prevent it. The FCC also recommends wiping your eSIM data whenever you replace your phone.

How to Protect Against a SIM Swap If You're a Likely Target

Anyone can be targeted, but a swap takes effort for each victim, so it makes the most sense to an attacker when the number unlocks something valuable or your details are easy to find. If one of these describes you, the 10 steps still apply, with a few changes in emphasis.

If you hold crypto or trade actively, assume someone will eventually try. Use security keys or passkeys on exchange and email accounts wherever they're offered, remove text-message recovery everywhere you can, and avoid posting about your holdings. Consider an email address used only for financial accounts, so a leak of your everyday address gives an attacker less to work with.

If your number is public for work, as it often is for real estate agents, freelancers, and small-business owners, you can't take it back. The goal shifts from hiding the number to making it useless to a thief, which means steps 1 to 5 come first. For new clients and leads, a separate channel keeps the list of people holding your personal number from growing, and our page on texting for business explains how masked sending works for that. If your carrier account is a business account, expect different procedures: T-Mobile's page, for instance, asks business and government customers to contact it to add Account Takeover Protection.

If you manage a family plan, check every line, not only your own. T-Mobile says its protection must be added to each line individually, and Verizon's app lets you toggle SIM Protection and Number Lock number by number. On AT&T, one Wireless Account Lock covers every line, which means family members may need you to unlock the account before they can upgrade a phone.

If you upgrade or switch phones often, the locks will get in your way as well as an attacker's. That's the point, and it's manageable. Unlock right before the change, remember that Verizon keeps SIM changes blocked for 15 minutes after SIM Protection is turned off, and set a reminder to turn protection back on the same day.

If your details were in a data breach, assume the answers to common verification questions are known. Replace your carrier PIN and security answers first, then work through steps 4 and 5 for your email and financial accounts.

SIM Swap Prevention Mistakes That Undo Your Work

Most failures in SIM swap prevention aren't dramatic. They're small gaps left behind after the setup is done. These are the ones to check for:

• A PIN that's already public. Birth years, house numbers, and the last digits of your phone number are exactly what the research link turns up first.
• Locking one line and not the others. On a family or business account, every unprotected line is a way in, and some carriers require protection to be added line by line.
• Unlocking for an upgrade and never re-locking. A lock you switched off in March and forgot about protects nothing in December. Re-enable it the same day.
• Adding an authenticator but keeping text recovery. An attacker will use the weakest method still enabled on the account, which is why step 5 exists.
• Leaving your carrier login weak. If someone gets into your online carrier account, they may be able to switch your locks off. Give it a unique password and the strongest sign-in option it supports.
• Relying on an eSIM alone. As the FCC points out, eSIMs reduce the risk of physical SIM theft, but port-out scams remain.
• Getting security alerts only by text. Once your number moves, those texts go to the attacker. Email and app notifications keep reaching you.
• Trusting caller ID. A call that appears to come from your carrier or bank can be faked. Hang up and contact the company through its app or the number on your bill.

A quick way to catch these is a twice-yearly review: confirm your locks are on for every line, confirm your carrier email is current, and check the recovery settings on your email and bank accounts. Pair it with something you already do on a schedule, such as reviewing a subscription renewal or changing smoke-detector batteries.

What to Do If a SIM Swap Gets Through Anyway

Even with every step in place, no protection is perfect. If your phone loses service without explanation or your carrier alerts you to a change you didn't make, act first and investigate later. These steps follow the FTC's guidance for SIM swap victims:

After the immediate crisis, change the passwords on other important accounts, especially any that used your number for codes. For a broader look at the ways a number can be misused beyond SIM swaps, see what someone can do with your phone number.

Frequently Asked Questions

Sources

• FTC: SIM Swap Scams: How To Protect Yourself
• FCC: Cell Phone Fraud
• T-Mobile: Account Takeover Protection
• AT&T: Learn About AT&T Wireless Account Lock
• Verizon: My Verizon app: Enable/Disable SIM Protection and Number Lock
• CISA: More than a Password (Multifactor Authentication)