SIM Swapping: What It Is and the Warning Signs

What Is a SIM Swap?

Every phone on a cellular network has a SIM, short for subscriber identity module. It can be a small removable card or an eSIM built into the phone, and it tells your carrier which device should receive the calls and texts for your number. As long as your number is paired with the SIM in your phone, everything reaches you.

Changing that pairing is a routine request. Carriers do it constantly for people who upgrade to a new phone or replace one that was lost or broken, and with eSIMs the whole move happens inside the carrier's systems without anyone handling a card. A SIM swap scam abuses that ordinary service. The criminal poses as you, persuades your carrier to reassign your number to a SIM in a phone they hold, and the network starts delivering your calls and texts to them.

So the plainest SIM swapping meaning is this: your number changes hands, but your phone does not. The FCC's draft rules on SIM swap and port-out fraud describe criminals taking over cell phone accounts "without ever gaining physical control" of the victim's phone. Your handset stays in your pocket while it quietly stops being the device your carrier believes is yours. You may also see the attack called SIM hijacking; it means the same thing.

SIM swap, port-out, or stolen SIM: three routes to one result

The FCC treats SIM swapping together with a close relative, port-out fraud. In a port-out, the attacker opens an account in your name at a different carrier and asks to transfer your number there. According to the FCC's draft order, a legitimate transfer between wireless carriers starts with the new carrier collecting your phone number, your current account number, your ZIP code, and any passcode on the account. That list explains why anyone who asks for your carrier account number or transfer PIN deserves suspicion. The lowest-tech route is plain theft: the FCC's cell phone fraud page warns that a thief can take the removable SIM card out of your phone and use it in their own device, posing as you.

	SIM swap	Port-out fraud	Stolen SIM card
Who gets fooled	Your current carrier	Your current carrier, via a new carrier the attacker signs up with	No one; the card is physically taken
Where your number ends up	A new SIM or eSIM on the attacker's phone, same carrier	A new account at a different carrier	The attacker's phone, running your own card
What the attacker needs	Enough personal details to pass your carrier's identity checks	Your number, account number, ZIP code, and account passcode	A few minutes alone with your phone
Alert you might receive	A SIM change or new-device notice	A number transfer notice	Usually none; your phone reports no SIM

An eSIM changes the odds for only one of these routes. Because it is wired into the phone, nobody can slip it into a pocket, and the FCC says that removes some of the physical theft risk while port-out scams remain a concern. The draft order also explains that carriers now reassign eSIMs from one phone to another virtually, and that criminals have convinced carriers to move a victim's virtual SIM onto a device the criminal controls. In short, an eSIM protects your number from pickpockets, not from a persuasive conversation with your carrier.

How a SIM Swap Scam Unfolds, Step by Step

Most SIM swaps follow the same arc. The details vary from case to case, but knowing the sequence tells you where the warning signs show up and where you can interrupt it.

1. Research. The attacker gathers what a carrier might ask to confirm your identity: your name, address, date of birth, the last digits of a payment card, perhaps your account PIN. Some of it comes from data breaches and public profiles; some comes from you, through a message pretending to be your carrier or bank.
2. The pretext. The attacker contacts your carrier by phone or in a store, posing as you. The cover story in the FTC's alert on SIM swap scams is mundane on purpose: a lost or broken phone, and a request to put the number on a replacement handset. The replacement belongs to the scammer.
3. The switch. If the carrier accepts the story, it reassigns your number. Your phone drops off the network, and the attacker's phone begins receiving your texts and calls.
4. The code harvest. The attacker opens your email, bank, and social media login pages and clicks "forgot password." Every service that confirms identity by text message now sends its code straight to the attacker.
5. The lockout and cash-out. Once inside, the attacker changes passwords and recovery settings so you can't get back in. The FCC's draft order lists draining bank accounts and selling or ransoming social media accounts among the harms, and the FTC adds opening new cellular accounts or buying phones in your name.

Because each step feeds the next, the chain can move quickly, which is why speed matters so much in the response section below.

Why carrier identity checks fail

Carriers don't hand out numbers to anyone who asks, so how do attackers get through? The FCC's draft order summarizes a 2020 Princeton University study in which researchers opened prepaid accounts with five major carriers and then phoned in SIM change requests. All five carriers used identity challenges that could easily be subverted. Two tricks from that summary show how creative attackers can be. One: buy a refill card, apply it to the victim's prepaid account, then cite that "recent payment" as proof of identity. Two: bait the victim into dialing specific numbers, then cite those calls as account history. The researchers also found that callers generally had to answer only one challenge correctly, even after failing several others in the same call.

The same document relays complaints from consumers alleging that carrier store employees were involved in the fraud, and that SIM changes went through even though the customer had set a PIN or password on the account. None of this means your carrier will cave on the first call. It does mean that a PIN is a strong lock rather than an unbreakable one, and that recognizing the warning signs still matters when you have done everything right.

What an Attacker Can Reach With Your Number, and What Stays Safe

Your phone number works like a skeleton key because so many companies use it to confirm who you are. As the FCC puts it on its cell phone fraud page, banks, businesses, and payment services often send text messages to verify your identity when you ask to change something on your account. Whoever holds the number receives those messages.

What a SIM swapper can typically reach

• Every new text and call to your number from the moment of the switch, including one-time codes and reset links sent by SMS.
• Any account that lets a text code alone reset the password. Email is the most dangerous of these, because an attacker who controls your inbox can reset almost everything else from there.
• Your contacts' trust. Texts and calls from your number now come from the attacker, who can use them to ask your friends or family for money or codes.
• Apps that sign you in with an SMS code, which can include messaging apps tied to your number, unless the app lets you add a PIN (WhatsApp calls this two-step verification) and you have set one.

How far can this go? The FCC's draft order reports that the Princeton researchers examined the login policies of more than 140 online services and found 17 websites with flaws that would let an attacker fully compromise an account with a SIM swap alone. Among the criminal cases the document cites is a 2019 report of a 20-year-old student who stole more than $5 million in cryptocurrency by hijacking the numbers of about 40 people and accepted a 10-year prison sentence.

What stays out of reach

• Everything already on your phone. The swap moves the number, not the device. Texts, photos, and apps stored on your phone stay with you, and the attacker gains neither your passcode nor your phone's location, unless they later break into a cloud account that syncs those things.
• Accounts protected by an authenticator app or a security key, as long as the service doesn't let a text message override them. The FTC cautions that text message verification may not stop a SIM swap and points people worried about swaps toward an authentication app or a security key.
• Accounts where your phone number isn't a recovery option. If an account can only be recovered through an email address or backup codes you control, a hijacked number doesn't open it.

How common is it?

SIM swaps are targeted attacks that take effort for each victim, so they are far less common than the mass-texted scams most people receive. The FCC counted roughly 300 complaints about SIM swap and port-out fraud in 2020, 400 in 2021, and 500 in 2022, according to its draft order. Those counts only include people who filed with the FCC, and many of the cases the document cites involved cryptocurrency or valuable social media accounts. Still, anyone whose bank or email trusts a text code holds something worth stealing. For the wider range of risks a phone number carries, see our ranked guide to what someone can do with your phone number.

SIM Swap Attack Signs to Watch For

In its consumer alert on SIM swaps, the FTC paints the scene: the phone abruptly goes quiet, with no data, texts, or calls, and then a message arrives from the carrier saying the SIM was activated on a different device. The FCC's draft order goes further, calling loss of service, with the phone going dark or allowing only 911 calls, typically the first sign that SIM swap or port-out fraud has happened. Here is what each warning sign looks like in practice.

Your phone loses service where it normally works

On an iPhone, the signal bars may give way to "No Service" or "SOS" in the status bar, meaning only emergency calls can connect. Android phones may show "No service" or "Emergency calls only." Some phones also display an error about the SIM itself. As of September 2026, the exact wording varies by phone model, software version, and carrier.

The catch is Wi-Fi. At home or at the office, apps that run over the internet keep working, so a missing signal indicator is easy to overlook. Often the first clue is that ordinary texts stopped arriving, a login code never showed up, or a friend mentions they couldn't reach you.

An alert about a SIM change, new device, or number transfer

Under FCC rules, covered in the next section, US carriers must notify you when someone requests a SIM change or a port-out on your account. The notice might come as a text, an email, an app notification, or an automated call. If you didn't order a new phone, activate an eSIM, or ask to switch carriers, treat it as an emergency rather than a routine update.

Notices about failed attempts to verify your identity

The draft rules also require carriers to tell you right away about failed authentication attempts connected to a SIM change request. A message saying someone couldn't verify as you is an early warning: nothing has moved yet, but someone is trying.

Password reset emails and new sign-in alerts

Emails about password resets, new sign-ins, changed recovery phone numbers, or two-factor settings you never touched suggest someone is already working through your accounts. Check the timestamps. A cluster of them shortly after your phone lost service is one of the strongest signals you can get.

You're locked out of your carrier account

If your carrier's app or website suddenly rejects your password, or the PIN, email address, or mailing address on the account has changed, someone may have taken over the account itself, not just the number.

People say your phone is acting strangely

Friends mentioning odd texts from you, a stranger picking up when they rang your number, or a money request "from you" all point to someone else holding your line.

A messaging app says your number moved to another phone

Apps that register accounts by phone number may sign you out and show a message that your number was registered on a different device.

Before the swap: requests for your PIN or a code

Many swaps start with an attempt to collect your details, so the earliest warning sign can arrive before your phone ever goes quiet. A text or call claiming to be your carrier and asking you to "confirm" your account PIN, read back a code, or update your personal information is a red flag in its own right. The FTC's advice is to contact the company through a phone number or website you know is real. If you have already answered a message like this, our guide to what happens if you reply to a scam text walks through the next steps, and our overview of how to protect yourself from SMS scams covers the common lures.

Example of a fake carrier security text

Your Carrier

Text Message

Security notice: unusual activity was detected on your line. To avoid suspension, confirm your 6-digit account PIN within 30 minutes at mycarrier-verify.example/secure

SIM Change Alerts: What Your Carrier Must Tell You

In November 2023, the FCC adopted rules aimed squarely at SIM swap and port-out fraud. On October 25, 2023, ahead of the vote, the agency released a public draft of the rules that lays out what they ask of wireless carriers. As described in that draft, the requirements that matter most to you are these:

• Stronger identity checks. Carriers must use secure methods to authenticate you before moving your number to a new SIM or a new carrier. The draft says methods built on readily available biographical information, account information, recent payment information, or call records don't count as secure.
• Immediate alerts for SIM changes and port-outs. Carriers must notify you right away whenever someone requests a SIM change or a port-out on your account, and the notice must go out before the change is carried out. That timing is deliberate: the FCC expects it to keep the warning from landing on the attacker's phone after the swap.
• Alerts for failed verification attempts tied to SIM change requests.
• Free account locks. Carriers must offer all customers, prepaid and postpaid alike, a free option to lock the account against SIM changes and against port-outs. While the SIM lock is on, the carrier may not complete a SIM change until you switch it off.
• Easy-to-find information. Carriers must explain the account protections they offer in clear language on their websites and apps.
• A clear way to report fraud. Carriers need an easy-to-use process for reporting SIM swap and port-out fraud, must investigate reports promptly, and must provide documentation of the fraud when you ask for it.
• Trained staff. Employees must be trained to identify, investigate, prevent, and remedy these scams.

These rules cover US wireless carriers; protections elsewhere depend on your country and your carrier. This is a general summary, not legal advice.

How the alert reaches you

The rules let each carrier decide how to deliver the notice, as long as it is reasonably designed to reach you and written in clear, concise language. The draft order mentions live or automated calls, texts, emails, and push notifications from a carrier's app, and when a phone has been lost or stolen, it points to email or a pre-arranged backup number as ways to reach the customer.

That flexibility has a practical consequence. An alert sent only to your own number may never reach you if the attacker already controls the line. Sign in to your carrier account and check that the email address is current, allow notifications from the carrier's app, and add a backup contact if your carrier offers one. If you're on a family or business plan, ask who receives these alerts, because it may be the account owner rather than you.

The rules also don't make carriers wait for your reply before completing a request. The FCC considered requiring a 24-hour delay and decided against it, concluding that the burden on customers who legitimately need a new SIM, such as people whose phones break or go missing, outweighed the benefit (FCC draft order). An unexpected alert is therefore a window, not a guarantee. Contact your carrier immediately through its app or a number you know is real, and say plainly that you did not make the request.

Genuine alert or phishing lure?

Scammers can imitate any message a company sends, and a security alert is an attractive disguise because it creates urgency. A genuine SIM change notice tells you that something happened and how to reach the carrier. It has no reason to ask for your PIN, a login code, or a card number through a link. If a "security alert" pushes you to a website to "verify" or "cancel," don't tap it; open the carrier's app or dial the number printed on your bill instead.

Example of a genuine-style SIM change alert

Your Carrier

Text Message

A SIM change was requested for your line ending 0142. If you made this request, no action is needed. If not, contact us right away in our app or at the number on your bill. We will never ask for your PIN by text.

No Service? How to Tell a Hijack From an Outage

Most of the time, a phone with no signal is just a phone with no signal. Towers go down, storms knock out service, and SIM cards work loose. What separates a SIM swap from an ordinary outage is context: where you are, what else is happening on your accounts, and whether the people around you have the same problem.

Start with a few quick checks:

1. Restart the phone, or switch airplane mode on and off.
2. Confirm your SIM or eSIM still appears in settings. On an iPhone, look under Settings, then Cellular. On many Android phones, the path is Settings, then Network and internet, then SIMs. As of September 2026, the names vary by model and software version.
3. Ask someone nearby on the same carrier whether they have service, or check your carrier's outage page or social media accounts over Wi-Fi.
4. Scan your email for messages from your carrier and for password reset or sign-in alerts from other services.

What you notice	Most likely cause	What to do
People nearby on your carrier have no service either	Network outage	Wait for service to return and follow the carrier's status updates
Signal is fine a few blocks away but not here	Coverage gap	Move, or use Wi-Fi calling where it works
A SIM error appeared after a drop or after the SIM tray was opened	Loose or damaged SIM card	Reseat the card; visit a store if the error persists
An email from your carrier about a missed payment	Billing suspension	Pay or contact the carrier through its app
Service vanished where it is normally strong, plus a SIM change or new-device alert	SIM swap	Contact the carrier immediately from another line
Service vanished, plus a notice about a number transfer	Port-out fraud	Contact the carrier immediately and mention the port-out
Password reset or sign-in emails you didn't trigger	Account takeover in progress, possibly through a SIM swap	Secure your email and contact your carrier now

The rule of thumb: an outage by itself is an inconvenience, but an outage alongside any unexpected account activity is an emergency. If a few minutes of checks don't explain the problem, act as though your number has been taken.

What to Do Immediately If Your Number Was Hijacked

The order matters. The number is the key the attacker is using, so take it back first, then protect the accounts it unlocks. These steps build on the FTC's advice for SIM swap targets, which starts with contacting your carrier immediately to regain control of your number.

Reach your carrier from a line the attacker doesn't control

Your own phone can't help, because its line now belongs to someone else. Borrow a family member's or friend's phone, use a work landline, open the carrier's online chat on a computer, or go to a carrier store with photo ID. Get the phone number from the carrier's official website or a paper bill rather than from a search ad or a text message.

When you reach someone, be direct. A script like this covers everything you need:

"My phone lost service, and I believe my number was moved to another device or carrier without my permission. I need to report SIM swap fraud. Please check whether a SIM change or port-out was made on my line and when, reverse it, and return the number to my phone. Then reset my account PIN and security details, turn on your SIM change and number transfer locks, and add a fraud note to my account. I would also like a reference number and written documentation of the fraudulent change."

If the first representative seems unsure what to do, ask for the fraud department and don't end the conversation without a ticket number. The FCC's draft order relays complaints from customers who spent many hours on the phone and in stores because employees didn't know how to handle a fraudulent swap. Under the rules, your carrier must have a clear process for reporting this fraud, must investigate promptly, and must give you documentation when you ask.

If your number was ported to a different company, say so. Ask your carrier which company now holds it and whether you should report the fraud there too. Recovering a ported number can take longer than reversing a SIM change, because two companies are involved, so keep your ticket numbers handy and ask for updates.

Secure your email before anything else

Email is the master key, because password resets for nearly every other account flow through it. From a computer or tablet where you are still signed in, change your email password, sign out of all other sessions, and review the recovery phone number, recovery email, and any forwarding rules or filters. A forwarding rule you didn't create is a sign someone is still reading your mail, so delete it.

If the account demands a text code you can't receive, use a backup code, an authenticator app, or the provider's account recovery process, and return to it once your number is back. The FTC's guidance is to change your account passwords once you regain access to your phone number, so work through the rest after the carrier has restored your line.

Protect your money

Call your bank and card issuers using the numbers printed on the back of your cards, tell them your phone number was hijacked, and review recent activity. The FTC advises checking credit card, bank, and other financial accounts for unauthorized charges or changes and reporting any you find to the institution. If you hold cryptocurrency, contact the exchange right away, because transfers generally can't be reversed once they go through.

Warn the people who might be targeted next

While someone else holds your number, anything that appears to come from you could be the attacker. Tell close family, friends, and coworkers through channels they already recognize, such as email, a message on social media, a call from a relative's phone, or in person, not to act on texts or calls from your number until you confirm it's back. Older relatives deserve a direct heads-up, since a money request "from you" is exactly what a hijacker might send.

Report it and write everything down

If you think the scammer also has your Social Security, credit card, or bank account number, the FTC directs you to IdentityTheft.gov for a step-by-step recovery plan. A police report can help when you dispute charges, and some banks ask for one. If your carrier won't help or ignores its obligations, the FCC encourages consumers to file complaints about providers that fail to follow these rules, which you can do through its Consumer Complaint Center.

Keep a running timeline: when service dropped, which alerts arrived and when, who you spoke with, ticket numbers, and every account you changed. It will save you time in every dispute that follows.

Cleaning Up in the Days After a SIM Swap

Getting your number back ends the emergency, not the incident. Work through these over the following days:

• Replace text codes where you can. Switch important accounts to an authenticator app or a security key, as the FTC suggests, and remove your phone number as a recovery option wherever the service offers another method. Our explainer on SMS security and encryption covers why text messages make a weak second factor.
• Audit every account a text code could reset. For each one, review the sign-in history, connected devices, recovery options, and saved payment methods, starting with anything tied to money.
• Check for accounts opened in your name. Ask your carrier to review every line and device order on your account. For a phone account someone opened in your name, the FCC's cell phone fraud guidance recommends a police report, an identity theft report with the FTC, notifying both your own carrier and the one holding the fraudulent account, and placing a fraud alert with one of the three major credit bureaus (Equifax, Experian, or TransUnion), which shares it with the other two. It also suggests checking your credit report at least once a year.
• Collect your documentation. Banks and police may want proof that your number was hijacked. The FCC's draft order notes that victims sometimes need this paperwork for law enforcement or financial institutions, which is why carriers must provide it on request.
• Turn on the locks now and set a new carrier PIN that you have never used anywhere else.
• Expect follow-up phishing. Whoever targeted you knows your details. Be especially skeptical of calls or texts claiming to be your carrier or your bank's fraud team, even ones that reference the incident.

Do you need a new phone number? Usually not. The weakness was the carrier account, not the number, and changing numbers means updating every bank, doctor, employer, and friend. A new number makes more sense if yours is posted widely and you keep getting targeted, or if the swap is part of a wider pattern of harassment. Our list of signs you should stop sharing your number can help you decide.

One more thing: don't blame yourself. A SIM swap succeeds by fooling a carrier's systems or staff, often with details you never knowingly shared. Reporting quickly and completely is what protects you now.

How to Make Yourself a Harder Target

Prevention deserves a full guide of its own, so here are only the essentials:

• Put a PIN or password on your carrier account, as the FTC recommends. Make it unique, and never share it with anyone who contacts you first.
• Turn on your carrier's free SIM change and number transfer locks, which the FCC's rules require carriers to offer. Our guide to what someone can do with your phone number lists the lock features the big US carriers provide.
• Move important accounts off text-message codes and onto an authenticator app or a security key.
• Share less. The FTC advises against posting your full name, address, or phone number on public sites where possible, because identity thieves use those details to get past security questions.

That last point is where number privacy helps. Every listing, dating profile, and group chat that shows your real number gives a stranger one more piece of the puzzle, and the privacy mistakes that expose phone numbers are easy to make. For people who don't need your real number, such as marketplace buyers, dating matches, or one-off contractors, a masked texting service like Ghost lets you send SMS without revealing it, so the number that guards your bank and email circulates less. Our explainer on phone number masking covers how that relay works.

Be clear about the limits, though. Masking hides your number from the people you text; it doesn't hide it from your carrier, and it can't lock your carrier account. The PIN and locks above are what stop a SIM swap. And don't move your verification codes to a masked or virtual number: Ghost is built for sending messages, not receiving codes, and account security belongs with an authenticator app, a security key, or your own protected line. Ghost's privacy summary spells out what it keeps and what it doesn't.

Frequently Asked Questions

Sources

• FTC: SIM Swap Scams: How To Protect Yourself
• FCC: Cell Phone Fraud
• FCC: Protecting Consumers from SIM Swapping and Port-Out Fraud (public draft, October 2023)
• FCC: SIM swap and port-out fraud rules, draft Report and Order (October 2023)