SIM Swap Attack Protection Guide: Stop Phone Hijacking

Stop a SIM Swap Before It Starts

The most effective protection against a SIM swap attack is removing your phone number as the weak link in your accounts: set a passcode or PIN with your mobile carrier, move two-factor authentication (2FA) off text messages and onto an authenticator app or hardware security key, and watch for the one warning sign that matters most, a sudden loss of cell signal you didn't cause. A SIM swap attack, also called SIM hijacking or a port-out scam, happens when a criminal convinces your mobile carrier to move your phone number onto a SIM card they control, usually by impersonating you with personal details gathered from data breaches, social media, or a phishing message. Once your number is theirs, they can intercept the SMS codes and password-reset links that guard your email, bank, and cryptocurrency accounts.

How Criminals Pull Off a SIM Swap

A SIM swap doesn't require stealing your physical phone. Attackers gather enough personal information, your name, date of birth, address, and the last four digits of your Social Security number, from data broker sites, old data breaches, or a convincing phishing text, then call or chat with your carrier's support line and claim to be you requesting a new SIM for a "lost phone." If the carrier's identity checks are weak, the rep activates the attacker's SIM and your number goes dead on your own device within minutes. From there, the attacker requests password resets on your email, bank, and exchange accounts, all of which land as text messages the attacker now receives instead of you.

According to the FBI's Internet Crime Complaint Center (IC3)SIM-swapping complaints resulted in roughly $68 million in reported losses in 2021, more than eight times the losses reported in 2018. The Federal Communications Commission (FCC) responded with new rules, adopted in November 2023, requiring wireless carriers to verify a customer's identity through a secure method before processing a SIM change or porting a number to another carrier; the FCC's rule phased in for major carriers through 2024. Those rules raise the bar, but they don't eliminate the risk, since a determined attacker with enough of your personal data, or a bribed insider, can still get past carrier controls.

Six Steps to Lock Down Your Phone Number

You can cut your risk sharply without replacing your phone or carrier. The steps below take most people under an hour and address both how attackers get in and what they do once they're in.

If You Think It's Happening Right Now

Act within minutes, not hours. Call your carrier from another phone or line and report the SIM swap; ask them to lock the account and reverse the port. Then, from a device you trust, change the passwords on your email and financial accounts and, wherever possible, revoke active sessions so the attacker is logged out. Check your bank, credit card, and any cryptocurrency exchange for unauthorized transactions, and place a fraud alert or credit freeze with the three credit bureaus. Bellator Cyber Guard's identity theft recovery steps guide walks through the full sequence, including filing reports with the FTC at IdentityTheft.gov and with the FBI's IC3.

If you hold cryptocurrency, treat a SIM swap as an emergency: many exchanges still allow SMS-based account recovery, which is exactly what SIM swap attackers target. See our crypto security guidance for exchange-specific protections. And if the attacker used your accounts to send phishing messages to your contacts, warn them directly, since your compromised number or email may now be attacking people who trust you.

Who Attackers Target Most

SIM swap attackers focus on people whose phone number unlocks something valuable: cryptocurrency holders, business owners with access to company financial accounts, and public figures or executives whose contact information is easy to find. They also target older adults, who may be less familiar with the warning signs and more likely to have a phone number listed publicly for years. If you're helping an aging parent or relative manage their accounts, Bellator's guide on how to protect elderly parents from online scams and identity theft covers the setup steps in plain terms. More broadly, our guide to how to protect your digital identity covers the account hygiene habits, like unique passwords and minimizing data exposure, that make you a harder target in the first place.

Old data breaches also feed SIM swap attempts, since attackers use leaked personal details to answer a carrier's verification questions. Checking whether your information is circulating is worth doing regularly; see dark web monitoring: what it is and why you need it for how that monitoring works and what it can and can't catch.