ThisCalculator

Everyday

SIM Swap Attacks: What They Are & How to Protect

Updated · Standard formula, shown below

SIM Swap Attacks: What They Are & How to Protect

SIM swap attacks (also called SIM splitting or SIM hijacking) are a type of account takeover where a criminal tricks your mobile carrier into transferring your phone number to a SIM card they control. Once the swap succeeds, the attacker receives your SMS text messages and phone calls, which lets them bypass two-factor authentication (2FA) codes sent by text and reset passwords on your email, bank, and social media accounts. Protecting your number means making it harder for someone to convince your carrier to move it, and reducing your reliance on SMS for security.

Background: Why SIM Swapping Exists

Mobile carriers have always allowed customers to move their number to a new phone or SIM card—that’s how you upgrade phones or switch carriers. The process is designed to be convenient, often requiring only a few pieces of personal information like your name, address, date of birth, or the last four digits of your Social Security number. Attackers gather this information through phishing emails, data breaches, social media oversharing, or even buying it on the dark web. With that data, they contact your carrier, impersonate you, and claim they lost their phone or need a new SIM. If the customer service agent doesn’t verify identity strictly enough, the swap goes through in minutes.

The attack isn’t new—it’s been reported since at least 2017—but it has become more common as more services rely on SMS for security. High-profile victims have lost cryptocurrency and had their social media accounts hijacked. The Federal Bureau of Investigation (FBI) and the Federal Communications Commission (FCC) have both issued public warnings about SIM swapping.

How a SIM Swap Attack Works Step by Step

Understanding the mechanics helps you see where you can intervene. Here’s a typical sequence:

  1. Information gathering: The attacker collects personal details about you from public records, phishing, or data breaches. They may even call your carrier pretending to be you to test what information is needed.
  2. Contacting the carrier: The attacker calls or visits a carrier store, claims to be you, and says their phone is lost or damaged. They provide the stolen personal details to pass identity verification.
  3. Carrier performs the swap: If the agent is convinced, they activate the attacker’s SIM card with your number. Your phone loses service immediately—often the first sign you notice.
  4. Attacker receives your texts and calls: Now any SMS-based 2FA codes, password reset links, or bank verification texts go to the attacker’s phone.
  5. Account takeover: The attacker uses those codes to reset passwords on your email, then uses email to reset passwords on other accounts. They may drain bank accounts, steal cryptocurrency, or lock you out of your own accounts.

Sometimes attackers also use a port-out—moving your number to a different carrier entirely—which can be even harder to reverse.

How to Protect Your Number: Practical Steps

No method is 100% foolproof, but a combination of carrier-level protections and personal habits dramatically reduces your risk.

  • Set up a PIN or password with your carrier: Most major carriers (AT&T, Verizon, T-Mobile) allow you to add a unique PIN or passcode to your account that must be provided before any account change. Call your carrier and ask for a “port-out PINâ€� or “account lock.â€� Keep this PIN secret and don’t use the same one for other accounts.
  • Use an authenticator app instead of SMS: Apps like Google Authenticator, Authy, or Microsoft Authenticator generate time-based codes on your device that don’t rely on your phone number. Enable this for any service that offers it, especially email and financial accounts.
  • Use a physical security key: For high-value accounts (Google, Facebook, banking), a hardware key like a YubiKey provides the strongest protection. It requires the physical key to log in, so a SIM swap alone won’t help an attacker.
  • Remove your phone number from recovery options: Where possible, use an email address or authenticator app as your recovery method instead of SMS.
  • Monitor your phone for loss of service: If your phone suddenly shows “No Serviceâ€� or “SOS onlyâ€� while you’re in an area with good coverage, contact your carrier immediately—it could be a SIM swap in progress.
  • Keep personal information private: Avoid sharing your full name, birthdate, and phone number publicly on social media. Use privacy settings to limit who can see your info.
  • Use unique passwords and a password manager: If an attacker gains access to one account, unique passwords prevent them from getting into others. A password manager also helps you avoid reusing passwords.

Common Problems and Misconceptions

One common misconception is that SIM swapping only happens to celebrities or cryptocurrency holders. In reality, anyone with a phone number can be a target, especially if they have a lot of personal information exposed online. Another misconception is that having a passcode on your phone’s lock screen protects you—it doesn’t, because the attack happens at the carrier level, not on your device.

A frequent problem is that carrier customer service representatives are not always trained to spot social engineering. Even with a PIN, some employees may accept other forms of verification. That’s why layered protection is essential.

Another issue: many people don’t realize that SMS 2FA is the weakest form of two-factor authentication. It’s better than no 2FA, but it’s vulnerable to SIM swapping. The National Institute of Standards and Technology (NIST) has even recommended phasing out SMS-based 2FA in favor of app-based or hardware methods.

Comparisons: SIM Swap vs. Other Attacks

SIM swapping is often confused with phishing or malware attacks, but they’re distinct:

  • Phishing: A scam email or text tricks you into entering your credentials on a fake website. The attacker gets your password directly, but doesn’t need to control your phone number.
  • Malware: Malicious software on your device can steal passwords or intercept SMS codes directly. SIM swapping doesn’t require any malware on your phone—it works by hijacking your number at the carrier.
  • Port-out fraud: This is a type of SIM swap where the attacker moves your number to a completely different carrier. It’s often harder to reverse because your original carrier loses control of the number.

Understanding the difference helps you know which protections to apply. For example, antivirus software won’t stop SIM swapping, but carrier PIN will.

Costs and Consequences

The financial cost of a SIM swap can be devastating. Victims have reported losing thousands of dollars from bank accounts, cryptocurrency wallets, and retirement accounts. Beyond money, there’s the cost of time spent recovering accounts, contacting credit bureaus, and dealing with identity theft. Some victims are locked out of their email for weeks, losing irreplaceable photos and documents.

There’s also an emotional cost—the feeling of violation and the fear of recurrence. While carriers may reimburse some unauthorized charges, they are not always legally required to, and the process can be slow.

What to Do If You’re a Victim

If you suspect a SIM swap, act quickly:

  1. Contact your carrier immediately to regain control of your number. Have your account PIN ready.
  2. Change passwords on critical accounts (email, bank, social media) using a different device or Wi-Fi network.
  3. Enable authenticator app 2FA on all accounts that support it, and remove SMS as a recovery method.
  4. Contact your bank and credit card companies to flag fraudulent transactions.
  5. File a complaint with the FCC and your local police department. The FBI’s Internet Crime Complaint Center (IC3) also accepts reports.
  6. Consider a credit freeze to prevent the attacker from opening new accounts in your name.

Frequently Asked Questions

Can a SIM swap happen without the attacker knowing my personal info?

In most cases, the attacker needs at least some personal details to pass verification. However, data breaches have exposed massive amounts of personal information, so it’s possible for an attacker to buy your info online. That’s why carrier PINs are so important—they add a secret that isn’t in any database.

Is SMS 2FA better than no 2FA?

Yes, SMS 2FA is better than nothing, but it’s the weakest form. If an attacker can swap your SIM, they can intercept the codes. Use an authenticator app whenever possible, and a hardware key for the most important accounts.

Can I still use my phone number for 2FA if I have a carrier PIN?

Yes, the PIN doesn’t stop SMS 2FA from working on your phone. It just makes it harder for someone else to move your number to their SIM. You can keep using SMS 2FA, but it’s still vulnerable to other attacks like SS7 flaws, so app-based 2FA is safer.

Do all mobile carriers offer a PIN or account lock?

Most major carriers in the US and many worldwide offer some form of account PIN or port-out lock. Contact your carrier to see what’s available. If they don’t, consider switching to a carrier that does—or at least use app-based 2FA for all sensitive accounts.

What’s the difference between a SIM swap and a port-out?

A SIM swap moves your number to a new SIM card on the same carrier. A port-out moves your number to a different carrier entirely. Both achieve the same goal for an attacker: they control your number. Port-outs can be harder to reverse because your original carrier no longer has the number.

Can I detect a SIM swap before it’s too late?

Often the first sign is your phone losing service. If that happens, call your carrier immediately. Some carriers also send a notification when a SIM change is requested—make sure you have that alert enabled. If you receive a text about a SIM change you didn’t request, contact your carrier right away.

Related

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.