Your phone number looks like contact information. In practice it is closer to a master key. It is the fallback route for password resets on your email, the second factor on your bank account, and the recovery path for the accounts you would struggle most to lose. Move that number onto someone else's SIM card and they inherit a remarkable amount of your digital life.
That is SIM swapping. It requires no malware, no cracked password, and no technical genius — just a convincing phone call and a carrier employee who believes it.
What Actually Happens During a SIM Swap
A SIM swap is a porting trick, not a hacking trick. Carriers move numbers between SIM cards all day long: people upgrade handsets, switch networks, lose devices, buy new ones. The attacker's job is simply to convince your carrier that they are you and that they need your number moved onto a new SIM.
To do that, they need to pass whatever verification the carrier uses. That might mean your name, address, date of birth, the last digits of an ID number, your account PIN, or details from a recent bill. Much of this sits in breach dumps, data broker listings, and your own social media history. Once the story is convincing enough, the number is ported.
Your phone goes dead. Theirs starts receiving your calls and texts. That includes every one-time passcode, every "confirm this login" message, and every password reset link sent by SMS.
Why SMS Codes Fail as a Second Factor
SMS two-factor authentication was a real improvement over passwords alone, and it still blocks plenty of automated attacks. Its weakness is structural: the code travels to a device identified by a phone number, and phone numbers can be reassigned by a support representative who is having a busy afternoon.
So the security of your second factor rests on carrier verification procedures, which are human, inconsistent, and occasionally bypassed by an insider. Attackers also use pressure tactics — a frantic caller claiming an emergency, a plausible-sounding story about a stolen phone.
SMS codes don't fail because the math is weak. They fail because the phone number isn't a secret you control; it's an asset your carrier can move on request.
There is one more problem. Password reset flows tend to loop back to the same channel. If your email account can be recovered by text, and your bank can be recovered by email, then one ported SIM can unravel the whole chain in minutes.
The Attack, Step by Step
- Reconnaissance. The attacker collects your personal details from breaches, public records, and social profiles, then looks for your mobile carrier — often revealed by a number lookup or a post complaining about coverage.
- Contact with the carrier. They call support or visit a store, claiming a lost or broken phone, and request a new SIM or an eSIM activation.
- The port. If verification succeeds, the number moves. You lose service; they gain your messages.
- Account takeover. They trigger password resets on email, banking, social media, and any wallet or exchange account tied to your number.
- Exploitation. Money moves, accounts get locked, and the recovery process is deliberately complicated by the attacker changing the contact details.
Warning Signs You've Been Swapped
- Your phone abruptly shows no service, "No SIM," or "SIM not provisioned," and restarting doesn't help.
- Calls go straight to voicemail and texts stop arriving.
- You get a port-out confirmation message or email you never requested — read these, they matter.
- Password reset emails or login alerts appear for accounts you weren't touching.
- Contacts say they received odd messages or calls from your number.
If several of these line up, treat it as an active emergency rather than a network glitch.
Stronger Authentication Than a Texted Code
The fix is to stop treating SMS as your security layer. Move to methods that don't depend on a phone number being yours.
Authenticator apps
Apps that generate time-based codes work offline and live on a device you already control. They aren't perfect — a synced cloud backup can be reached if your main account falls — but they eliminate the port-out shortcut entirely. When you set one up, save the backup codes somewhere offline: printed, or in a password manager you trust.
Hardware security keys and passkeys
A physical key or a passkey tied to your device is the strongest option widely available today, because the credential is bound to a specific origin and can't be read off a screen by someone on the other end of a phone call. If your email and banking providers support them, use them there first.
Order of operations
Protect in this sequence: your primary email account, then your password manager, then financial and crypto accounts, then social media. Whoever controls your email can usually reset everything else, so it deserves the strongest factor you have.
Lock Down Your Carrier Account
Many carriers offer a number lock, port freeze, or port protection feature, and most let you set a separate account PIN or passcode. Ask for both, then ask what is required to remove them. Some carriers will only lift a port freeze with an in-store visit and photo ID, which is exactly what you want.
Two habits make this stick. Use a PIN that isn't your birth year or the last digits of anything. And review your carrier account occasionally, because settings and support policies change.
What to Do Next
Tonight, log into your mobile account and turn on whatever port protection is offered. Tomorrow, switch your email and your password manager off SMS and onto an authenticator app or a security key. Store backup codes offline. Then move on to your bank.
If your number is swapped right now: call your carrier from another phone, ask them to reverse the port, and change your email password from a device that isn't relying on the hijacked number. Warn your contacts that messages from your number may not be you. If money or identity documents are involved, contact your bank and, where relevant, your local authority — and consider taking advice from a professional rather than working it out alone under pressure.
Photo: Jacob / Pexels
