SIM-Swap Scams: How to Protect Your Phone Number and Accounts

What to Do in the Moment

If you suspect your phone number has been hijacked, you must act immediately. Do not wait to see if your service returns.

1. Contact Your Wireless Carrier Immediately: Call your carrier from another phone or visit a physical retail store. Tell them your service has stopped unexpectedly and ask if a SIM change or port-out has been processed on your account.
2. Secure Your Financial Accounts: Log into your bank, credit card, and investment accounts from a computer or a trusted secondary device. Change your passwords immediately.
3. Disable SMS Two-Factor Authentication: Switch your security settings away from text-message verification. If possible, transition to an authenticator app or a physical security key.
4. Check for Unauthorized Activity: Review your sent emails, bank transactions, and login history for any signs of unauthorized access.

How the Scam Works

SIM swapping and port-out fraud are two highly disruptive techniques that bad actors use to take control of your mobile number without ever physically touching your phone (FCC Report and Order). Scammers target your phone number because it is frequently used as a convenient way to verify your identity for email, social media, and financial accounts (FCC Report and Order).

• SIM Swapping: A bad actor convinces your wireless provider to transfer your mobile service and phone number from your device to a device containing a SIM card in the scammer's possession (FCC Report and Order).
• Port-Out Fraud: The scammer poses as you, opens an account with a different wireless carrier, and arranges to transfer (or "port") your phone number to the new account under their control (FCC Report and Order).

Once the scammer controls your phone number, they can intercept the one-time passcodes sent via text message or phone call to bypass security checks and log into your bank accounts, email, or cryptocurrency wallets (FCC Report and Order). This tactic is often paired with other sophisticated schemes, such as bank-impersonation call and SMS scams, to drain victims' assets.

The Numbers: Billions in Losses

According to the FBI’s 2025 Internet Crime Report, cyber-enabled crimes defrauded Americans of nearly $21 billion (FBI). Cryptocurrency complaints accounted for the highest losses, with 181,565 complaints totaling more than $11 billion (FBI). Additionally, older adults are heavily targeted; Americans over 60 reported approximately $7.7 billion in losses to cyber-enabled fraud in 2025, representing a 37% increase from the previous year (FBI).

Red Flags of a SIM Swap

Recognizing the warning signs early can help you contain the damage before scammers access your financial accounts:

• Sudden Loss of Service: Your phone unexpectedly displays "No Service," "SOS Only," or fails to connect to your cellular network in an area where you normally have strong reception.
• Unprompted Notifications: You receive a text message or email from your wireless carrier stating that your SIM card has been updated, your password has changed, or a port-out request has been initiated, even though you made no such request.
• Inability to Log In: You are suddenly locked out of your email, social media, or financial accounts because your passwords or security settings have been altered.

Three Defenses: Do All Three

To protect yourself from future attacks, implement these three security measures on your mobile account:

1. Enable an Account Lock

Under Federal Communications Commission (FCC) rules, wireless providers must offer customers the option to lock their accounts to block the processing of SIM changes and port-out requests (FCC Fact Sheet). Contact your carrier and explicitly request a "SIM lock" or "port freeze" to prevent unauthorized transfers.

2. Move Away from SMS Verification

Whenever possible, avoid using your phone number to receive security codes. Instead, use dedicated authenticator apps (such as Google Authenticator, Microsoft Authenticator, or Duo) or physical security keys. These tools generate codes directly on your physical device and cannot be intercepted through a SIM swap.

3. Establish a Strong Carrier PIN

Set up a unique, complex PIN or passcode with your wireless provider that must be provided verbally or online before any changes can be made to your account. Avoid using easily guessable numbers like your birth year, address, or the last four digits of your Social Security number.

What to Do If the Money Is Already Gone

If a scammer has successfully accessed your accounts and stolen funds, take these steps to document and report the crime:

1. Document the Details: Document the dates of contact, methods of payment, where funds were sent, and a thorough description of the interactions (FBI).
2. File a Complaint with the FBI: Submit a detailed report to the Internet Crime Complaint Center at ic3.gov as soon as possible (FBI). Include the scammer's methods of contact, payment methods, and where the funds were sent.
3. Contact Your Financial Institutions: Notify your bank, credit card issuers, or cryptocurrency exchanges immediately to freeze compromised accounts and dispute the fraudulent transactions.

Who Is Most at Risk?

While anyone can be targeted, older adults and people holding cryptocurrency report the highest losses to these types of cyber-enabled fraud (FBI). Scammers also use advanced tactics like AI voice clone scams and deepfake video call scams to impersonate loved ones or public figures, relying on pressure techniques to defraud victims (FBI).

Quick Answers

What is the difference between a SIM swap and port-out fraud?

In a SIM swap, a scammer transfers your service to a new SIM card on their own device using your existing carrier. In port-out fraud, the scammer transfers your phone number to an entirely different wireless carrier (FCC Report and Order).

How do scammers get the information needed to swap my SIM?

Scammers often gather personal details through phishing or personal data breaches (FBI). They use this information to trick customer service representatives into believing they are you.

Does the law protect me from SIM swapping?

Yes. The FCC has established rules requiring wireless providers to use secure customer authentication methods before processing SIM changes or port-outs, and to immediately notify you when these requests are made (FCC Report and Order).