SIM Swap Scams: How They Work and How to Protect Yourself

By 2Phon Team · October 27, 2026 · 10 min read

In a SIM swap scam, a criminal gets your carrier to move your phone number to their SIM, then uses your verification codes to break into your accounts. Here are the warning signs, what to do fast, and how to lock your number down.

A SIM swap scam is when a criminal tricks or bribes your mobile carrier into moving your phone number to a SIM card or eSIM they control. Once that happens, your calls and SMS verification codes go to their phone. They then use those codes to reset your passwords and take over your email, bank and crypto accounts.

You can protect yourself without being a security expert. The steps that matter most are locking your carrier account and moving important logins off text-message codes. It also helps to keep your main number out of places where strangers can find it. This guide explains how a SIM swap attack works, the warning signs, what to do in the first hour, and the protections that actually help. We'll also cover where a second number from an app like 2Phon helps, and where it doesn't.

What is a SIM swap scam?

A SIM swap is a takeover of your phone number, not of your phone. The criminal never touches your device. They go to your carrier, pretend to be you (or pay someone on the inside), and have your number moved to a SIM they hold.

The FBI's Internet Crime Complaint Center (IC3) defines it as "the use of unsophisticated social engineering techniques against mobile service providers to transfer a victim's phone service to a mobile device in the criminal's possession" (IC3 2025 Internet Crime Report, checked 2026-10-27).

There is a close cousin called port-out fraud. Instead of a new SIM at the same carrier, the criminal transfers your number to a different carrier. The FCC treats the two together, because both "take control of consumers' cell phone accounts … without ever gaining physical control of a consumer's phone" (FCC rules, Federal Register, December 8, 2023).

How does a SIM swap attack work?

A SIM swap usually runs in four steps, and only one of them happens at your carrier. The rest depend on accounts that trust a text-message code.

1. They collect details about you

   Your name, phone number, address, date of birth and sometimes the last digits of your ID number. Much of this comes from data leaks, people-search sites and social media.

2. They get your number moved

   The FBI describes three routes: impersonating you to the carrier, paying a carrier employee, or phishing employees to get into carrier systems (FBI IC3 public service announcement, February 8, 2022).

3. Your codes start going to them

   Your phone loses service. Calls and SMS codes sent to your number now ring and arrive on the criminal's device.

4. They reset your passwords

   They tap "Forgot password" on your email, bank or crypto exchange. They receive the code and lock you out. Your email account is often the first target, because it resets everything else.

How common are SIM swap scams?

SIM swaps are a smaller crime by volume, but each one can be expensive. In 2025, the FBI's IC3 received 971 SIM swap complaints with about $17.4 million in reported losses. That compares with 982 complaints in 2024 and 1,075 in 2023 (IC3 2025 Internet Crime Report). These are only the cases people reported to the FBI, so the true number is likely higher.

Signs of a SIM swap: how to tell if it's happening

The clearest sign of a SIM swap is that your phone loses service for no reason. The FTC describes it as "no data, no text messages, no phone calls" (FTC: SIM swap scams). Watch for:

• No Service or SOS in the status bar while you're somewhere with normal coverage, and restarting doesn't fix it.
• A carrier notice you didn't expect, such as an email or message saying your SIM was activated on a new device, or that a number transfer was requested. Many carriers send these alerts, and the FCC's 2023 rules call for carriers to notify customers about SIM change and port-out requests.
• Password reset emails you didn't ask for, especially several in a row.
• Being locked out of your email, social or bank accounts, with a password that suddenly doesn't work.
• Bank or exchange alerts about logins, new payees or transfers you don't recognize.

What to do if you think your SIM was swapped

Act within minutes, and start with your carrier. Every minute the criminal holds your number, they can receive more reset codes.

The FBI advises victims to contact their carrier immediately, change their passwords, alert their financial institutions, and report to the IC3 and local law enforcement. The FTC adds checking your financial accounts for charges you don't recognize.

How to protect yourself from SIM swap fraud

SIM swap protection comes in two layers. The first makes it hard to move your number. The second makes a moved number much less useful. You want both.

Add a PIN or passcode to your carrier account

A carrier account PIN is the single most recommended step. The FTC lists it first, and it means anyone who calls or walks into a store as "you" needs a secret that isn't in a data leak. Pick a PIN that isn't your birthday, your address or the last digits of your phone number. Don't reuse your phone's unlock code or your bank PIN.

Turn on your carrier's SIM and number-transfer lock

Many carriers now offer a switch that blocks SIM changes and number transfers until you turn it off. The rules the FCC adopted in 2023 call for wireless providers to offer all customers, at no cost, "the option to lock or freeze their account" against SIM changes and port-outs. Carriers don't all offer it the same way yet, so check what yours has today.

Names differ by carrier. Examples from the carriers' own pages, as listed on 2026-10-27:

• Verizon has two settings. SIM Protection "blocks anyone from moving your mobile number to another device" and Number Lock "blocks anyone from moving your mobile number to another carrier," both until you turn them off. You manage them in My Verizon (Verizon account security).
• AT&T has Wireless Account Lock, "a free security feature" in the AT&T app that "disables specific transactions and account changes" while it's on (AT&T support).

On another carrier, search its help pages for "SIM protection", "number lock", "port-out protection" or "account lock". Remember to switch the lock off before you upgrade your phone or move to a new eSIM yourself, then switch it back on.

Move important accounts off SMS codes

This is what limits the damage if a swap gets through anyway. A text-message code goes to whoever holds your number. An authenticator app, a passkey or a security key stays on your device. The FTC notes that "text message verification may not stop a SIM card swap" and recommends an authentication app or security key for sensitive accounts. The FBI likewise recommends biometrics, physical security tokens or standalone authenticator apps instead of SMS alone.

Start with the accounts that can reset other accounts:

1. Your main email. Add a passkey or an authenticator app, and save the backup codes somewhere safe.
2. Your Apple Account or Google Account. Check which phone numbers and emails are listed for recovery.
3. Banks, payment apps and crypto exchanges. Use the strongest option each one offers. If SMS is the only choice, the carrier PIN and lock are what protect that number, so don't skip them.
4. Your password manager, if you use one.

For more on which number belongs on which account, see our guide to which phone number to use for verification.

Share your main number in fewer places

The fewer places that know your main number, the less there is to link it to you. The FBI advises limiting the personal information you post online, including your phone number and address. The FTC makes the same point: identity thieves use public details to answer security questions.

In practice, that means keeping your main number off marketplace listings, dating profiles, shop sign-ups and contest forms. We cover the wider risks in what someone can do with your phone number.

Know what a SIM PIN on iPhone does (and doesn't)

A SIM PIN on your iPhone protects your physical SIM or eSIM, not your carrier account. It locks the SIM whenever the phone restarts or the card is removed, so a thief can't use it in another phone. Apple explains how to set it up in Settings › Cellular, and warns not to guess a forgotten PIN, because wrong attempts can lock the SIM permanently (Apple Support). It's worth having, but it does nothing against a criminal who calls your carrier. That's what the account PIN and lock are for.

Be careful with calls "from your carrier"

Criminals sometimes call pretending to be your carrier or your bank and ask for your account PIN or a code you just received. The FBI's advice is to hang up and call your carrier's customer service number yourself. No real carrier or bank needs a code you received. Our guide to receiving verification codes safely covers code scams in more detail.

Can a second phone number protect you from SIM swaps?

Not directly. A second number reduces how exposed your main number is, but it doesn't lock your carrier account or replace app-based 2FA. Here is where each measure helps:

The honest case for a second number is simple. Your main number is the one your carrier, bank and email know. Every time you type it into a shop form, a marketplace listing or a dating app, it lands in one more database that can leak. A second number keeps your main number out of those places, so there's less to connect it to your name.

2Phon is an iPhone app that gives you a real second phone number from dozens of countries. It's a real mobile number, not VoIP, so popular apps accept it for verification codes, by SMS or by voice call. You can also make and receive real calls, and the people you call see your 2Phon number, not your personal one.

Be clear about what it isn't for:

• Don't move your bank or main email to it as a SIM swap fix. Your 2Phon number is yours while your subscription is active. If it lapses, the number may be released to someone else. Critical accounts belong on an authenticator app or passkey, with a recovery number you'll keep for years.
• It doesn't send texts. 2Phon receives verification codes and handles calls. It doesn't send SMS.
• It's iPhone only. There's no Android app.

If you want a separate number for sign-ups, listings and strangers, get 2Phon on the App Store. Here's more on what a second phone number is and how people use one.

The short version

A SIM swap scam steals your phone number at the carrier, then uses your text-message codes to take over your accounts. Sudden No Service and unexpected carrier notices are the signs to act on, and your first call goes to your carrier. To protect yourself, add a carrier PIN and turn on the SIM and number-transfer lock today. Then move your email and bank to an authenticator app or passkey, and stop handing your main number to every form that asks for it.

Frequently asked questions

What is the difference between a SIM swap and port-out fraud?

In a SIM swap, the criminal gets your number moved to a new SIM or eSIM at your own carrier. In port-out fraud, they transfer your number to a different carrier. The result is the same either way. Your calls and verification codes go to them.

Can a SIM swap happen with an eSIM?

Yes. The scam targets your carrier account, not the card in your phone, so a criminal can ask for your number on a new eSIM the same way as on a plastic SIM. The FCC's rules count both physical and virtual SIMs. A carrier PIN and a SIM or number lock protect against both.

Can someone SIM swap me even if I have a carrier PIN?

It's much harder, but not impossible. The FBI notes that criminals also bribe or trick carrier employees, so add your carrier's SIM and number-transfer lock too. Most important of all, move your key accounts to an authenticator app or passkey.

Does a second phone number stop SIM swap attacks?

No. A second number keeps your main number out of sign-up forms and public listings, which leaves attackers less to work with. It doesn't lock your carrier account. For banking and email, use an authenticator app or a passkey.

Can I send text messages from a 2Phon number?

No. 2Phon receives verification codes and makes and takes real calls. It doesn't send SMS or MMS of any kind.