SIM swap scams: how they work, and how to lock your number

A SIM swap is a scam in which a criminal talks your wireless carrier into moving your phone number to a phone the criminal controls. Your calls and texts then go to the thief, including the one-time codes that banks and other sites send by text. You can lock your number for free with your carrier, and you can stop relying on texted codes. This guide shows how, and what to do if it already happened.

What a SIM swap and a port-out are

A SIM (subscriber identity module) is a physical or virtual card that ties a phone to a mobile network. The Federal Communications Commission (FCC) describes two scams that aim at your number:

• SIM swap. A bad actor convinces your wireless provider to transfer your mobile service and number from your phone to a phone the bad actor holds.
• Port-out fraud. A bad actor, posing as you, opens an account with a different provider. Then the bad actor arranges for your number to be transferred, or “ported out,” to that new account.

The FCC says both happen without the thief ever holding your phone. Phone numbers are often used to prove who you are, it explains, for accounts at carriers, email and social media companies, banks, and online stores. With your number, a thief may be able to get into those accounts, change the logins, and drain bank accounts, the FCC says.

How common is it

The FBI’s Internet Crime Complaint Center (IC3) counted 971 SIM swap complaints in 2025, with $17.4 million in reported losses. That was out of 1,008,597 complaints of all kinds. In 2024 it counted 982 complaints and $26.0 million. In 2023 it counted 1,075 complaints and $48.8 million. These are only the cases people reported. The IC3 defines a SIM swap as using social engineering, which means tricking people, against mobile service providers to move a victim’s phone service to a device the criminal holds.

The signs

The FCC says losing service is typically the first sign: the phone goes dark or allows only 911 calls. The FTC adds a second sign: an unexpected notice from your carrier that your SIM was activated on a new device. Verizon says you may not know until your phone stops working.

A lost signal can have ordinary causes, such as an outage. Treat it as a warning if it comes with a carrier message you did not expect, or with alerts from your accounts.

Lock your number

1. Set a PIN on your carrier account. The FTC says a PIN or password on your cellular account could help protect it from unauthorized changes. The Cybersecurity and Infrastructure Security Agency (CISA) says most carriers offer an extra PIN that is required for sensitive steps such as moving your number. Never share the PIN. Verizon says it will never ask you for a password, PIN, Social Security number or payment information.
2. Turn on your carrier’s lock. Verizon, AT&T and T-Mobile each offer one, and each calls it free. The table shows what each carrier says its lock blocks.
3. Protect your carrier login. Use a unique password, and turn on two-factor authentication, which asks for a second proof that it is you. Verizon gives this advice on its SIM swap page. Our password generator can make a strong password.
4. Share less in public. The FTC says to limit the personal information you post, because thieves can use it to answer security questions.

Carrier	Feature	What the carrier says it blocks
Verizon	SIM Protection	Any step that needs a new SIM, including SIM swaps, device upgrades and bring-your-own-device transactions.
Verizon	Number Lock	Moving your number to another carrier.
AT&T	Wireless Account Lock	SIM and eSIM swaps, device upgrades, number changes, and transfers of your number to or from another carrier. It also blocks billing changes.
T-Mobile	SIM Protection	Moving your number to another device.
T-Mobile	Port Out Protection	Transferring your lines to another carrier.

Where to turn them on: Verizon, in the My Verizon website or app, under security settings. AT&T, only in the AT&T app, under the person icon. T-Mobile, in the T-Life app or on T-Mobile.com. T-Mobile says Port Out Protection must be added to each line.

On price, Verizon says both of its features come “at no cost to you.” AT&T calls its lock a free security feature. T-Mobile calls SIM Protection free for postpaid customers, and Port Out Protection free for postpaid, business, prepaid and Metro customers. AT&T’s page was last updated April 22, 2026. Verizon’s and T-Mobile’s pages show no date, so menu names may have changed. Follow your carrier’s own page. If you use a smaller carrier, ask whether it offers a PIN or a lock.

Stop relying on texted codes

A lock protects your number. It does not make a texted code safe. The FTC says texted or emailed codes are “the least secure type of two-factor authentication,” and suggests an authenticator app or a security key. An authenticator app is an app that makes a short-lived code on your phone, so the code does not travel by text. A passkey lets you sign in without a password or a texted code. See Passkeys vs passwords.

CISA wrote its guidance mainly for senior officials and others who are likely targets, but says it is applicable to all audiences. It recommends that you:

1. List your valuable accounts, including email and social media. For the most valuable ones, CISA recommends FIDO sign-in, meaning a hardware security key or a passkey. It calls passkeys an acceptable alternative to a key. For less valuable accounts, it suggests an authenticator app.
2. Turn the text option off once the new method works. CISA warns that signing up for an authenticator does not remove the text option, and a leftover text option can be a weak fallback.
3. Know the limit. CISA says authenticator codes are better than texts but can still be phished. It says only FIDO authentication is phishing-resistant. Phishing is a trick that gets you to type a code into a fake site.

If it happens to you

1. Contact your carrier right away, from another phone or a computer. The FTC says to do this first, to take back your number. Verizon’s page lists *611 and 1-800-922-0204 for this. Ask for a written record of the fraudulent change. The FCC reports complaints from customers whose providers refused to give them documentation, which made it hard to pursue claims with their banks or law enforcement.
2. Secure your email first, then your other accounts. Change the passwords from a safe device, and switch off texted codes. See Am I hacked? for the order to follow.
3. Check your bank and card accounts. The FTC says to look for charges or changes you did not make, and to report them. Call the bank’s fraud department using the number on your card.
4. Protect your identity. If your Social Security number or bank account number may be exposed, follow Identity stolen? What to do, in order, and freeze your credit.
5. Report it. The FBI’s IC3 is the central place to report cyber-enabled crime. The IC3 says it will never contact you for information or money.

What the FCC rules do, and do not do yet

On November 15, 2023, the FCC adopted rules for SIM swap and port-out fraud. They tell wireless providers to check a customer’s identity with secure methods before a SIM change or port-out, to notify customers about these requests, and to offer a lock that blocks them. They also call for a clear process for customers to report fraud.

But providers do not have to comply yet. On July 5, 2024, the FCC’s Wireline Competition Bureau said compliance will not be required until the Office of Management and Budget finishes a paperwork review and the FCC announces the date in the Federal Register. The eCFR, the government’s online rulebook, was up to date as of October 23, 2026. It still says compliance with 47 CFR 52.37 “will not be required until this paragraph is removed or contains a compliance date.” Do not wait for the rules. Turn on the lock your carrier already offers.

What can go wrong

• A PIN alone may not be enough. Complaints filed with the FCC include claims that carriers completed SIM changes even though the customer had set a PIN. Add the lock and a stronger second step.
• Locks block honest changes too. Verizon says you must turn Number Lock off to move to another carrier, and SIM Protection off to upgrade. T-Mobile says you get an error if SIM Protection is on when you change SIMs. Turn the lock back on afterward.
• Some sites still use text codes to recover an account. CISA says that may be hard to avoid. Keep your carrier lock on.
• A fake “carrier” message. Do not reply to calls, emails or texts that ask for personal information, the FTC says. Contact the company using a number or website you know is real.

What to do now

1. Set a PIN on your carrier account, and turn on its free lock (Verizon, AT&T or T-Mobile).
2. Make your email account the first to switch from texted codes to an authenticator app or passkey.
3. Turn off the text option on accounts where the new method works.
4. Save your carrier’s fraud line, and know the signs: sudden loss of service, or a notice about a new SIM.
5. If it happens, call your carrier from another device, then secure your email and bank accounts.