SIM Swap Attack: What It Is and How to Protect Yourself

A SIM swap attack (also called SIM hijacking) happens when your phone number is moved to a SIM card held by a scammer without your knowledge. Once the number changes hands, calls and text messages sent to it no longer reach your phone. They go to the attacker's device instead. In this article we explain how the attack works, how to spot it, and above all how to protect yourself.

What exactly is a SIM swap?

Your SIM card is your phone's identity on the carrier's network. Your number is not tied to the plastic card itself but to a record in the carrier's systems. Replacing a lost or damaged card is a perfectly legitimate and common request. A SIM swap is the abuse of that process: the fraudster tries to convince the carrier to transfer your number to a card they control, usually by posing as you with personal details collected elsewhere.

The target is not your phone but the accounts linked to your number. That means you can be a victim even when the device is in your hand, the screen is intact and nobody knows your passwords.

Why do attackers want your number?

Many services send an SMS code during login and "forgot password" flows. Whoever controls the number can see those codes, which puts email, social media, banking and other valuable accounts at risk.

There is an important distinction here. The weak point is less SMS technology itself and more the assumption that "whoever holds the number is the owner." If the number changes hands, every check built on that number changes hands too. That is also where the core idea of protection comes from: do not tie the security of your valuable accounts to a phone number alone.

What are the signs of a SIM swap?

No single sign is proof, but take it seriously when several appear together:

• Your phone suddenly shows "no service" or "emergency calls only" and a restart does not fix it.
• Calls and texts stop completely while other phones around you work normally.
• You get an unexpected "SIM change," "number transfer" or "new card" notice from your carrier.
• Password reset emails or new-device login alerts arrive that you did not trigger.
• Banking or wallet apps send notifications you cannot explain.

Keep in mind that signal loss is most often an ordinary network issue. Stay calm, but do not wait: use another device to call your carrier and confirm what is happening.

Protections on the carrier side

The options differ from one carrier to another, so treat the following as a checklist:

1. Protect your carrier account and app with a strong, unique password and turn on two-step verification if it is offered.
2. Ask whether you can add an extra password or PIN that is required for any SIM change on your line.
3. Keep carrier notifications (SMS, email, app) switched on so you notice a transfer attempt early.
4. Keep your contact details, such as email and an alternative phone number, up to date.
5. Set a PIN on the SIM inside your phone. It adds a layer if the phone is lost or stolen.

Never give your birth date, ID number or mother's maiden name to someone who calls you. If a caller says they work for your carrier, hang up and call back using the official customer service number.

Protections on the account side

Real resilience is built in the settings of your accounts:

• A stronger method than SMS: On critical accounts, use an authenticator app or a security key/passkey. These do not depend on your phone number.
• Make your email a fortress: Most account recovery runs through email. Give it a unique password and strong verification.
• Review recovery options: If a service relies only on your phone number for recovery, add an alternative method or, where possible, remove the number as a recovery route.
• Store backup codes: Keep the backup codes services give you offline in a safe place.
• Turn on bank alerts: Use transaction notifications and, where available, spending limits.

It is also worth reviewing from time to time which account is linked to which number. Old accounts you no longer use are links in the same chain.

Do not hand your real number to everyone

An indirect way to reduce SIM swap risk is to reduce how many places hold your main number. Every sign-up form adds it to another database, which widens the surface for both spam and targeted attacks. We covered this in detail in why you should not share your phone number everywhere.

A practical split works well: keep your main number for your bank, your email and the accounts that really matter. For low-risk situations such as quick trials, testing or a second account, you can use a single-use virtual number. You can check current countries and services on the pricing page.

To be honest about it: virtual numbers are single-use and do not give you permanent ownership. That makes them unsuitable for SMS-based two-step verification on an account you care about. After setting up an account, add an authenticator app and a recovery email. Some platforms may restrict virtual numbers, so follow the terms of the service you use.

What to do if you suspect a SIM swap

Speed matters. Follow this order:

1. Call your carrier from another phone, ask whether a SIM change was made, and have the line placed under protection.
2. From a safe device, change your email password first, then update critical accounts such as banking and social media.
3. Call your bank and ask them to temporarily protect your cards and accounts.
4. Sign out of all sessions and review your two-step verification methods again.
5. Report the incident to the relevant authorities and to your carrier in writing, and keep screenshots of any notices or alerts.

Frequently asked questions

Is a SIM swap the same as SIM cloning?

No. In a SIM swap, the number is moved to another card through the carrier's records. Cloning means copying the card itself and is far less common today. The protective logic is similar: do not rely on number-based verification alone.

Does an authenticator app protect against SIM swap?

Authenticator codes are tied to the app on your device, not to your phone number, so they do not travel to an attacker even if the number is taken over. Still, keep backup codes safe and protect the account's recovery route.

If my phone has no signal, is it a SIM swap?

Most of the time, no. Network outages, card problems or poor coverage are much more common. But if signal loss comes together with account alerts you do not recognize, contact your carrier immediately.

Does a virtual number remove SIM swap risk?

Not on its own. It helps you avoid sharing your main number needlessly, but the real protection is using non-SMS verification on valuable accounts. For more information, see our frequently asked questions page.