Your Phone Number Is a Weak Lock on a Lot of Doors

Think about how many of your accounts will let you reset the password with a text message. Email, bank, social media, maybe your crypto exchange. Now imagine someone else receiving those texts instead of you. That's SIM swapping, and it's nasty precisely because it doesn't involve hacking your phone at all.

Here's how it works. Your phone number isn't really tied to your phone. It's tied to a SIM (or eSIM) that your carrier has linked to your account. Carriers can move your number to a new SIM, which is a normal, useful thing when you lose your phone or upgrade. A SIM swap attack is just a criminal convincing your carrier to do that on their behalf. They call support or walk into a store, pretend to be you, and ask for your number to be moved to a SIM they control. Sometimes they have enough personal details from breaches and social media to pass the identity checks. Sometimes they target carrier employees with bribes or phishing. A close cousin, the port-out scam, does the same thing by moving your number to a different carrier entirely.

The first sign is usually your phone suddenly losing service for no obvious reason. By the time you notice, they're already requesting password resets and receiving your codes.

The good news is there's a lot you can do, and most of it is pretty quick.

Lock down your carrier account. This is the big one. Most carriers offer a separate account PIN or passcode required for changes, and many now offer a specific "number lock," "port-out protection" or "SIM protection" setting that blocks transfers until you turn it off yourself. Call or check your carrier's app or website and turn on everything they have. Use a PIN that's not your birthday or the last four of anything.

Stop using SMS as your second factor where you can. Switch important accounts to an authenticator app or, better, a passkey or a hardware security key. Those don't care who has your phone number. Start with your email, since it's the master key to everything else, then your bank, your password manager and anything holding money.

Remove your phone number as a recovery option on critical accounts, if the service lets you and you have another solid recovery method set up. Some services quietly allow SMS-based recovery even after you've set up an authenticator app, so check the recovery settings specifically, not just the 2FA settings.

Be stingy with your number. The fewer places it's public, the harder it is for an attacker to know which number belongs to you. Some people use a separate number (from a VoIP service, for example) for sign-ups and keep their real carrier number private. Just be aware that some banks don't accept VoIP numbers for verification.

Guard the details that answer security questions. Attackers posing as you will use your birthday, address, and anything else they can find. The less of that is floating around publicly, the harder their job gets.

Know what to do if it happens. If your phone suddenly shows "No Service" or "SOS only" and you're somewhere it normally works, and especially if you then get emails about password changes you didn't make, treat it as urgent. Contact your carrier immediately from another phone and tell them you suspect an unauthorized SIM change. Then work through your most important accounts from a trusted device: change passwords, check recovery options, sign out other sessions. Contact your bank too.

None of this requires paranoia. A carrier PIN and moving your email off SMS codes takes maybe half an hour, and it turns you from an easy target into a hard one. Attackers doing this are usually looking for the easy ones.