SIM Swap Attacks Are Surging: How Scammers Steal Your Phone Number

You wake up, grab your phone, and see "No Service" where your signal bars should be. You assume it's a network hiccup. By the time you realize it's not, someone on the other side of the country is already resetting your bank password using your phone number.

That's a SIM swap attack. And in 2024, the FBI's Internet Crime Complaint Center logged nearly $26 million in reported losses from this single type of fraud. The real number is almost certainly higher — most victims don't realize what happened until the damage is done.

Here's how SIM swapping works, what the warning signs look like, and how to make sure it doesn't happen to you.

How a SIM Swap Attack Actually Works

A SIM swap doesn't require a hacker to touch your phone. It doesn't involve malware, and it doesn't exploit a software vulnerability. It targets something much simpler: your mobile carrier's customer service process.

The attack follows a predictable sequence. First, the scammer gathers personal information about you — your name, phone number, date of birth, the last four digits of your Social Security number. This data often comes from previous data breaches (the kind that have exposed over 16 billion credentials in the last year alone), social media, or targeted phishing messages like the fake Amazon recall texts that have been circulating recently.

Armed with those details, the attacker contacts your wireless carrier — by phone, online chat, or sometimes even walking into a retail store. They pose as you. They tell the representative that they lost their phone or got a new device, and they need to transfer service to a different SIM card.

If the carrier's verification process fails — and it does, more often than most people realize — the rep activates the new SIM. Your phone goes dead. The attacker's phone starts receiving your calls and texts.

This is where it gets dangerous. Every two-factor authentication code sent by text now goes directly to the attacker. Password resets for your email, banking apps, cryptocurrency wallets, even your Apple Pay account — all routed to a phone you don't control.

In March 2025, an arbitrator ordered T-Mobile to pay $33 million after a single SIM swap enabled attackers to drain over 1,500 Bitcoin from a customer's wallet. The victim had an eight-digit security PIN on his account. The attackers bypassed it anyway.

Why SIM Swapping Is Getting Worse

Three things are converging to make SIM swap attacks more effective than ever.

Massive personal data exposure. Billions of credentials and personal records are circulating on dark web marketplaces. Attackers don't need to research you — your information is already packaged and available for purchase. That's exactly why it matters when companies collect more data than they need, whether it's your phone's background app activity or your airline booking details.

Overreliance on SMS-based verification. Most banks, email providers, and financial platforms still send login codes via text message. SMS was never designed as a security tool. It was designed to deliver 160-character messages. Cyber security companies have been warning businesses and consumers for years that text-based authentication is fundamentally flawed — but adoption of stronger alternatives like authenticator apps and hardware keys remains low.

Global escalation. This isn't just an American problem. In the UK, the fraud prevention service Cifas recorded nearly 3,000 unauthorized SIM swaps in 2024 — a 1,055% increase from the previous year. Australia saw a 240% spike over the same period. The infrastructure that makes mobile number portability convenient for consumers also makes it exploitable for criminals.

Red Flags That You're Being Targeted

SIM swap attacks often start before the actual swap happens. Here's what to watch for:

• Unexpected "account verification" texts or emails. If you receive messages asking you to confirm a SIM change, port-out request, or account modification you didn't initiate, someone may be in the process of attempting a swap. Do not click any links in these messages.
• Sudden loss of cell service. Your phone showing "No Service" or "SOS Only" when you normally have a signal is the single most reliable indicator that a swap has already occurred. This is not the time to assume it's a network outage. Call your carrier from a different phone immediately.
• Login alerts from accounts you didn't access. Password reset emails, two-factor authentication codes you didn't request, or notifications about sign-ins from unfamiliar devices can signal that an attacker already has control of your number and is moving through your accounts.
• Calls or texts that stop arriving. If people tell you they've been trying to reach you but your phone shows no missed calls, that's a strong signal your number has been redirected.

What Your Carrier Is Supposed to Be Doing About It

The FCC adopted new rules in late 2023 specifically targeting SIM swap and port-out fraud. Under these rules, wireless providers are required to verify your identity through secure authentication before processing any SIM change or number transfer. They're also required to notify you immediately when a swap or port-out request is made on your account.

Carriers must now offer a free account lock feature — sometimes called a SIM lock, number lock, or port freeze — that blocks unauthorized transfers. The rules apply to all wireless providers, including prepaid services and resellers.

In practice, enforcement has been uneven. The rules set a floor, not a guarantee. Some carriers implement these protections well. Others still rely on security questions that an attacker armed with breached data can easily answer.

How to Protect Yourself Right Now

1. Enable SIM protection and port-out locks on your account

Every major carrier offers this. For T-Mobile, enable "SIM Protection" and "Port Out Protection" through the T-Mobile app or website. For AT&T, activate "Wireless Account Lock" in the myAT&T app. For Verizon, turn on "Number Lock" and "SIM Protection" in My Verizon. Do this today — it takes less than two minutes.

2. Set a strong account PIN that isn't guessable

Most carriers let you set a PIN or passcode that must be provided before any account changes are made. Don't use your birth year, the last four of your SSN, or any number that appears in your personal data. Make it random.

3. Move away from SMS-based two-factor authentication

Wherever possible, switch to an authenticator app like Google Authenticator, Authy, or Microsoft Authenticator. These generate codes locally on your device — they can't be intercepted through a SIM swap. For your most sensitive accounts (email, banking, crypto), a hardware security key like a YubiKey provides the strongest protection available.

4. Reduce your personal data exposure

The less information about you that's publicly available, the harder it is for an attacker to impersonate you to your carrier. Review what your phone is sharing with apps and advertisers. Audit which apps have access to your data, and consider a data removal service to scrub your information from broker sites.

5. Know exactly what to do if it happens

If your phone suddenly loses service, act fast. Call your carrier from another phone and tell them you suspect a SIM swap. Request an immediate freeze on your account. Then change the passwords on your email, banking, and financial accounts — starting with the email account tied to your password resets, since that's the master key to everything else. File a report with the FBI's IC3 at ic3.gov.

Speed matters. Research shows that over 40% of SIM swap victims don't realize what happened for more than 12 hours. Every minute of delay is a minute the attacker has full access to your accounts.

A SIM swap doesn't start with a hack. It starts with a phone call and a convincing story. The carriers are slowly improving, the regulations are catching up, and the legal consequences for negligence are getting real. But right now, the most effective protection is the one you set up yourself.