SIM Swap Protection: Don't Let Hackers Steal Your Phone Number (2026)

A SIM swap attack occurs when a criminal convinces your mobile carrier to transfer your phone number to a SIM card they control. Once they have your number, they receive your text messages and calls — including SMS 2FA codes.

This gives them access to any account that uses SMS verification: email, banking, social media, and more.

1. Research: The attacker gathers your personal information (name, address, last 4 of SSN) from data breaches, social media, or phishing
2. Social engineering: They call your carrier pretending to be you, claiming they lost their phone or need a new SIM
3. Carrier transfer: The carrier rep transfers your number to the attacker's SIM card
4. Account takeover: The attacker uses your number to receive SMS 2FA codes and reset passwords on your accounts

The entire attack can happen in under 30 minutes.

• Your phone suddenly loses service (no signal, "SOS only")
• You receive unexpected text messages about account changes
• You can't log into accounts that were working minutes ago
• Your carrier notifies you of a SIM change you didn't request

Step 1: Add a PIN/Passcode to Your Carrier Account

All major US carriers offer account PINs:

• T-Mobile: Account PIN (Settings > Security)
• AT&T: Extra Security passcode (myAT&T > Profile > Sign-in info)
• Verizon: Account PIN (My Verizon > Account Security)

This PIN must be provided before any account changes, including SIM swaps.

Step 2: Switch from SMS 2FA to Authenticator Apps

SMS 2FA is the weakness that SIM swaps exploit. Switch to an authenticator app (Authy, Google Authenticator) on every account that supports it. Authenticator codes are generated on your device and can't be intercepted via SIM swap.

Step 3: Enable Number Lock / Port Freeze

Most carriers offer a "number lock" or "port freeze" that prevents your number from being transferred without additional verification:

• T-Mobile: Account Takeover Protection
• AT&T: Number Transfer PIN
• Verizon: Number Lock

Step 4: Use Hardware Security Keys for Critical Accounts

For your most important accounts (email, banking), use a YubiKey or similar hardware security key. These are completely immune to SIM swap attacks since they require physical possession of the key.

Step 5: Minimize Personal Information Online

SIM swap attackers use publicly available information to pass identity verification:

• Remove your phone number from social media profiles
• Use a Google Voice or VoIP number for public-facing accounts
• Opt out of data broker sites (deleteme.com, privacy.com)
• Be cautious about what you share on social media

Act immediately:

1. Contact your carrier from another phone — report the unauthorized SIM swap
2. Regain control of your phone number
3. Change passwords on all critical accounts (email first, then banking)
4. Check for unauthorized transactions and report to your bank
5. File a report with the FBI's IC3 (ic3.gov)
6. Enable authenticator-app 2FA on everything (not SMS)
7. Consider a credit freeze

Attack methods documented based on FBI IC3 reports and FCC enforcement actions. Carrier protection features verified with current T-Mobile, AT&T, and Verizon account interfaces in April 2026. Protection recommendations based on CISA and NIST guidelines.

Continue learning

Related Guides

security

How to Share Passwords Safely: Stop Using Slack and Email (2026)

Secure methods for sharing passwords, API keys, and credentials with teammates. Password manager sharing, Bitwarden Send, and one-time links.

Sarah Chen

security

Device Encryption Guide: Protect Your Data If Your Laptop Is Lost (2026)

How to enable full-disk encryption on Windows, Mac, iOS, and Android. Your data stays secure even if your device is stolen.

Sarah Chen

security

Endpoint Security for Remote Workers: Beyond Antivirus (2026)

Your devices are endpoints in the security chain. Modern endpoint protection goes beyond antivirus — here's what you need in 2026.

Sarah Chen