One morning, your phone drops to “No Service” and stops receiving calls and texts. You assume it’s a network glitch and you get on with your day.
But across town, someone has just convinced your mobile carrier that they’re you.
They’ve moved your number onto a SIM card sitting in their own phone.
Every call and text meant for you now goes to them, including the security codes that protect your email and your bank logins.
This is a SIM swap. The attacker never touches your password or breaks into a single system. They take over your phone number, then use it to reset everything attached to it.
They start by gathering a few details about you, often pulled from an old data breach or your social media.
Then they call your carrier, claim your phone was lost or damaged, and ask to activate your number on a new SIM. If the agent believes the story, your number is theirs in minutes.
From there, the SMS codes you rely on become their codes (SMS is the text message system most accounts use to send those one-time login codes). Password reset links and login verifications all land on their device instead of yours.
Researchers at Princeton University tested five major US carriers by posing as customers and trying to move numbers they didn’t own. They succeeded on 80% of their first attempts, mostly because the carriers were leaning on security questions a motivated attacker could answer.
The losses reported to the FBI run into the tens of millions of dollars a year, and the true figure is almost certainly higher, because most victims report the end result, like a drained account, rather than the phone takeover that caused it.
Your personal mobile number is probably the recovery method for nearly everything you log into, from your Microsoft 365 account to your business bank.
If that one number falls into the wrong hands, a lot can fall with it.
Don’t panic though. This is very fixable, and the setup is quick and free:
Lock your number with your carrier
Every major provider now offers a free toggle that blocks anyone from moving your SIM or porting your number without your say-so.
Move your important logins off text-message codes
For your email, banking, and admin accounts, switch from SMS codes to an authenticator app or a passkey.
Both keep working even if someone steals your number because the approval happens on your device, not through your phone signal.
Add a separate passcode to your carrier account.
Most carriers let you set a PIN or passcode that’s required before any change is made to your account. It’s one more wall between an attacker and your number.
Many carriers now send a text or email alert when someone requests a SIM change on your account. If that alert shows up and it wasn’t you, call your carrier right away.
If you’d like a hand checking which of your accounts still rely on text-message codes, or help locking down your team’s numbers, just reply and we’ll walk you through it.