SIM swapping: how it works and how to protect yourself

SIM swapping is a form of account takeover in which a criminal gets your phone number moved to a SIM card, or eSIM profile, that they control. After the swap, your calls and text messages, including SMS login codes and password-reset messages, reach them instead of you. It does not require breaking into your phone, only fooling the staff or systems of your mobile provider. The risk is modest for most people, but it is the reason security bodies advise against relying on SMS codes for important accounts.

How a SIM swap works

1. Gathering information. The attacker collects personal details: name, address, date of birth, sometimes account or customer numbers. These come from data breaches, phishing, social media or social engineering.
2. Contacting the provider. They pose as you, claim the phone is lost or the SIM damaged, and ask for a replacement SIM or a new eSIM. Sometimes they bribe or deceive an employee, or use a weak online process.
3. Taking over the number. Once the provider switches the number, your own SIM stops working.
4. Using the codes. The attacker triggers password resets or logins on your accounts and reads the SMS codes that arrive on their device. Banks, email providers and exchanges are the typical targets.

Related is port-out fraud, where the number is moved to another provider. The effect for you is the same.

Warning signs

• Your phone suddenly shows “No service” or “SOS only” for no obvious reason.
• You receive a message from your provider about a SIM change, a number transfer or a new eSIM that you did not request.
• You get unexpected security notifications, password-reset emails or login alerts.
• Contacts tell you they received odd messages from your number.

A single dropped signal is usually harmless, since networks do fail. If it lasts and other phones nearby are fine, act promptly.

How to protect yourself

Reduce what SMS can do for an attacker

1. Move 2FA away from SMS. Use passkeys, hardware keys or authenticator apps on email, banking, cloud and social accounts.
2. Check recovery options. Many accounts let you reset the password by SMS even when a stronger factor is on. Remove or tighten this where possible. See account recovery.
3. Protect your email first. Your email account can reset almost everything. Our guide to securing your email account covers this.

Protect the number at the provider

1. Add a PIN or password to your mobile account for any contract or SIM change, if your provider offers one.
2. Ask about SIM or porting locks. Some providers let you block SIM replacement or number transfers unless extra checks pass.
3. Set up account notifications so you are alerted by email or app about SIM changes.
4. Use a strong, unique password for your mobile provider’s customer portal, ideally with a second factor.

Limit what others can learn about you

• Do not give out your birth date, address or customer number to unknown callers or on unsolicited links.
• Be cautious with posts that reveal personal data used in identity checks.
• Beware of calls or texts pretending to be your provider or bank. Hang up and call the official number yourself.
• Keep your phone number out of public profiles where you can.

What to do if you suspect a swap

1. Call your provider from another phone or visit a shop with ID. Ask them to block the SIM, restore your number and note the incident.
2. Change the password of your email account from a safe device, and enable a stronger second factor.
3. Contact your bank, and check your accounts for transactions or changes you did not make. Ask the bank to block cards or online access if needed.
4. Secure other accounts: messaging, cloud, social media, crypto and shopping accounts.
5. Review recovery settings and remove your phone number as a reset method where possible.
6. Consider reporting it to the police, and keep records of messages and times, which can help with banks and insurers.

Why criminals like this method

SIM swapping appeals to attackers because it needs no technical barrier to be crossed: there is no malware you might notice and no fake link you have to click. The attack targets a process at the provider. That makes it hard to see from the victim’s side, but easy to plan for. If your important accounts no longer depend on your phone number, the attack loses most of its value.

Your ten-minute checklist

1. Ask your provider whether you can set an account PIN or password for SIM changes, and set one.
2. List the accounts that still send codes to your number: email, bank, cloud, social media.
3. Switch the top three to an authenticator app, passkey or security key.
4. Check the “forgot password” options of your email account and remove the phone number if a stronger option exists.
5. Save the number of your provider’s support line on another device, so you can call quickly if your SIM stops working.

Is it a big risk for me?

For most people the chance of a targeted SIM swap is low, and the damage can be contained if your important accounts do not depend on SMS. That is the practical message: you do not have to defend the phone number, you just have to stop making it the only thing between an attacker and your accounts. The BSI recommends authenticator apps and hardware-based methods over SMS for this reason.

Switch the accounts that matter most, ask your provider about a PIN, and you will have dealt with most of the risk.