SIM swapping: how your phone number becomes the weak link

There is a particular kind of bad morning that starts with your phone saying "No service." Not in a tunnel — at home, where you had full bars yesterday. You reboot. Still nothing. Meanwhile, on a stranger's phone, your texts are arriving: the login code for your email, the reset link for your bank. Your phone never left your pocket. Your phone number did.

That's a SIM swap, and it earns its place in the taxonomy of ways 2FA actually gets bypassed through one uncomfortable property: the attack doesn't target you — it targets your carrier. You can do everything right and still lose accounts because somebody talked a support agent into moving your number. Here's the anatomy, why it keeps working, and what measurably slows it down.

How a SIM swap actually happens

There are two routes to the same outcome. In a SIM swap proper, the attacker contacts your carrier — by phone, in a store, occasionally through a paid insider — claims to be you, and asks to activate your number on a new SIM, with a story about a broken phone. In a port-out, they move the number to a different carrier, an ordinary thing real customers do every day. Either way, the number points at a SIM the attacker holds, and yours goes dark.

What gets them through the door is your personal data. To verify that "you" are you, carriers ask for name, billing address, account number, the last four of your Social Security number, maybe a recent payment amount — all of it in breach databases, aggregated well enough to answer support questions with. The attacker isn't hacking anything here; they're passing an identity check with better paperwork about you than you could produce yourself.

Why it keeps working

Carrier verification is weak in a structural way: the data used to prove you're you is exactly the data that has been leaking for a decade. There is no secret you and the carrier both know that the breach ecosystem doesn't. The last line of defense is a support agent working through a queue against someone holding your complete profile.

Number porting is also regulated to be fast and easy, and that cuts both ways. Portability rules exist so you can switch carriers without begging your old provider for permission — and friction that would stop an attacker would equally stop you escaping a bad one. The rules that make "keep your number" a consumer right also make stealing one a same-day service.

Regulators have noticed. The FCC publishes consumer guidance on the SIM swap scam, and as of this writing has been pushing carriers to verify SIM-change and port-out requests more strictly. The direction is right; the arrival date isn't guaranteed. Plan around the support desk being the attack surface, because it is.

The blast radius is your recovery channel

The naive read of SIM card swap fraud is that it only matters if you log in with SMS codes. The real read is worse. Your phone number is a recovery channel for nearly everything — email, banking, crypto, social accounts — and recovery flows are checked less vigorously than logins, because they exist for locked-out, panicked people.

The kill chain writes itself: swap the number, reset the email with a texted link, read the inbox, reset the password manager and everything downstream. Your email password can be a 40-character random string and it won't matter if the "forgot password" flow texts your number. The strongest front door is worthless when the side door is under attack.

So SIM swap protection is really two jobs: make the number harder to move, and shrink what it can unlock.

Defense layer one: at the carrier

The highest-value move by far: require an extra credential before your number can move. Every major US carrier offers some version — a port-out PIN, a number lock, a transfer freeze — and the names get rebranded often enough that you should search for the capability, not the brand. You set a secret or a toggle, and after that no port-out proceeds without it. If you haven't set one, do it today — ten minutes, and the attack stops being a social-engineering problem and becomes a secret the attacker doesn't have.

While you're in the settings, set a separate account passcode if one exists. And check the recursive trap: if your carrier account can be recovered by SMS to your number, the defense eats its own tail — point the carrier login at an email address, a unique password, and an authenticator-based second factor if the carrier supports one.

Defense layer two: on your accounts

Demote SMS wherever the option exists — as a login factor and, just as importantly, as a recovery channel. When a service offers an authenticator app, a passkey, or a hardware key, take it; then check what the "forgot password" flow uses and remove your number from accounts that allow it.

Regulation pulls the same way. NIST's SP 800-63B marks out-of-band secrets delivered over the phone network — SMS or voice — as RESTRICTED: deprecated for new deployments, with verifiers expected to offer alternatives and plan their way out. For where each method sits in the factor hierarchy, the factors guide has the full treatment. The short version: an authenticator app beats SMS because the secret never travels through the phone network; a passkey beats both because it's bound to the genuine site.

If you're choosing an authenticator, our 2026 TOTP app comparison covers the field — including ours and its trade-offs.

eSIM: a different shape, the same door

eSIM is a small, real improvement for one specific reason: there's no physical SIM to obtain. A slice of SIM-swap lore involves store employees issuing physical SIMs for cash, and eSIM removes that prop — activation must run through carrier systems that can demand stronger verification than a clerk eyeballing an ID. Don't oversell it: the boundary was never the plastic, it's the carrier's verification process, and eSIM does nothing about the port-out route, which never touches your SIM. A mild speed bump on one of two roads, not a wall.

Learn the early warning

The fastest tell is sudden, persistent loss of service where you should have signal: "No service" or "SOS only" at home, surviving a reboot, calls and texts silently failing with no explanation. That's the moment the clock starts — the attacker's window is the gap between the swap and your noticing.

The habit is cheap. Dead phone at home? Call your carrier from another phone immediately and ask them to check for a SIM change or port — they can freeze it, and the earlier the call, the smaller the damage.

The crypto and banking angle

If you hold funds on an exchange or bank from your phone, your number is the crown jewel. SIM swap plus an SMS-protected exchange account is the classic heist combination — crypto's early years produced a string of eight-figure losses this way, including a well-known case where an investor lost roughly $24 million after his number was ported. The pattern persists wherever SMS remains the second factor or the reset channel.

Banks layer on device fingerprinting and in-app approvals, but their recovery flows still lean hard on the number — for accounts where a takeover means losing money outright, treat it as hostile infrastructure. The 2FA for crypto guide covers exchange-specific hardening; the bank 2FA field guide covers what banks offer.

Shrink the blast radius

Every account you move from SMS to TOTP makes the number matter less, and an afternoon of re-enrollment is the cheapest security work you'll ever do. The generator on our homepage shows how painless enrollment is — paste a Base32 secret or a QR image, get codes, all in your browser, no account, no storage. When you're ready to keep those secrets permanently, ours is zero-knowledge: seeds are encrypted in your browser before upload, the server stores only ciphertext, and you can create a free account without handing us the keys.

The uncomfortable summary: your phone number is an identity document issued by a company whose help desk is the attack surface. You can't fix the carriers. You can decide what the number is allowed to unlock. Treat it as a convenience, not a credential — and when a service insists it must be a credential, treat that as the account's real security level.

Frequently asked questions

What is SIM swapping?

SIM swapping is an attack in which someone convinces your mobile carrier to activate your phone number on a SIM card they control, usually by impersonating you with data bought from breach dumps. From that moment, every call and text sent to your number — verification codes, password-reset links — arrives on the attacker's phone, while yours loses service entirely.

How do I know if my SIM has been swapped?

The clearest early warning is sudden, persistent loss of service on a phone that should have signal — "No service" or "SOS only" at home, surviving a restart. Call your carrier from a different phone immediately and ask them to check for a SIM change or port-out; they can freeze the transfer, and the sooner you call, the smaller the attacker's window.

What is a port-out PIN?

A port-out PIN is an extra credential you set with your carrier that must be supplied before your number can be transferred to another carrier. US carriers each offer a version under different names, and it's the most effective carrier-side defense because it turns porting from a support agent's judgment call into a secret the attacker must actually possess.

Does an authenticator app protect me from SIM swapping?

It removes your phone number as the login factor, which closes the most common attack path — but many services still use your number as the recovery channel even when you sign in with app-generated codes. Demote SMS as a login factor, then check the account-recovery settings before calling the job done.

Is eSIM safer than a physical SIM?

Slightly, and in one specific way: an eSIM can't be physically issued by a store employee, so a swap must run through the carrier's remote activation process, which can demand better verification. That process was always the real boundary, so eSIM raises the bar a little without changing the fundamentals — a port-out PIN still matters just as much.