SIM Swap Scam: Warning Signs and How to Lock Your Number

Your phone shows "SOS only" in the middle of the afternoon, and a minute later your email warns that someone just reset your password. That is how a SIM swap scam usually feels from the victim's side. A criminal convinces your carrier to move your phone number onto a SIM card or eSIM they control, and from then on every text and call meant for you, including login codes, goes to them.

The FBI's Internet Crime Complaint Center counted 1,611 SIM swap complaints in 2021 alone, with more than $68 million in adjusted losses, up from 320 complaints across the three years before that. The good news is that all three major US carriers now offer free locks that block this. Below are the warning signs, the exact settings to turn on, and what to do if your number has already been taken.

Warning signs your number may be getting hijacked

• Your phone suddenly has no service, no data, no texts and no calls, while people around you on the same carrier are fine.
• You get a text or email from your carrier saying your SIM card or eSIM was activated on a new device, and you did not do it.
• Your carrier alerts you to an account change, such as a new authorized user, a changed address or a port out request.
• You receive "Forgot password" or account recovery emails you never requested, especially from your bank, email provider or crypto exchange.
• Someone claiming to be your carrier or bank calls and asks you to read back a code that was just texted to you.

The FTC lists the first two as the clearest signs.

How the scam works (and why your texts are the prize)

The FCC describes two routes. In a classic SIM swap, the scammer gathers enough personal details about you (name, address, last digits of your Social Security number, account PIN) to convince a store or phone rep that they are you, then asks for a new SIM because the "old phone was lost." In a port out scam, they move your number to a different carrier entirely. The FBI adds that some cases involve bribed or phished carrier employees.

Once your number is theirs, the scammer goes to your email, bank or exchange, clicks "Forgot password," and receives the reset code by text. That is why the FTC warns that text message verification may not stop a SIM swap. The number itself is the weak point, so the fix is to lock it and to stop relying on it.

Switching to an eSIM does not end the risk. The FCC notes that eSIMs cannot be physically stolen like a plastic card, but port out scams remain a concern.

Lock your number with your carrier: a checklist

Every option below is free. Turn on both the SIM lock and the port out lock where your carrier separates them.

Verizon

1. Open the My Verizon app, tap the Account tab, then Edit Profile and Settings under your name.
2. Scroll to Security Menu and tap SIM Protection, then turn it on. On the website the path is the same: Edit Profile and Settings, Security Menu, SIM Protection.
3. On a prepaid line, open the menu in the upper left, then Account, Account Settings, the Security tab and Manage SIM Protection.
4. Turn on Number Lock as well, which blocks moving your number to another carrier until you switch it off.

Verizon says only the Account Owner or an Account Manager can change SIM Protection. When you turn it off, there is a 15 minute delay before a new SIM can be activated, which gives you a window to react if someone else did it. You will need to switch it off yourself before an upgrade, then switch it back on.

T-Mobile

1. In the T-Life app, go to Manage, tap the gear icon, then Security and SIM Protection.
2. Turn it on for the whole account or for single lines, then tap Save Changes and Continue.
3. Add Port Out Protection to each line: Manage, See Plans, Manage add-ons, pick the line, check Port Out Protection, then Agree & Submit.
4. Prepaid customers sign in on the prepaid site with the primary line and find SIM Protection under My Profile.

T-Mobile says an authorized user can add SIM Protection, but only the Primary Account Holder can remove it. Port Out Protection works the same way and is free for postpaid, prepaid and Metro by T-Mobile lines. While you are in Security, set an account PIN of 6 to 15 non sequential digits.

AT&T

1. Open the AT&T app on a phone that is active on your account and sign in.
2. Tap the person icon, then Wireless account lock, and swipe to lock.
3. On prepaid, go to Profile & Settings, Account Info & Preferences, Wireless Account Lock, then enter the one time code AT&T texts you.

AT&T's lock covers a lot: SIM and eSIM changes, device upgrades, number transfers, new or removed lines, authorized user changes and billing details. Payments, plan changes and AutoPay still work. The primary account holder gets an email, and each line gets a text, any time the lock changes.

Make a stolen number less useful

Locking the number is half the job. The other half is making sure a hijacked number cannot open your accounts.

1. Move important logins off text codes. Use an authenticator app, a passkey or a hardware security key for email, banking and crypto. Our guide to setting up an authenticator app walks through it, and passkeys explained shows why they resist phishing.
2. Lock down your email first. It is the reset hub for everything else, so give it the strongest second step you have.
3. Set a carrier PIN that is not your birthday or the last four of your SSN. The FTC recommends a PIN or password on your cellular account.
4. Post less. The FBI advises against sharing financial details or holdings online, because posted holdings tell criminals who is worth targeting.
5. Never read a code to a caller. If someone says they are from your carrier, hang up and dial the number on your bill.

What to do if your number was already swapped

Speed matters, because the scammer is working through your accounts while you are offline.

1. Call your carrier from another phone right away and ask them to restore your number to your SIM. Verizon customers can reach support at 1-800-922-0204. Ask them to note the fraud and turn on every lock.
2. Change passwords on your email first, then banking, payment apps and crypto exchanges. Sign out of other sessions where the option exists.
3. Call your bank and card issuers. Ask them to flag the account and watch for unusual logins and transfers, as the FBI recommends.
4. Check for damage. Review bank, card and exchange activity, and look for new accounts opened in your name. A credit freeze stops new credit lines quickly.
5. Report it. File a complaint at ic3.gov, report identity theft at IdentityTheft.gov, and tell the FCC through its Consumer Complaint Center. The FBI and FCC also suggest filing a report with local police.

If money or accounts were taken, our identity theft recovery steps cover the longer cleanup, and how to report a scam lists more agencies by scam type.

A quick final check

Once your locks are on, open your carrier app and confirm the line shows as locked or protected. Then pick the three accounts that would hurt most to lose and confirm none of them still accept a text message as the only second step. For more practical security guides, browse our Tech section.