SIM swap protection: how to stop someone stealing your phone number

Your phone number is a login for more accounts than you might think. Banks, email providers and social networks send reset links and one-time codes to it. Whoever controls the number receives those codes. There are two ways to steal it:

• SIM swap: the criminal convinces your own carrier to move your number to a new SIM card or eSIM that they hold, usually by impersonating you in a store, on the phone or through a hijacked online account. Your phone loses service; theirs starts getting your texts.
• Port-out: the criminal opens an account at a different carrier and asks to transfer your number to it, using your account number and transfer PIN. The result is the same.

The details they need (name, address, date of birth, last four of your SSN, carrier account number) often come from data breaches and people-search sites, which is one reason removing your details from data brokers helps.

At its November 15, 2023 open meeting the FCC adopted rules aimed at exactly this. Under the SIM swap and port-out fraud order, wireless carriers must:

• Use secure methods to authenticate a customer before changing their SIM or porting their number out.
• Notify the customer immediately when a SIM change or port-out is requested.
• Let customers lock their accounts against SIM changes and port-outs.
• Train staff on these scams and limit employee access to account data until the customer is authenticated.
• Keep a clear process for reporting fraud and fix it promptly.

The rules set a baseline and leave the exact methods to each carrier, so the protections below differ in name and detail. The locks are the part you control.

None of these is on by default at Verizon, and you should assume the same elsewhere. Each takes a minute in the carrier's app. Feature names as listed on each carrier's support pages in October 2026:

• Verizon: its SIM Protection and Number Lock help page says protected numbers are blocked from anything needing a new SIM, including upgrades, and that a number with Number Lock on cannot generate a transfer PIN. Number Lock alone does not stop SIM changes, so turn on both.
• T-Mobile: its account fraud page covers SIM Protection, Port Out Protection and the account PIN. Only the primary account holder can change the PIN or turn Port Out Protection off.
• AT&T: see Learn about AT&T Wireless Account Lock. Only users with primary or secondary access to the account can turn it on or off.

On a smaller carrier or a prepaid brand, search its support site for "port out protection" or "SIM lock", or ask in a store. You will need to switch these off yourself before upgrading a phone or moving to a new carrier; Verizon notes a short wait after disabling before changes go through.

The account PIN or passcode is what a store or phone agent asks for. T-Mobile, for example, requires 6 to 15 digits and rejects sequences, repeats and anything taken from the phone number. Pick one you use nowhere else, store it in your password manager, and never read it out to someone who called you.

Your carrier's website and app login matter just as much, because a criminal inside it can switch the locks off. Give it a unique password and the strongest sign-in option it offers.

Locks reduce the risk. Taking your important accounts off SMS removes the payoff. In order:

1. Your main email account: switch to an authenticator app, a security key or a passkey.
2. Your Apple Account or Google Account.
3. Your bank, brokerage and any crypto accounts. Some banks only offer SMS; ask about alternatives.
4. Remove your phone number as a password-reset option where a site lets you use an authenticator instead.

Our guides to two-factor authentication and passkeys walk through each option. SMS codes are still better than no second factor, so do not turn 2FA off on accounts that only offer SMS.

Losing signal at home, with "No Service" or "SOS only" while other phones nearby work, or a text from your carrier about a SIM change or transfer you did not ask for, are the classic signs. Speed matters, because the criminal is usually resetting accounts within minutes.

1. From another phone or a computer, contact your carrier's fraud line (on its website or your bill) and say your number was moved without permission. Ask them to restore it and add the locks above.
2. Sign in to your email from a trusted computer and change its password. Check recovery options and forwarding rules, and sign out other sessions.
3. Call your bank and card issuers. Ask them to flag the account and review recent transfers.
4. Freeze your credit at all three bureaus if you have not already; see how to freeze your credit.
5. Report it at IdentityTheft.gov for a recovery plan, and at the FBI's IC3.gov if money was taken. Ask the carrier for written documentation of the fraud; the FCC rules require carriers to provide it.

Our guide to what to do if your identity is stolen covers the longer recovery. This page is general information, not legal advice.