SIM Swap Attacks Explained: How They Work and How to Protect Your Accounts
Your phone number has quietly become a key. Banks, email providers and social apps send a code to it and treat whoever receives that code as you. A SIM swap attack goes after the key itself, and it does not need any hacking skill, only a convincing phone call.
What a SIM swap is
A SIM swap, sometimes called a port-out scam, happens when someone persuades your mobile operator to move your number to a SIM card that they control. They may pretend to be you, use leaked personal details or bribe an insider. Once the transfer is done, your own phone loses service and the attacker's phone starts receiving your calls and text messages, including every verification code.
Why it works
- Many accounts still use SMS codes as the second step or as the way to reset a password.
- Operators sometimes verify callers with details that are easy to find, such as a date of birth or an address.
- The victim often notices only when their phone suddenly shows no signal.
Warning signs
- Your phone shows no service for no clear reason, while others on the same network are fine.
- You receive messages from your operator about a SIM change or a number transfer that you did not ask for.
- You are suddenly logged out of accounts or get password reset emails you did not request.
How to protect yourself
- Ask your operator whether you can set a PIN or password on your account, or lock your number against transfers.
- Move important accounts from SMS codes to an authenticator app or a passkey where the service allows it.
- Keep personal details such as your full date of birth and address out of public profiles.
- Use a different email address for banking than for social media.
- Save backup codes offline so a lost number does not lock you out.
What to do if it happens
- Contact your operator at once from another phone and ask them to restore the number.
- Change the passwords of your email first, then your bank and social accounts.
- Tell your bank and ask them to watch the account.
- Turn on stronger two-step verification as soon as you regain control.
- Report it to the relevant authority in your country if money was taken.
Where virtual numbers fit
A virtual number does not protect a bank account from a SIM swap, and you should not put an important account on a temporary number. It is useful for the opposite job: signing up to low-value services without giving them the number that your bank and email rely on. Keep your real number for the accounts that matter and use a virtual number for the rest.
A realistic timeline
A typical attack runs in hours. The attacker gathers your name, number and a few personal details from leaks or social media. They contact your operator, pass a weak identity check and move your number to a new SIM. Your phone loses signal. Within minutes they request password resets that send codes by SMS, and the codes go to them. By the time you notice the missing signal, the main email account may already be changed.
What to do the same day
- Call your operator from another phone and ask them to restore the SIM and add a port-out PIN.
- Change the password of your email first, then banking, then everything else.
- Move accounts away from SMS codes to an authenticator app.
- Check your bank and email for sign-ins and forwarding rules you did not set.
- Write down what happened and when, in case a bank or the police ask.
Questions people ask
Can an authenticator app be stolen the same way?
Not through your phone number. An attacker would need your device or your account backup.
Is a SIM swap the same as a stolen phone?
No. Here your phone stays with you but your number is moved to another SIM.
Related guides and pages
Create a free OtpGet account and try it with a small balance.