You do everything right — strong passwords, two-factor authentication — and yet an attacker drains your accounts anyway. One way they pull this off is a SIM swap: they steal your phone number, not your phone, and with it the text-message codes guarding your logins. Our GetMyPassword team explains what a SIM swap attack is, how it works, the warning signs, and how to protect yourself.
What a SIM swap attack is
In a SIM swap, an attacker convinces your mobile carrier to transfer your phone number to a SIM card they control. They do it by impersonating you — using personal details gathered from leaks and social media — and claiming a lost or upgraded phone. Once your number is theirs, your calls and texts come to them, not you.
Why it is so dangerous
The danger is what your phone number unlocks. Many services send password resets and 2FA codes by SMS. With your number, an attacker requests a reset, receives the code, and walks into your email, bank or crypto account. It is the main reason security experts now prefer app-based codes over text messages.
Warning signs
- Your phone suddenly loses all signal and cannot make calls or texts.
- You get a notification that your SIM or number was changed.
- You are locked out of accounts, or see reset emails you did not request.
If your phone abruptly loses service for no reason, treat it as an emergency, not a glitch. Those few minutes between a SIM swap and an account takeover are when acting fast matters most.
How to protect yourself
Two steps make the biggest difference. First, add a PIN or passcode to your mobile account with your carrier, so no one can port your number without it. Second, switch your two-factor authentication from SMS to an authenticator app or security key, which a SIM swap cannot intercept. And as always, give each account a unique password from our password generator, so a stolen number alone is not enough.
Frequently asked questions
How do I know if I am being SIM swapped?
The clearest sign is your phone suddenly losing all signal while others nearby work fine, often with a message that your SIM changed. You may also see unexpected password-reset emails. Contact your carrier immediately.
How can I prevent a SIM swap?
Set a PIN or passcode on your mobile carrier account so your number cannot be ported without it, and use an authenticator app or security key instead of SMS for two-factor authentication.
Is SMS two-factor authentication still safe?
It is better than no second factor, but vulnerable to SIM swaps. For important accounts like email and banking, prefer an authenticator app or a security key, which cannot be intercepted by stealing your number.