What a SIM swap actually is
A SIM swapis when someone gets your phone number moved onto a SIM or device they control. They do it by social-engineering your carrier — or, in some cases, bribing an insider — into transferring your number. Once they have it, every text-message code and password-reset link meant for you arrives on their phone, which is how a SIM swap turns into drained bank accounts and hijacked email. The attacker never touches your phone; they take over your number.
The warning signs
- Sudden loss of service.Your phone shows “No Service” or SOS-only and cannot call or text, while other phones nearby work normally.
- A port or SIM-change notice.A text or email saying your number was ported or a new SIM was activated — one you did not request.
- Account lockouts. You are abruptly signed out of email or banking and your password no longer works.
- Unexpected 2FA prompts. Verification codes or reset notifications you did not ask for, a sign someone is trying your accounts.
What to do right now
Move fast and in order. Call your carrier from another phoneto reclaim the number — this is the one step only they can do. Then, from a device you trust, secure email and bank accounts first by changing passwords and signing out all sessions. Finally, move off SMS codes to an authenticator app or hardware security key so the same trick cannot work twice. The full recovery walkthrough is in SIM-swap attack recovery.
How rare is it, really?
Honestly, fairly rare — and the reported trend is downward. Complaints to the FBI's Internet Crime Complaint Center went from 2,026 in 2022 to 1,075 in 2023 to 982 in 2024, with reported losses falling too. One caveat worth stating: IC3 counts only the cases people report, so the true number is higher than any official tally. The honest read is that the reported trend is down, not that the problem is solved.
Here is the way to hold both facts at once: a SIM swap is a rare event but a severe one when it lands on you— and the defenses are cheap no matter the base rate. A carrier port-out PIN and app-based 2FA cost minutes and block the attack outright, which is why they are worth setting even though the odds in any given year are low.
The free shield, and the rule behind it
The strongest, cheapest protection is a carrier port-out PIN or account lock, paired with a credit freeze — both free, both covered in how to freeze your credit and lock your SIM. There is also a federal backstop: under FCC rules adopted in 2023 (compliance required from July 2024), carriers must use secure verification before moving a number, notify you of SIM changes and ports, and offer a free account-lock option.
This guide is about spotting and surviving a SIM swap. For the separate question of whichsecond factor to use in the first place — and why text codes are the weakest choice — read why SMS two-factor is the weakest link.
Sources
- Federal Register (Federal Communications Commission), Protecting Consumers from SIM-Swap and Port-Out Fraud. https://www.federalregister.gov/documents/2023/12/08/2023-26338/protecting-consumers-from-sim-swap-and-port-out-fraud
- Federal Communications Commission, FCC Announces Effective Date for SIM Swapping and Port-Out Fraud Rules. https://www.fcc.gov/consumer-governmental-affairs/fcc-announces-effective-date-sim-swapping-item
- FBI Internet Crime Complaint Center (IC3), 2024 Internet Crime Report. https://www.ic3.gov/AnnualReport/Reports/2024_IC3Report.pdf
