The short version: a SIM swap is when a criminal moves your phone number to a phone they control. You can make it much harder in a few minutes. Start by adding a PIN to your phone account.
There is no need to panic
You may have heard about criminals who take over phone numbers. This guide explains what that means. It also shows what you can do about it. Most of the steps take only a few minutes.
What a SIM swap is
A SIM is the small chip that links your phone to your phone number. An eSIM does the same job, but it is built into the phone. You set it up with a code or an app, not a plastic card.
In a SIM swap, a criminal tricks or pays someone at your phone company. The goal is to move your number to a SIM or eSIM that the criminal controls. After that, your calls and texts go to the criminal’s phone. This includes text-message codes.
A port-out is a related trick. It moves your number to a different phone company, instead of to a new SIM at the same company. Both can end with a criminal controlling your number.
Why criminals do it
Many sites send a code by text to prove it is you. They also send a reset link or code if you forget your password. If a criminal gets your texts, they can use these codes to reset the passwords for your email, money apps and social media. The FBI describes this.
We have a separate guide about text codes. Read why text-message codes are the weakest 2FA.
Signs to look for
- Your phone suddenly shows “No service”, or it can make only emergency calls. (On an iPhone in the US, this can show as “SOS”.) Other people nearby have signal.
- You get a message from your phone company about a SIM change or a number transfer. You did not ask for it.
- You cannot sign in to your accounts.
These signs can have other causes. A network problem or a broken phone can look the same. If you are not sure, call your phone company.
How to protect your number
- Add a PIN or passcode to your phone account. It can help stop changes you did not ask for. Never tell your PIN to someone who calls you. If someone says they are from your phone company, hang up. Then call the number on your bill or on the company’s real website.
-
Turn on a number lock, if your phone company has one. In the US, these companies offer locks. Check their help pages for the steps.
- AT&T: Wireless Account Lock.
- T-Mobile: SIM Protection and Port Out Protection.
- Verizon: SIM Protection and Number Lock.
A lock blocks changes until you turn it off. You will need to turn it off when you buy a new phone or move to a new phone company. In the UK, ask your phone company what security options it offers for your account, such as a PIN or password. To move your number to a new company, the UK uses a code called a PAC. Give a PAC only to a company you chose to join.
-
Move important accounts away from text-message codes. Use a passkey or an authenticator app. Read authenticator apps and two-factor authentication.
- Keep your email account safe. Criminals use email to reset other passwords. Read secure your email.
- Do not post your phone number in public. Also keep other personal details, such as your address, off public sites.
- Turn on alerts. Ask your phone company and your bank to tell you by text or email when something changes. Choose email alerts if you can.
If a service only offers text-message codes, you can still use them. Do the steps above to protect your number.
If you think it has happened
Do these steps in this order.
- Call your phone company from another phone. Use a friend’s phone, a work phone or a landline. Say: “I think my number has been moved.” Ask them to take back control of your number.
- Call your bank and other money services. Ask them to watch your accounts. In the UK, you can dial 159 to reach most banks. It works on most big UK phone companies and may cost the same as a normal call. If 159 does not connect you, call the number on your card or in your banking app.
- Change your email password first. Use a device you trust. Then change the passwords for your money and social media accounts.
- Add an authenticator app to your email and other key accounts. Save your backup codes. Read recovery codes and backups.
- Report it.
- US: report at reportfraud.ftc.gov. You can also report to the FBI at ic3.gov and file a police report. If a criminal may have your personal details, IdentityTheft.gov gives you a step-by-step recovery plan.
- UK: in England, Wales and Northern Ireland, use Report Fraud (formerly Action Fraud) at reportfraud.police.uk. In Scotland, call Police Scotland on 101.
Check your bank and card accounts for payments you do not know. If you see any, tell the company.
Scam texts
If you get a scam text, forward it to 7726 (SPAM). In the US and the UK, most phone providers accept this. Never read a code out to someone who contacts you.
Do this today (about 8 minutes in your phone company’s app)
- Open your phone company’s app or website, or call them.
- Add or change your account PIN.
- Turn on a number lock if your company has one.
Another day: add an authenticator app to your main email account.
Never type a code or password into this website, and never read a code out to someone who contacts you.
Checked: 25 Oct 2026. Phone company feature names and app screens change. If yours looks different, search the company's help page.
