Most people imagine account takeovers as someone guessing a password or hacking a server. SIM-swapping is more insidious because it attacks something you were told to trust: your phone number. In a SIM-swap, a criminal does not break into your phone at all, they convince your mobile carrier to move your number onto a SIM card they control, and from that moment every call and text meant for you, including the one-time security codes that protect your bank, email, and crypto, arrives on their device instead. Victims often notice only when their own phone abruptly loses signal, by which point accounts may already be draining. The attack is alarmingly low-tech, relying on social engineering rather than code, which is exactly why understanding it and hardening against it matters. This guide explains how a SIM-swap unfolds, why SMS-based security is the weak point, and the specific steps that take you off the menu. For the foundation it builds on, see two-factor authentication explained.
How a SIM-Swap Attack Works
The attack begins not with your phone but with your identity. The criminal first gathers enough personal information to impersonate you to your carrier, your name, address, date of birth, account number, and answers to security questions, much of it harvested from data breaches, social media, and the data-broker market we describe in how data brokers buy and sell your email. Armed with that dossier, they contact your mobile provider posing as you and claim to have lost or damaged their phone, requesting that the number be activated on a new SIM card, the one in their possession.
If the carrier's verification is weak or the representative is careless, or in some cases bribed, the request succeeds and your number ports to the attacker's SIM. Your real phone goes dead, losing service entirely, while the criminal now receives all your calls and texts. They then go to your important accounts, trigger a password reset, and intercept the SMS verification code sent to what is now their phone, resetting the password and locking you out. With control of your phone number they can cascade through every account that relies on it for recovery or two-factor codes, often starting with your email, because whoever controls your inbox can reset almost everything else.
Why SMS Two-Factor Is the Weak Link
The uncomfortable truth that SIM-swapping exposes is that a phone number was never designed to be a secure identifier. It is a routing label that carriers can, and routinely do, reassign, and that reassignment is governed by customer-service procedures rather than cryptography. Text-message two-factor authentication leans on the assumption that only you receive texts to your number, and a SIM-swap breaks exactly that assumption, turning your supposed second factor into the attacker's master key. This is why security professionals rank SMS codes as the weakest form of 2FA, as we note in email verification codes and OTPs explained.
That does not mean SMS 2FA is worthless, having any second factor is far better than a password alone, and for low-value accounts it is a reasonable baseline. But for anything an attacker would target, banking, email, crypto, the primary password manager, relying on SMS is building your security on a foundation someone else controls and can give away with a phone call. The fix is to move those critical accounts onto second factors that a phone number cannot unlock, which is where the strongest defences lie. Crypto holders are a favourite target precisely because transactions are irreversible, a risk we examine in temp mail for crypto and airdrops.
How to Protect Yourself
The single most effective step is to stop depending on SMS for your most important accounts. Replace text-message codes with an authenticator app, or better still a hardware security key or a passkey, none of which travel over the phone network, so swapping your SIM gains the attacker nothing. Prioritise your email first, since it is the recovery path for everything else, then your bank, password manager, and any crypto accounts. Where a service offers no option but SMS, treat that account as more exposed and compensate with an especially strong, unique password from a manager, as covered in our guide to strong passwords.
Next, harden the carrier account itself, because that is the door the attacker actually walks through. Most mobile providers let you add a separate port-out PIN or passcode and a note requiring extra verification before any SIM change, set this up, and make it something not derivable from your public information. Reduce the personal data available to impersonate you by minimising what you share publicly and using disposable or masked addresses for low-trust sign-ups so your real contact details spread less widely, the habit set in temporary email best practices. Finally, decouple where you can: use an authenticator app rather than your phone number for 2FA, and consider a separate number for verifications you would rather not tie to your main line, as discussed in temp phone numbers for SMS verification.
What to Do If You Are Being SIM-Swapped
Speed matters, because a SIM-swap is a race. The clearest warning sign is sudden, unexplained loss of cellular service, no calls, no texts, no data, especially if it happens out of the blue and a friend confirms your number still rings for them. Other red flags are unexpected notifications that your account password or security settings were changed, or that a SIM was activated on a new device. If you suspect it is happening, contact your carrier immediately from another phone to report a fraudulent SIM change and have your number frozen or restored.
In parallel, race to secure your email first, since it controls recovery for everything else, then your bank and any financial or crypto accounts, changing passwords and revoking active sessions from a device that still has trusted access. Alert your bank to watch for fraudulent transactions, and once the immediate fire is out, follow the broader recovery and monitoring steps in what to do when your email is in a data breach, including checking which other accounts shared that number. Document what happened and report it, in many places SIM-swapping is a prosecutable crime, and a paper trail helps both recovery and any disputes over fraudulent charges.
The Short Version
SIM-swapping is a social-engineering attack in which a criminal uses your personal information to convince your mobile carrier to move your number to their SIM, then intercepts the calls and texts, including SMS security codes, to reset passwords and seize your accounts, often starting with your email. The root weakness is that a phone number is a reassignable routing label, not a secure identifier, which makes SMS two-factor authentication the soft spot the whole attack depends on. Protect yourself by moving critical accounts off SMS to an authenticator app, hardware key, or passkey, adding a port-out PIN to your carrier account, shrinking the personal data available to impersonate you, and prioritising your email above all. If your phone suddenly loses all service for no reason, treat it as an emergency, contact your carrier at once and secure your email and financial accounts immediately.
Frequently Asked Questions
What is a SIM-swap attack?
A SIM-swap is when an attacker tricks your mobile carrier into transferring your phone number onto a SIM card they control. They do this by impersonating you using personal information gathered from breaches, social media, and data brokers, then claiming they need the number activated on a new phone. Once the swap succeeds, your phone loses service and all your calls and texts, including SMS two-factor codes, go to the attacker. They use those intercepted codes to reset passwords and take over your accounts. The attack relies on social engineering of the carrier, not on hacking your actual device.
How do I know if I have been SIM-swapped?
The clearest sign is a sudden, unexplained loss of all cellular service, no calls, texts, or mobile data, particularly if it happens without warning and others confirm your number now rings elsewhere or not at all. You might also receive notifications that a SIM was activated on a new device, or that an account password or security setting was changed without your action. If you see these signs, treat it as urgent: contact your carrier from another phone immediately to report a fraudulent SIM change, then move quickly to secure your email and financial accounts.
Is SMS two-factor authentication still safe to use?
Having SMS two-factor is better than a password alone, so it is a reasonable baseline for low-value accounts. But it is the weakest form of 2FA precisely because a phone number can be reassigned by your carrier through a SIM-swap, handing your codes to an attacker. For anything worth targeting, your email, bank, password manager, and crypto, you should move to an authenticator app, a hardware security key, or a passkey, none of which depend on the phone network. Reserve SMS for places that offer no stronger option, and pair it with an especially strong, unique password there.
How can I stop a SIM-swap from happening?
Two layers help most. First, remove the payoff by moving your important accounts off SMS-based 2FA onto an authenticator app, hardware key, or passkey, so intercepting your texts gains an attacker nothing, and protect your email first since it controls recovery for everything else. Second, harden the carrier account that the attacker targets: add a port-out PIN or passcode that is not derivable from public information, and ask for a note requiring extra verification before any SIM change. Reducing the personal data available to impersonate you, by using disposable or masked addresses and sharing less publicly, makes the impersonation step harder too.
What should I do first if my accounts are being taken over?
Move fastest on your email, because it is the recovery path that controls almost every other account. From a device that still has trusted access, change your email password, sign out of all active sessions, and switch its 2FA to an app or key rather than SMS. Then secure your bank and any crypto or financial accounts the same way, and alert your bank to watch for fraud. In parallel, contact your carrier to reverse the fraudulent SIM change and freeze the number. Once the immediate threat is contained, work through the wider recovery and monitoring steps for a compromised account.
Sources & further reading
External links are provided for verification and are not endorsements. Reviewed against these sources per our editorial policy.
Achyuth Kumar
Founder & editor, TempMailKit
Achyuth builds privacy tools and writes TempMailKit’s guides on email security, spam, and online privacy. Every article is checked against primary sources and our editorial policy before it is published. Questions or a correction? Get in touch.