How to protect your phone number from SIM swaps

Telecom breaches like the one at Singapore's Simba expose exactly what criminals need for SIM swapping: names, ID numbers, dates of birth and phone numbers.

What is a SIM swap?

A criminal contacts your mobile carrier pretending to be you and asks to move your number to a new SIM card they control. Once it works, your calls and texts go to them — including one-time login codes for your bank and email. The FCC has introduced rules requiring US carriers to better verify SIM change requests.

A SIM card is the small, removable chip that lets a phone connect to a carrier's network. Legitimate SIM swaps happen all the time — for example, when someone upgrades phones or their device is lost or damaged. Fraudulent swaps abuse that same process: a scammer tricks or bribes a carrier representative, or uses stolen personal information, into reassigning a victim's number to a SIM the scammer controls, as described in a US Department of Justice indictment of a SIM-swapping conspiracy DOJ indictment.

Why criminals want your number

Many banks, exchanges and email providers still use SMS text messages to send one-time passcodes for login or password resets. Once an attacker controls your phone number, they can intercept those codes and take over accounts protected only by SMS-based two-factor authentication.

High-profile cases show the scale of the problem

SIM swapping has already caused some of the largest individual cryptocurrency thefts on record:

• Cryptocurrency investor Michael Terpin had more than $20 million in crypto stolen via a SIM swap in 2018. One of the men involved, Nicholas Truglia, was later sentenced to 18 months in prison and ordered to pay $20,379,007 in restitution; prosecutors said Truglia and his associates were part of a scheme that stole more than $100 million from crypto investors in total DOJ. A civil jury separately awarded Terpin a $75.8 million judgment against Truglia Krebs on Security.
• In February 2021, the UK's National Crime Agency and US Secret Service announced the arrest of eight men in England and Scotland for a series of SIM-swapping attacks against "well-known influencers, sports stars, musicians, and their families" throughout 2020, which were used to steal money, bitcoin and personal information, and to hijack victims' social media accounts US Secret Service. Europol said the wider ten-person network was linked to the theft of more than $100 million in cryptocurrency by hijacking phone numbers Europol.
• In a more recent US case, prosecutors charged three defendants — Robert Powell, Carter Rohn and Emily Hernandez — with running a SIM-swap conspiracy from March 2021 to April 2023 in which they shared the personal identifying information of more than 50 victims, created fraudulent identification documents, and took over victims' cellular accounts to access financial and social media accounts DOJ indictment.

New US regulation

In November 2023, the FCC adopted a Report and Order specifically targeting SIM swap and port-out fraud, revising its Customer Proprietary Network Information (CPNI) and Local Number Portability rules FCC Report and Order. The rule requires wireless carriers to:

• Use secure methods to authenticate a customer before redirecting their phone number to a new device or carrier.
• Immediately notify customers whenever a SIM change or port-out request is made on their account.
• Take additional steps, including account locks, to prevent unauthorized changes.

The rule took effect January 8, 2024, with some information-collection provisions delayed for further approval Federal Register. In December 2023, the FCC's Enforcement Bureau also issued an advisory reminding carriers of their legal obligation to protect customers' sensitive data and take reasonable steps to prevent SIM fraud schemes FCC Enforcement Advisory.

Warning signs

• Your phone suddenly shows "No service" or "SOS only" in an area where it normally works.
• You get a notice about a SIM change you did not request.
• You are suddenly locked out of email, banking or social media accounts.
• You receive password-reset texts or calls you did not request.

How to protect yourself

1. Add a PIN or passcode to your carrier account. Most carriers offer a "port-out PIN" or SIM lock.
2. Turn on SIM protection features where available, such as T-Mobile's SIM Protection or Verizon's Number Lock.
3. Move away from SMS codes. Use an authenticator app or passkeys for important accounts.
4. Do not post your phone number publicly, and be careful who you share it with.
5. Be cautious with personal details on social media. Many SIM swap attacks start with information gathered from public profiles, such as your birthday or mother's maiden name, used to pass carrier identity checks.
6. Watch for phishing that targets your carrier login. Attackers often first try to obtain your carrier account credentials directly, rather than calling the carrier blind.

If it happens

• Contact your carrier immediately from another phone.
• Change passwords on email and bank accounts and remove your phone number as a recovery option.
• Report it to your bank and to the police.
• File a complaint with the FCC and, if you are in the US, consider reporting to the FBI's Internet Crime Complaint Center (IC3).
• Check all linked financial and crypto accounts for unauthorized transactions, since SIM swaps are frequently used specifically to drain cryptocurrency exchange accounts.

What readers should do

• Call your mobile carrier today and ask to add a port-out PIN or enable any available SIM-lock or "SIM protection" feature.
• Replace SMS-based two-factor authentication with an authenticator app or hardware security key wherever a service allows it, especially for email, banking, and cryptocurrency accounts.
• Limit how much personal information — birthdate, address, mother's maiden name — you share publicly online, since this data is commonly used to pass a carrier's identity checks.
• Set up account alerts with your carrier so you are notified immediately of any SIM or port-out request.
• If you hold meaningful cryptocurrency balances, move them off exchanges tied to SMS-based recovery and into a method that does not depend on your phone number.
• If your number is ever hijacked, act immediately: contact your carrier from a different phone, lock down your email and bank accounts, and file reports with your carrier, bank, and law enforcement.

Sources

• FCC: Cell phone fraud guide
• FCC Report and Order on SIM-swap and port-out fraud
• Federal Register: FCC final rule on SIM-swap and port-out fraud
• FCC Enforcement Advisory on SIM fraud prevention
• US DOJ: SIM swap sentencing in $20 million theft
• Krebs on Security: NY man pleads guilty in $20 million SIM swap theft
• US Secret Service: Brits arrested for SIM swapping attacks on US celebs
• Europol: Ten hackers arrested for SIM-swapping attacks against celebrities
• DOJ indictment: Powell, Rohn, Hernandez SIM swap conspiracy