A SIM-swap attack can redirect your phone number to a criminal-controlled SIM or eSIM, allowing attempts to intercept calls, texts, and account-recovery codes. This reusable checklist explains how to assess your exposure, which carrier and account settings to change first, and what to do if your phone suddenly loses service.
Overview
In a SIM-swap or port-out attack, someone persuades a mobile carrier to move your number to another SIM, eSIM, or carrier account. The attacker may use personal information obtained from phishing, data leaks, social media, or previous fraud. Once the number is moved, they can try to reset email, banking, cryptocurrency, social media, and other accounts that use SMS for authentication or recovery.
Your phone number is more vulnerable when a carrier account has a weak or reused password, no account PIN, no port-out restriction, or recovery information that an attacker can easily guess. Using SMS codes is not automatically unsafe, but SMS should not be the strongest protection on important accounts when a stronger option is available.
Start with this priority order:
- Secure the mobile carrier account with a unique password and account PIN.
- Enable the carrier's available port-out, number-lock, transfer-lock, or equivalent protection.
- Move high-value accounts from SMS authentication to an authenticator app or hardware security key.
- Review recovery methods, voicemail settings, and recent account activity.
- Know how to contact your carrier through an official channel if service suddenly stops.
Carrier names and settings differ, so verify the exact options in your account or with the carrier's official support channel. Do not rely on a link in an unexpected text or email to make security changes.
Checklist by scenario
Before there is a warning
- Create a unique carrier password. Do not reuse the password from email, banking, social media, or another service. A password manager can help generate and store a separate credential.
- Set an account PIN or passcode. Choose a value that is not your birth year, street number, phone number, or a code used elsewhere. Ask the carrier whether this PIN is required for account changes or number transfers.
- Turn on transfer protection. Look for a port-out lock, number lock, transfer lock, SIM-change alert, or a similar setting. Some controls may require contacting the carrier or visiting a store.
- Secure the email account tied to the carrier. Use an authenticator app or hardware security key where supported. If an attacker controls that email account, they may be able to approve or exploit recovery requests.
- Replace SMS on priority accounts. Begin with your primary email, password manager, financial accounts, workplace administrator account, and accounts that can reset other passwords. Save recovery codes somewhere secure and offline when offered.
- Review your public information. Remove unnecessary details such as your phone number, address, birthday, or answers to common security questions from public profiles.
After replacing a phone, SIM, or eSIM
- Use the carrier's official app or website to confirm that the correct number, device, SIM, and account email are listed.
- Confirm that transfer protection and the account PIN remain enabled. Security settings may need to be rechecked after an account change.
- Test calls, text messages, mobile data, and voicemail from a trusted device.
- Review recent sign-ins and recovery settings on important accounts, especially email and financial services.
- Delete old devices or sessions that you no longer control from account security pages.
When your phone suddenly loses service
Unexpected loss of cellular service is not proof of a SIM swap. It can result from an outage, damaged equipment, an expired account, or a local network issue. Treat it as an account-takeover warning when it is sudden, unexplained, or accompanied by carrier notifications, password-reset messages, or alerts about a new device.
- Use Wi-Fi or another phone to contact the carrier through its official website, app, billing statement, or a number you already trust.
- Ask whether the number was transferred, the SIM or eSIM was changed, or the account details were modified.
- Tell the carrier that you suspect an unauthorized SIM change or port-out and ask what account protections can be applied.
- Secure your email and other critical accounts from a trusted device. Change passwords and revoke unfamiliar sessions.
- Contact banks, payment services, and workplace security teams through official channels if there are suspicious resets, transactions, or login alerts.
- Preserve carrier messages, account notices, timestamps, and transaction records. They may help with recovery and fraud reporting.
If you receive a suspicious security message before taking action, use the guidance in Security Alert Triage and verify the message independently.
Protection comparison
| Control | What it protects | What to check |
|---|---|---|
| Carrier account PIN | Changes to the mobile account | It is unique, difficult to guess, and required for sensitive requests. |
| Port-out or transfer lock | Unauthorized movement of your number | It is enabled and you know how to temporarily remove it when legitimately switching carriers. |
| Authenticator app | Logins to supported accounts | It is configured on a trusted device and backup codes are stored safely. |
| Hardware security key | High-value account sign-ins and recovery | You have a spare key or another documented recovery method. |
| Recovery email | Password resets and account recovery | The mailbox has strong authentication and current recovery details. |
| Voicemail PIN | Access to voicemail messages | It is not the carrier default or an easily guessed number. |
What to double-check
Do not confuse a screen lock with carrier protection. A phone passcode helps protect the device, but it does not necessarily stop someone from requesting a number transfer through the carrier.
Check every recovery path. An account may use SMS for login but a phone number, email address, trusted device, backup code, or security question for recovery. Remove outdated phone numbers and review whether recovery methods can be changed without additional verification.
Secure the number's dependencies. Your primary email, password manager, carrier account, and identity-verification accounts deserve stronger protection than ordinary accounts because they can unlock other services. A credential leak check can help identify accounts that need attention; see Credential Leak Checks.
Review voicemail. Change the voicemail PIN from any default value and avoid recording sensitive personal information in the greeting. Do not assume voicemail is protected by the same controls as your phone's lock screen.
Use official contact routes. If a caller or message asks for a one-time code, carrier PIN, password, or urgent SIM change, stop and verify independently. For broader phishing checks, see How to Check Whether an Email, Text, or QR Code Is a Phishing Scam.
Common mistakes
- Using SMS as the only protection for every account. Keep SMS available as a fallback if necessary, but prefer an authenticator app, passkey, or hardware key for important services.
- Reusing a carrier PIN or password. A password exposed in an unrelated breach can become useful to an attacker targeting your mobile account.
- Publishing too much personal information. Public details can make impersonation and account-recovery questions easier to answer.
- Ignoring a carrier notification. An unexpected notice about a SIM, eSIM, device, account email, or number transfer deserves prompt verification.
- Waiting for service to return before protecting accounts. If a SIM swap is suspected, use another connection immediately to secure email, financial, and work accounts.
- Assuming a port-out lock makes every account safe. Attackers may still target email, devices, recovery addresses, or support workflows. Layered protection remains important.
When to revisit
Review this checklist at least when you change carriers, replace a phone, activate an eSIM, change your number, or add a new recovery method. Recheck it after receiving an unexpected carrier notice, discovering exposed credentials, or seeing an account-takeover warning. It is also useful as part of an annual account-recovery audit and before periods when you expect to travel or rely heavily on mobile access.
Carrier controls, device software, authentication options, and recovery procedures can change. Revisit the carrier's current security settings whenever you make an account change and update this plan after major mobile-platform or carrier changes. Keep a short offline record of your carrier contact route, account-recovery codes, and the steps trusted people should follow if your number stops working.
Action to take today: sign in to your carrier account through its official website or app, set a unique password and PIN, enable the strongest available transfer protection, then move your primary email away from SMS-only authentication. Those changes reduce the consequences of a compromised phone number without requiring you to wait for a warning.
