Your phone number is a master key to your digital life, and criminals know it. A SIM swap attack is when hackers convince your mobile carrier to transfer your phone number to a SIM card they control, giving them access to two-factor authentication codes and account recovery options. The good news: you can defend yourself by enabling carrier security tools, using authentication apps, and monitoring your accounts.
What is a SIM swap attack?
A SIM swap attack happens when someone calls your mobile provider and impersonates you, persuading them to transfer your phone number to a new SIM card. Once they control your number, they intercept text messages containing login codes and password reset links meant for you. From that moment, they can access your email, banking apps, cryptocurrency wallets, and social media accounts.
The attack exploits two weaknesses at once. First, it targets a perceived point of trust, your carrier's customer service line, which often relies on readily available personal information to verify identity. Second, it relies on SMS-based two-factor authentication, which sends codes as text messages rather than using more secure methods. Many people assume SMS is safe because it comes through their phone. It isn't, once someone controls that number.
How SIM swap attacks work
The attacker starts by gathering information about you. They might buy data from a breach, scrape your social media profiles, or make educated guesses based on public records, your birthdate, address, the last four digits of your ID, your mother's maiden name. These details are often enough to pass carrier verification checks.
Next, they call your mobile provider claiming they've lost their SIM card or got a new phone. They provide the details they've collected. If the representative is rushed, lacks proper training, or if the attacker is convincing, the transfer goes through. Your phone suddenly shows no signal. Meanwhile, your incoming messages now arrive on their SIM card, and you have no idea anything is wrong.
From there, the attacker moves quickly. They visit the password reset page of your email account, enter your address, and select the option to receive a reset code via text. The code lands on their phone. They reset your password, gain full access to your email, and from there, they can reset passwords on every other account linked to that email, banking, trading platforms, cryptocurrency exchanges.
Why SIM swap attacks succeed
These attacks work because most online services still treat your phone number as a reliable authentication factor. Banks, email providers, and cryptocurrency platforms assume that if you can receive a text message sent to your number, you must be you. This assumption breaks the moment someone controls your SIM.
Carriers themselves often lack strict verification procedures. Staff turnover is high, training varies, and attackers who sound confident and know your personal details can get through. Some attacks succeed on the first call; others require several attempts at different branches or at different times of day.
How to defend against SIM swap attacks
Enable carrier authentication tools
Major UK carriers offer SIM swap protection. Contact your provider and ask for a PIN or password requirement before any SIM changes can be made. Some carriers call this a "security PIN" or "SIM protection" service. You set a unique number or code that the carrier requires before approving any changes to your account. Without it, a caller, even if they know your personal details, cannot transfer your number.
Set a PIN that is not linked to obvious information like your birthday or the year you were born. Store it somewhere secure and separate from your normal passwords. This single step blocks most casual attackers and many professional ones too.
Switch to authentication apps instead of SMS
Stop relying on text message codes for two-factor authentication. Instead, use an authenticator app. Apps like Google Authenticator, Microsoft Authenticator, or Authy generate codes on your device itself, not via SMS. Even if someone controls your phone number, they cannot intercept codes that never travel through the network.
Go through your important accounts, email, banking, cryptocurrency, social media, and enable app-based two-factor authentication wherever the service offers it. On most platforms, you can keep your phone number on file for account recovery, but the app codes are your primary 2FA method.
Strengthen your email account security
Your email is the skeleton key to your digital life. If attackers take over your email, they can reset passwords on every other service. Add app-based two-factor authentication to your email account itself. For Gmail, this means enabling Google Authenticator or a similar app as a second authentication factor. Don't just rely on SMS there either.
Consider adding a recovery email address, a second email account you control that can be used to regain access if your primary email is compromised. This gives you a fallback even if someone gets into your phone number.
Use a hardware security key for critical accounts
For accounts holding money, cryptocurrency, or sensitive personal information, consider a hardware security key. These are small USB or NFC devices that authenticate you without broadcasting codes over the internet. A security key like a YubiKey cannot be compromised by someone who controls your phone number because the authentication happens locally on the device you hold in your hand.
Hardware keys work with most email providers, many banks, and cryptocurrency platforms. They're more friction than typing a code, you have to plug them in or tap them, but that friction is the point. An attacker thousands of miles away cannot use your key.
Monitor your accounts and phone service
Stay alert to signs of attack. If you suddenly lose signal for a few hours, contact your carrier immediately. If you receive unexpected password reset emails, notification that your login location has changed, or alerts about accessing unfamiliar devices, your accounts may be under attack.
Set up login alerts on your email account and any financial accounts. Most services can email you every time someone logs in from a new location or device. Enable these notifications and review them regularly. A surprise alert is often the first sign of trouble.
Work with your carrier on additional protections
Beyond the security PIN, ask your carrier if they offer other protections. Some providers allow you to lock your account so no changes can be made without an in-person visit to a physical store. Others will flag your account as high-security and route calls to specialized teams with stricter verification. These services may take longer, but they add layers attackers rarely overcome.
FAQ
Can SIM swap attacks happen to me?
Yes, if you have accounts with money, cryptocurrency, or valuable information and someone knows enough about you to pass carrier verification. The attack doesn't require you to be famous or wealthy, attackers often target people at random, testing carriers' defenses. The better question is not whether you can be attacked, but whether you're defended.
What should I do if I think I'm being attacked right now?
Contact your mobile carrier immediately and report the issue. Ask them to reverse any SIM changes and secure your account with a PIN. Next, log into your email account from a device connected to Wi-Fi (since your phone may have no signal). Change your email password and check for unauthorised login activity. Then change passwords on all sensitive accounts. Work with your bank or service provider if money has been moved.
Is SMS two-factor authentication completely unsafe?
SMS 2FA is better than no 2FA, but it has a known weakness. For routine accounts with limited risk, SMS is acceptable. For accounts holding money, sensitive data, or identity information, app-based or hardware-key authentication is stronger and should be your priority.
What if my provider doesn't offer a security PIN?
Switch to a provider that does. SIM swap protection is now standard among major carriers. If your current provider refuses to offer it, that's a red flag about their security practices. Most providers offer it free of charge, so there's no cost to adding it.
Can I use a password manager to protect my phone number?
A password manager protects your passwords, not your phone number. However, using a strong, unique password on every account, which a password manager makes easy, does limit the damage if one account is compromised. Keep your phone number and password security as separate defenses.
Conclusion
A SIM swap attack is a real threat that costs people money and dignity every year. But it's not inevitable. Start today by calling your mobile provider and requesting a security PIN. Then enable app-based two-factor authentication on your email and financial accounts. For cryptocurrency, trading, or banking apps, use a hardware security key if available. Monitor your accounts for unexpected login activity. These steps won't make you unhackable, but they move the burden of the attack so far up the difficulty curve that most attackers will move on to easier targets. Take them one at a time. Start now.