Quick Answer
Protect your number with your carrier’s account PIN, SIM-change protection and port-out lock where available. Then secure important accounts with authentication that does not depend on SMS, plus a recovery method you can still use if your phone is lost. If an unexpected SIM-change alert or loss of service suggests fraud, contact your carrier immediately through a trusted channel.
SIM swapping moves your phone number to a SIM or eSIM controlled by someone else; a fraudulent port moves it to another carrier. Either can expose calls and texted login codes. This guide separates number protection, account security and urgent recovery, with US carrier examples. Other countries and smaller providers use different names and eligibility rules.
How Can You Lock Down Your Mobile Number?
Start in your carrier account, separate from the phone’s screen lock. Use a unique account password and a hard-to-guess carrier PIN or passcode. Avoid your birth year, address digits and codes reused elsewhere. Keep the PIN in a secure place you can access without relying on the affected phone number.
Ask about both SIM-change and port-out protection. A new SIM on the same network and a transfer to another network are different transactions; one switch may not protect against both. Check every family or business line, who can disable the controls, and how to make a legitimate replacement later. Carrier safeguards reduce risk but do not guarantee that fraud or insider misuse is impossible.
| US carrier | Protection to check | Important limit or setup detail |
|---|---|---|
| Verizon | SIM Protection and Number Lock | Separate controls for SIM/device changes and transfers. In My Verizon, open Me, then Edit profile and settings and Security. Verizon documents a 15-minute block on SIM changes and upgrade orders after SIM Protection is disabled. |
| T-Mobile | SIM Protection and Port Out Protection | SIM Protection covers SIM changes. Port Out Protection covers transfers to another carrier and must be added separately to each line. Postpaid, prepaid and business management paths differ. |
| AT&T | Wireless Account Lock | The AT&T app manages eligible wireless-account changes; postpaid and prepaid steps differ. On a standard wireless account, use the person icon, then Wireless account lock. Primary or secondary account users can control it. |
These examples reflect the providers’ current guidance: Verizon SIM Protection and Number Lock, T-Mobile fraud protections and AT&T Wireless Account Lock. Follow the path for your account type, and ask your provider if a control is unavailable. Before an upgrade or legitimate port, find out which lock must be temporarily disabled; restore appropriate protection afterwards.
A SIM PIN Is a Different Protection
A SIM PIN on the phone locks use of the existing SIM or eSIM, such as after a restart. It is not the carrier account PIN and does not stop a provider from issuing a replacement SIM or porting the number. Apple’s SIM PIN guidance also warns against guessing the PIN or PUK: incorrect attempts can permanently lock the SIM. Contact the carrier for the correct procedure.
How Can You Protect Accounts That Use Your Number?
Move two-factor authentication from SMS to methods that do not depend on your phone number. Carrier safeguards and account safeguards serve different jobs. Review email and financial accounts first, including any text-message recovery fallback.
Replace SMS Codes on Your Most Important Accounts
An authenticator app such as Google Authenticator, Microsoft Authenticator or Authy generates one-time codes on your device instead of sending them over the mobile network. Because the code does not travel by text message, an attacker cannot intercept it through a SIM swap.
- Open the security or two-factor authentication settings for the account you want to protect.
- Choose the authenticator app option instead of SMS.
- Scan the QR code shown with your chosen authenticator app.
- Enter the six-digit code the app generates to confirm the setup.
- Save any backup codes the service provides in a secure place separate from your phone.
Where supported, a FIDO security key or passkey offers phishing-resistant authentication as well as avoiding delivery of a code by SMS. An authenticator’s typed one-time code is not delivered to a swapped SIM, but a fake login page can still trick you into handing it over. Use the account’s supported method rather than assuming every app accepts the same option.
Passkeys are another option supported by an increasing number of major platforms. They use a cryptographic credential through a supported device, credential manager or security key. Synced and device-bound passkeys have different recovery arrangements; make sure you can recover access after losing the phone.
Caution: some services still allow account recovery through SMS or a phone call, even after you set up an authenticator app or security key. Check your account recovery options and remove the phone number fallback where the service allows it. Otherwise, the SMS weakness remains despite your other precautions.
Secure Your Email, Carrier Login and Recovery Settings
Protect your email account with a non-SMS method first, since it is usually the recovery route for everything else. If an attacker can reset your email password using an intercepted text, they can also reset passwords on other accounts that use that email address.
Also review your carrier account’s own login. If it uses SMS-based verification and your number has already been compromised, that verification step offers no protection.
Keep a Safe Way Back Into Your Accounts
Store backup codes for your authenticator-protected accounts somewhere that does not depend on your phone, such as a password manager or a written copy kept securely. Losing your phone and backup codes at the same time can lock you out entirely, so treat backup codes with the same care as a spare house key.
Before replacing SMS, add the new method, verify that it works, and save the supported recovery option. Do not remove your only working route into the account. Some services require a trusted number or offer only SMS; keep available MFA rather than turning it off, and strengthen the carrier account. For email-specific checks, follow our guide to securing your email account.
How Can You Make Impersonation Harder?
Limit the personal details scammers can find and use to convince your carrier or bank that they are you. SIM swap fraud relies on social engineering, meaning the attacker’s main tool is information, not technical hacking.
Recognise Requests for Carrier Details and Verification Codes
Unexpected messages may impersonate your carrier or bank and ask for passwords, PINs, transfer codes or verification codes. Do not disclose a code or approve a change just because the caller knows personal details. End the conversation and use the provider’s app or contact details you already trust. Our guide to recognising phishing emails explains how to verify a request independently.
If you receive an unexpected request for account details by phone, text or email, do not respond directly. Contact the company yourself using a number or address you already know is genuine.
Limit the Personal Information Used to Verify Your Identity
Scammers often build a profile using details you post on social media, such as your school, a pet’s name or your mother’s maiden name. They can then use those answers to pass security questions. Avoid posting information publicly that matches your account recovery questions, and avoid sharing your phone number, home address or full birth date where anyone can see it.
Separate email addresses for financial and public-facing accounts can reduce easy connections between them, but they do not prevent a takeover by themselves. Unique passwords, secure recovery settings and careful handling of unexpected requests still matter.
What Should You Do if You Suspect a SIM Swap?
Unexpected loss of service can have innocent causes, but an unrequested SIM-change alert, account lockout or unusual transaction warrants urgent action. Do not wait for every warning sign to appear. Wi-Fi may still work even when your mobile number has been taken.
Check the Warning Signs Without Assuming Every Outage Is Fraud
Possible warning signs include:
- Your phone shows “No Service” or “Searching” with no clear cause, such as travel or a known network outage.
- You receive a text alerting you to a SIM or device change you did not request.
- You are suddenly locked out of email, banking or social media accounts.
- You notice unfamiliar transactions or password reset notifications you did not trigger.
A dropped signal alone does not prove fraud. Ask your carrier to check the line and any recent SIM or porting activity, particularly when another account has also changed unexpectedly.
Contact Your Carrier Through an Official Channel
From another phone or trusted internet connection, contact your carrier through its official app, website or an established support number. Ask its fraud team to check for an unauthorised SIM replacement or port, restore control and secure the account. Do not rely on being able to call from the affected line. Have identification ready and record the case reference.
Secure Your Accounts and Report Any Financial Fraud
Contact the carrier immediately, and alert financial institutions at once if money is at risk. Use a device you trust for account recovery. If it is a work number or affects a work account, notify your IT or security team.
- Report unrecognised transactions to the affected bank, card issuer or exchange through a trusted contact route. Ask what restrictions and reporting steps apply.
- Recover your primary email and other affected accounts. Change exposed or reused passwords, review sessions, and remove unfamiliar recovery details, forwarding rules and connected apps.
- Restore non-SMS authentication and backup access where supported. Verify the carrier PIN, line locks and authorised users after control is restored.
- Keep dated alerts, transactions and case references. In the US, use IdentityTheft.gov for a recovery plan if personal information was stolen or misused; consider a credit freeze or fraud alert where the exposure warrants it. Other countries have their own reporting and credit-file systems.
- Follow the institution’s or insurer’s reporting instructions. A police report may be appropriate for theft or required by a particular claim, but requirements vary. Beware anyone promising guaranteed recovery for an upfront fee.
If a bank account or cryptocurrency exchange shows fraudulent transactions, report this directly to that institution as well as your bank’s fraud department. The reporting timeline can affect whether losses are recoverable.
Protect Your Number and Your Accounts Together
Neither a locked carrier account nor strong two-factor authentication alone gives complete protection against SIM swapping. Carrier locks reduce opportunities for unauthorised transfers, while non-SMS authentication limits what an attacker can do if a transfer gets through.
Treat these as two separate layers, not one fix. SIM-change protection and port-out protection address different ways of taking control of the number. Authenticator apps, security keys and careful account recovery settings protect your accounts if that number is compromised despite the lock. Keeping personal information off public social media reduces the material a scammer can use to pass identity checks with your carrier or bank.
Review your carrier’s lock settings and your most important accounts’ authentication methods on the same day. Gaps in one area can go unnoticed until an actual attack tests the other.
Frequently Asked Questions
How do I protect against SIM swapping on an iPhone?
Secure the carrier account with its PIN and available SIM-change and port-out controls. An iPhone SIM PIN protects use of the existing SIM, not carrier-side replacement. For an Apple Account, use Apple’s supported two-factor and recovery options; do not assume an ordinary authenticator app can replace its verification system.
How do I protect against SIM swapping on Android?
Use your carrier’s available line locks and a unique account PIN and password. For Google and other accounts, choose a supported passkey, security key or authenticator method and keep backup access. Android’s screen lock and SIM PIN serve separate purposes from the carrier controls.
Does a SIM PIN prevent a SIM swap?
It does not prevent a carrier-side SIM replacement or a port to another network. A SIM PIN locks use of the existing SIM or eSIM. A carrier account PIN and carrier line protections help protect changes made through the provider.
Can someone SIM swap an eSIM?
Yes. An attacker can fraudulently persuade a carrier to move your number to a different eSIM profile. The absence of a removable SIM does not remove this account-takeover risk.
How can I tell whether my number has been SIM swapped?
Unexpected loss of calls, texts or mobile data, an unrequested SIM-change alert and account lockouts are warning signs. None alone proves a swap. Contact your carrier promptly through a trusted channel and ask it to check recent changes.
Sources and Image Credits
Sources: Verizon; T-Mobile; AT&T; FTC SIM-swap advice; FTC authentication guidance; FIDO Alliance passkeys; Canadian Centre for Cyber Security; Apple SIM PIN guidance.
Illustrations: Impulsec.
Share this article
Stuart Kerr Spindlow is Impulsec’s Publisher, Chief Editor and Lead Reviewer. He writes and maintains coverage of consumer cybersecurity and digital-safety software, with a focus on practical suitability, limitations and the evidence behind product claims. Read Stuart’s full profile.