SIM Swap Scams: How Criminals Steal Your Phone Number
In a SIM swap scam, criminals convince your mobile network to transfer your phone number to a SIM card they control. Suddenly they receive your calls and SMS codes, including banking OTPs and password resets.
How it works
- Criminals gather your personal details from social media, data breaches or phishing.
- They contact your network, or use insiders or fake documents, claiming to have lost their SIM.
- The network issues a new SIM with your number to them.
- Your phone loses signal. They use SMS codes to reset passwords and access accounts.
Warning signs
- Your phone suddenly shows "No service" or "Emergency calls only" in an area with good coverage.
- You get messages about a SIM change or eSIM activation that you didn't request.
- You receive alerts about password changes or logins you didn't make.
What to do immediately
- Contact your mobile network from another phone and report possible SIM fraud.
- Call your bank on its official number to block online banking and cards.
- Change passwords for email and important accounts from a secure device.
- Report to the relevant cybercrime authority in your country.
How to protect yourself
- Use authenticator apps or passkeys instead of SMS for 2FA where possible. See passkeys explained.
- Set a SIM PIN in phone settings so a stolen physical SIM can't be used in another phone.
- Ask your network whether they offer an account PIN or extra verification for SIM changes.
- Limit personal information you share publicly, like your full date of birth, ID number and phone number.
- Never share OTP codes with anyone.
- Protect your email with a strong password and 2FA, since it's the key to resetting everything else.
Banking tips
Turn on in-app transaction notifications, set daily transfer limits, and use biometric login. Many banks now bind accounts to your specific device for extra protection.
Reduce your dependence on SMS codes
The less your security relies on SMS, the less a SIM swap can hurt you. Work through your important accounts:
| Account | Better option than SMS |
|---|---|
| Email (Gmail, Outlook) | Passkey or authenticator app, backup codes |
| Social media | Authenticator app |
| Password manager | Authenticator app or security key |
| Banking | In-app approvals with device binding and biometrics (where offered) |
After adding a stronger method, remove your phone number as a recovery option where it's safe to do so, or at least make sure it's not the only way in.
Protect the information scammers need
SIM swap criminals often start with your personal details. Reduce what's available:
- Don't post your full date of birth, ID number or phone number publicly.
- Be careful with online forms and giveaways asking for ID details.
- Shred documents with personal information.
- Be wary of calls asking you to "confirm" personal details.
See reducing your digital footprint for more.
Help older relatives
Older family members are frequent targets because many rely on SMS banking. Help them set up app-based banking with biometrics, save the bank's official number, and explain that no real bank asks for OTPs.
Frequently asked questions
Can eSIMs be swapped too?
Yes, criminals can request eSIM transfers. The same precautions apply.
Is SMS 2FA still better than nothing?
Yes. Use it if nothing else is offered, but prefer an authenticator app.
Keep reading
What Is a VPN and Do You Actually Need One?
A plain-English explanation of VPNs: what they protect, what they don't, when they're useful, and how to choose a trustworthy one.
10 Signs Your Account Has Been Hacked (and What to Do)
Recognise the warning signs that your email, social media or other accounts are compromised, and take back control quickly.
How to Secure Your Home Wi-Fi Router in 10 Minutes
Change default passwords, turn on WPA2/WPA3, update firmware and lock down your router to keep your home network safe.