Your phone shows “No Service.” You assume it is the network. Twenty minutes later your email password has changed, your bank has sent a confirmation for a transfer you did not make, and your Instagram is posting about crypto.

Nobody touched your phone. They took your number.

How it works

Your phone number is not tied to your device. It is tied to a SIM, and your carrier can reassign the number to a different SIM at any time. That is how you get a replacement when you lose a phone. A SIM swap is simply that process, performed by someone who is not you.

The attacker contacts your carrier, by phone, by chat, or by walking into a store, and claims to be you. They have your name, address, date of birth, and often the last four digits of your Social Security number, all of which are available from breach data and people-search sites. They say they lost their phone and need the number moved to a new SIM. If the representative believes them, or if the attacker has bribed a store employee, the swap goes through.

Your SIM goes dead. Theirs lights up with your number. Every call and text meant for you now arrives on their device.

A related technique is the port-out, where the attacker moves your number to a different carrier entirely. Same outcome, different paperwork.

Why SMS codes are the problem

The number itself is not valuable. What it unlocks is.

Most accounts still offer SMS as a two-factor method or a password recovery path. With your number in hand, the attacker goes to your email provider, clicks “Forgot password,” and receives the reset code. From the email account they reset everything else. Banks, exchanges, and platforms that treat a text message as proof of identity are now wide open.

This is why SMS-based two-factor authentication is weaker than it feels. It protects you against someone who has your password. It does not protect you against someone who has your phone number, and your phone number is held by a customer service department you have never met.

The FBI’s Internet Crime Complaint Center logged 982 SIM swap complaints in its 2024 report, with roughly $26 million in reported losses. Those are self-reported figures from victims who knew what had happened and filed. The attacks that hit creators and executives tend to be targeted, not random, because a high-value account justifies the effort of impersonating a specific person.

Lock the carrier account

The first fix is at the carrier. All three major U.S. carriers now offer controls designed specifically for this. Set them all.

Account PIN or passcode

Every carrier lets you set a PIN or passcode that must be provided before account changes are made. Set one. Make it something that is not your birthday, your address, or the last four of anything. Do not share it with your team, and do not store it anywhere a phishing attack could reach.

Number lock and port-out protection

  • AT&T offers Wireless Account Lock, which blocks SIM changes, number transfers, and other high-risk account changes until you turn the lock off yourself in the myAT&T app.
  • Verizon offers Number Lock, which prevents your number from being ported to another carrier, and SIM Protection, which blocks SIM changes on the line. Both are managed in the My Verizon app.
  • T-Mobile offers Port Out Protection and SIM Protection, enabled per line through your account settings or the T-Life app.

Turn these on for every line on your account, including family members. If one of your lines is left unlocked, the attacker will use it as the entry point to the account.

Features and names change. If you cannot find these, call your carrier and ask specifically for SIM change protection and port-out freeze. Ask them to note on the account that no changes are to be made without an in-store visit with government ID.

Move two-factor off your phone number

Carrier locks reduce the odds of a swap. Removing SMS from your security chain removes the payoff.

Go through every account that matters and look at its two-factor and recovery settings. Where SMS is listed as a method, replace it.

  • Authenticator apps (Google Authenticator, Microsoft Authenticator, Authy, or the one built into your password manager) generate codes on the device itself. A swapped SIM gets nothing.
  • Hardware security keys, such as a YubiKey, require physical possession and are immune to phishing as well as SIM swaps. Use them on the accounts that own everything: primary email, password manager, Apple or Google account, and any platform that supports them.
  • Passkeys, where offered, provide similar protection and are tied to your devices rather than your number.

Then remove your phone number as a recovery option wherever the platform allows it. If a service insists on having a number, consider a number that is not your everyday one, held with a carrier account that is locked and that nobody knows exists.

If it happens anyway

The signal is sudden loss of service while others around you have signal. Call your carrier from another phone immediately and tell them you are the victim of a SIM swap; ask them to reverse it and freeze the account. Then move straight to your email account and secure it, because that is where the attacker is heading. File a report at ic3.gov. The sequence for the rest is the same as any account takeover: sessions, documentation, platforms, notifications.

Where ShutOut comes in

ShutOut’s account hardening work includes locking down carrier accounts, migrating every client account off SMS-based authentication, and deploying hardware keys for the accounts that matter most. We also run exposure removal so the personal details an attacker needs to impersonate you at a carrier are harder to find, and if a swap does land, our incident response team handles the carrier and platform escalations while you deal with the rest of your day.