What a SIM actually does
A SIM is the small chip, or in many modern phones the embedded equivalent called an eSIM, that tells the mobile network which subscriber a phone belongs to. Your phone number is not stored in the handset as such. It is an entry in your carrier’s systems, linked to a SIM identity. When someone calls or texts your number, the network delivers it to whichever SIM is currently linked to that number.
That arrangement is convenient. If your phone breaks or you buy a new one, the carrier can link your number to a new SIM, and your calls and texts follow. SIM swapping abuses exactly that convenience.
What a SIM swap is
In a SIM swap, a fraudster gets your number moved to a SIM they control. Once that happens, calls and text messages meant for you go to their device, and your own phone typically loses service. The attacker does not need to touch your phone at all.
There are several ways this has been reported to happen, and the details vary by country and carrier.
- Impersonating the customer. The attacker contacts the carrier, in person or by phone or online, pretending to be you and claiming a lost or damaged SIM. They may use personal details gathered from a data breach, social media or other public sources to pass identity checks.
- Persuading or pressuring staff. Support workers are people, and social engineering can sometimes get past their checks, particularly when the story is urgent.
- Insider involvement. In some reported cases, a carrier employee has been bribed or has abused access. This is thought to be less common than impersonation but is a known risk.
- Tricking you first. An attacker may use phishing to obtain your account details or PIN with the carrier, which makes the later request look legitimate.
A related but different problem is number porting, where a number is transferred to another provider. The effect for the victim is similar: the number ends up elsewhere.
Why text-message codes make this serious
Many services send a code by text message to confirm that you are signing in or resetting a password. The assumption is that only the owner of the phone number receives it. A SIM swap breaks that assumption: the code goes to the attacker.
If the attacker already has some of your details, such as a password from a leak or phishing page, the intercepted code can be the last missing piece. They can then use password resets, which often rely on a text or call, to reach email, social media, financial services or other accounts. That chain is a common route to account takeover.
This is one reason why two-factor authentication methods are not all equally strong. A code by text is usually better than no second factor, since many attacks are simple and untargeted, but it relies on the security of the phone number, which depends on how well the carrier can resist fraud. An authenticator app or a physical security key does not depend on the phone number in the same way.
Warning signs
Signs that a SIM swap may be underway or has happened include:
- your phone suddenly shows no signal or “emergency calls only” when you are in an area with normal coverage
- texts or calls stop arriving without explanation
- messages from your carrier about a SIM change, activation or porting request you did not make
- notices of password resets or login attempts that you did not trigger
- being logged out of accounts unexpectedly
Loss of signal can also be caused by ordinary network faults, travel or a damaged SIM, so it is not proof of an attack. But combined with unexpected account alerts, it is a reason to act quickly.
Reducing the risk
No measure removes the risk completely, but several reduce it.
- Use stronger second factors where possible. Authenticator apps and security keys avoid depending on a phone number. A passkey login can reduce the need for texted codes altogether on services that support it.
- Add protection with your carrier. Many carriers let you set an account PIN or passcode, or turn on extra locks for SIM changes and number transfers. Ask what is available, and use a PIN that is not guessable from public information.
- Keep personal details to a minimum. Information collected by data brokers or posted on social media can help an impersonator answer identity questions. Limiting what is public makes a convincing impersonation harder.
- Secure your email account especially well. Email often controls resets for everything else, so strong unique passwords from a password manager and a non-text second factor are valuable there.
- Do not share carrier PINs or verification codes with anyone who calls you, even if they claim to be from the carrier.
- Consider which accounts depend on the number. For high-value accounts, such as banking and email, check whether the number is the only recovery route, and add alternatives.
If you think it has happened to you
Speed matters, though outcomes vary. Typical steps are:
- Contact your carrier from another phone or in person, tell them you suspect a SIM swap and ask them to restore your number and lock the account.
- From a trusted device, change passwords for key accounts, beginning with email, and move off text-message verification where you can.
- Tell your bank and card providers, and consider fraud alerts if identity information may be exposed.
- Review accounts for changes and sign out other sessions, following the approach set out in guidance on account takeover recovery.
- Report the incident to the relevant authorities in your country and keep a record of what you did and when.
A note on proportion
For most people, the larger everyday risk remains simpler scams such as fake messages and reused passwords. SIM swapping tends to be aimed at people whose accounts are worth the effort, but being aware of it is still sensible because it shows a wider lesson: a phone number is a convenient contact detail, not a strong proof of identity.