Text message codes feel safe, because they come to your own phone. But your phone number belongs to your mobile provider, not your handset. This guide explains why that matters. It is part of our two-factor login and passkeys guide.

What a SIM swap is

Your SIM links your phone to your number. If you lose your phone, your provider can move your number to a new SIM. A SIM swap attack abuses that useful service.

How the attack works

  1. A criminal gathers your details from data leaks and social media.
  2. They contact your mobile provider and pretend to be you, or bribe or trick a staff member.
  3. The provider moves your number to the criminal's SIM.
  4. Your phone loses signal, and login codes now go to the criminal.
  5. They use "forgot password" on your email and other accounts.

It is often aimed at people known to hold crypto, because that money is hard to get back.

Warning signs

  • Your phone suddenly shows no service, while others nearby have signal.
  • You get a message that your SIM or number has changed.
  • You see login alerts or password reset emails that you did not ask for.
  • Friends say they get odd calls or texts from you.

How to protect yourself

  • Add a PIN to your mobile account. Ask your provider for a port-out PIN, a transfer lock or SIM protection. Our phone security guide covers this.
  • Move key accounts off SMS. Use an authenticator app, a security key or a passkey instead.
  • Remove your phone number as a recovery option on your email and bank, where possible.
  • Share less online. Your birthday and phone number make impersonation easier.
  • Use a different number for sign-ups if your provider or a service lets you do so.

What to do if it happens

  1. Call your provider from another phone, and get your number back.
  2. Change the passwords on your email first, then your bank.
  3. Log out of all devices and check your recovery settings.
  4. Tell your bank and watch your accounts.
  5. If money was stolen, report it, for example at the FBI's IC3 in the US.