SSOGEN / Learn / SIM Swapping: How It Works, How to Tell, and What to Do in the First Hour
Learn
SIM Swapping: How It Works, How to Tell, and What to Do in the First Hour
In a SIM swap, a carrier moves your number to a SIM an attacker holds, so your calls and text-message codes go to them instead.
Updated
SIM swapping is fraud in which a criminal gets your mobile carrier to activate your phone number on a SIM card they hold. From then on, your calls and texts reach their phone, including the one-time codes that banks, email providers and employers send by SMS.
The FTC describes the usual route: a scammer tells the carrier a phone was lost or damaged and asks for the number on a new SIM (FTC, SIM Swap Scams: How to Protect Yourself, read 2026-10-09).
The fix is the same for most people and organizations: stop treating a phone number as proof of identity.
What is a SIM swap, and what does it change?
Your number is a record at the carrier that points to a SIM. A swap changes that record; nobody breaks into your phone.
The FBI’s Internet Crime Complaint Center names three ways in (FBI IC3 PSA220208, February 2022, read 2026-10-08):
- social engineering: posing as the customer to the carrier
- insiders paid to make the change
- phishing of carrier employees
The sequence below shows how a swap turns your texted code into the attacker’s code.
How a SIM swap defeats a text-message code
- Attacker
- Mobile carrierholds the number record
- Your phone
- Account servicebank, email, employer
- Attacker to Mobile carrier1Says a phone was lost or damaged; asks for a new SIMThe usual route the FTC describes.
- Mobile carrier2Number now points to the attacker's SIMA swap changes the record; nothing on your phone is broken into.
- Your phone3Your phone loses all serviceNo calls, texts or data. Often mistaken for bad coverage.
- Attacker to Account service4Asks to sign in or reset a password using your numberWorks only where a texted code can stand in for you.
- Account service to Attacker5Texts the code to the number, which now reaches the attacker
Is it possible for a SIM card to be hacked?
In the cases the FTC and FBI describe, nobody cracks the card. The carrier is persuaded to move the number.
How can I make a SIM swap?
For a legitimate swap, ask your own carrier, which will verify you.
This page doesn’t explain how attackers get past that check. It covers the defending side: what your carrier must now do, and how to make a stolen number open nothing.
Why do SMS codes fail against a SIM swap?
A text-message code proves only that whoever holds the number received it. After a swap, that is the attacker.
NIST’s current digital identity guideline, SP 800-63B-4 (page dated August 26, 2025, read 2026-10-08), classes the telephone network as a restricted authenticator in section 3.1.3.3.
Before sending a secret that way, services should check risk indicators such as a device swap, SIM change or number porting.
Under section 3.2.9, a service that offers a restricted authenticator must:
- offer at least one alternative that isn’t restricted;
- give users meaningful notice of the risk;
- keep a migration plan in case the method stops being acceptable.
Can a scammer access my bank account with my phone number?
Only if the bank lets the number stand in for you:
- Sign-in. A texted code to sign in.
- Password reset. A texted code to reset a password.
- Confirmation. A phone call to confirm.
If the account requires an authenticator app code or a security key, the number alone opens nothing. For sensitive accounts, the FTC recommends an authentication app or a security key instead of text verification.
How common is it? Is it still a thing?
The FBI counted these complaints and losses:
| Period | Complaints | Losses |
|---|---|---|
| 2021 | 1,611 | More than $68 million |
| January 2018 to December 2020 | 320 | About $12 million |
Source: FBI IC3 PSA220208, read 2026-10-08. These are the most recent FBI figures this page cites.
The FCC adopted rules on the problem in November 2023 and published them as a final rule in the Federal Register (88 FR 85794, December 8, 2023, read 2026-10-08). Regulators clearly still treat it as an active fraud.
What are the signs you were swapped?
The FTC lists two signs:
- a sudden loss of cellular service: no calls, texts or data;
- a carrier notice that a SIM was activated on an unfamiliar device.
Password reset emails, login alerts or sign-in codes you never requested also show that someone is using your number.
A phone with no signal is the strongest sign, and people often blame coverage. Treat a sudden total loss of service, away from a known outage, as urgent.
What should you do in the first hour?
Take the number back first, then lock down the accounts that depend on it.
- Call your carrier from another phone, or go to a store. Ask them to restore the number to your SIM and mark the account as compromised. The FTC’s first step is to contact the carrier right away.
- Ask what changed. Check whether other lines, a forwarding setting, a new account PIN or an email address on the account changed too.
- Change your email password first. Email resets other passwords. Choose a password you use nowhere else, then sign out other sessions.
- Change passwords on your bank, payment and work accounts. The FTC says to do this once you have access back. Then move each account from text-message codes to an authenticator app or key where the service allows it.
- Call your bank using the number on your card. Ask them to check for new payees or changed contact details.
- Check transactions and account changes on bank, card and other financial accounts, and report anything wrong to the institution. If a scammer has your sensitive details, the FTC points to IdentityTheft.gov.
- Tell your employer’s help desk if you use the phone for work sign-in. They can end sessions and reset second steps.
- Add a PIN or password to your carrier account. The FTC recommends it. Ask the carrier about the account lock described below.
What do the FCC rules require of carriers?
The FCC’s rules, 47 CFR 64.2010 and 52.37, apply to providers of commercial mobile radio service, resellers included (88 FR 85794, read 2026-10-08). In the final rule’s terms:
| Requirement | What the rule says, in short |
|---|---|
| Authentication | Before a SIM change, use secure methods reasonably designed to confirm the customer’s identity; do not rely on readily available biographical, account, recent payment or call detail information |
| Notice | Notify the customer immediately that a SIM change or port-out request was made on their account |
| Account lock | Offer every customer, at no cost, the option to lock or freeze the account against SIM changes and port-outs |
| Training | Train employees to address fraudulent SIM change and port-out attempts, complaints and remediation |
The rule took effect January 8, 2024. Most parts applied six months later; a few waited on Office of Management and Budget review.
The lock’s name and how to turn it on differ by carrier, so check your carrier’s own pages. A rule on carriers doesn’t change what a service does with a texted code once it is sent.
A worked example at Acme Corp
Maria Lopez at Acme Corp (acme.example) uses a texted code as her second step. The timeline is simplified, and the addresses come from the documentation range.
| Time | What happens | Where it shows |
|---|---|---|
| 09:02 | Maria’s phone loses service | Her phone |
| 09:10 | A password reset for maria.lopez@acme.example is requested from 192.0.2.45 |
Sign-in or audit log |
| 09:11 | A code is sent to her number | SMS provider log |
| 09:12 | The code is entered and the reset completes | Audit log |
| 09:14 | A sign-in succeeds from 192.0.2.45, an address she has never used | Audit log |
| 09:30 | She reaches a Wi-Fi network and sees the carrier’s notice | Her phone |
Two details give the swap away: the code was used within a minute of being sent, and the new address has no history for her.
A help desk that knows the pattern can end her sessions at 09:31, not next week.
This is the case for alerting on a password reset followed by a sign-in from a new address. It is also the case against letting one texted code both reset a password and pass the second step.
What should organizations do?
Don’t make SMS the only second factor for anyone who can reach money, data or admin tools. Offer an authenticator app at minimum, and a security key or passkey where devices allow.
NIST’s section 3.2.9 bar, an unrestricted alternative plus a migration plan, is a sound internal standard. Then add these controls:
- Treat a phone-number change, a new device and a reset as risk signals, as NIST suggests.
- Don’t let a help desk call reset a second factor on a name and a date of birth alone.
- Review who can still use text codes, and set a date to remove them.
- Brief staff in advance. A starting message:
Subject: If your phone suddenly stops working
Attackers sometimes talk a mobile carrier into moving a person’s number to their own SIM card.
If your phone loses all service for no clear reason, call your carrier from another phone. Then call us at help@acme.example so we can end your sessions.
We will never ask for a sign-in code over the phone. Over the next quarter we are moving sign-in codes from text message to an authenticator app. Enroll at My Account before the date in the notice.
Which alternatives to text codes exist?
| Method | Travels over the phone network | A SIM swap gives the attacker the code | Notes |
|---|---|---|---|
| Text message code | Yes | Yes | Restricted by NIST (section 3.1.3.3) |
| Authenticator app | No | No | The code is made on the phone, not sent; an attacker can still phish a code you type |
| Security key | No | No | A separate device; see phishing-resistant MFA |
| Passkey | No | No | Approved with your fingerprint, face or PIN on the device; no code to type |
The two middle columns follow from how each method works; the notes follow the sibling pages linked here.
Recovery is the weak point: if “forgot my authenticator” falls back to a text message, the number is back in control. The full comparison is in MFA types.
What this does not stop
A stronger second factor doesn’t stop a swap; it limits what the swap opens. Several exposures remain:
- The attacker still receives your calls and texts, which can help them impersonate you to a person.
- A phished authenticator code or an approved prompt still works for them; read MFA fatigue attacks.
- Services that use SMS for recovery stay exposed until they change it.
- The carrier rule lowers the odds of a swap but doesn’t remove them.
How SSOGEN treats text codes
SSOGEN treats Text a code as a weaker second step (MFA guide).
- Off by default. The policy option Text message (weaker) is off by default.
- Admin Console. The policy that governs the Admin Console never accepts email or text codes.
- Admin mode. Admin mode asks for an authenticator app code.
- Your choice. An administrator can leave texted codes off and require an authenticator app.
Questions people ask
What will swapping SIM cards do?
A normal swap, such as for a new phone, moves your own number to a new card. A fraudulent one moves it to someone else’s card, and you lose service.
Is SIM swapping the same as port-out fraud?
They’re related. The FCC’s rules cover both: a SIM change on the same carrier, and a port-out to another carrier.
How do I prevent SIM swapping?
Set a PIN on your carrier account and use the no-cost account lock if your carrier offers one. Move important accounts to an authenticator app or key (FTC advice and the FCC rule above).
Where to go next
- SSO and MFA. Compare SSO and MFA.
- Passkeys. Read passkeys against passwords.
- Learn hub. Return to the Learn hub.
Sources, all read 2026-10-08 or 2026-10-09: FTC, FBI IC3, the Federal Register final rule and NIST SP 800-63B-4.