How to prevent SIM swapping

What SIM swapping and port-out fraud are

• SIM swapping. The FCC says it takes place when a bad actor convinces your wireless carrier to transfer your service from your cell phone to a cell phone in the bad actor's possession.
• Port-out fraud. The FCC says the bad actor, posing as you, opens an account with a carrier other than yours, then arranges for your phone number to be transferred to that account.
• Why it matters. The FTC says hackers who take over your number can get texts sent to it, including those with a verification code, before you realize someone stole your number. The FCC says they may then have the means to get into your financial, social media and other accounts, change login credentials and drain bank accounts.
• How scammers get your details. The FCC says they gather personal information about their target online, combing through social media posts, or buy it from cyber thieves or hackers. With the right combination, such as an address, birth date, PINs or passwords and the last four digits of a Social Security number, they may be able to con the phone company into porting out the number.
• An eSIM isn't enough on its own. The FCC says an eSIM is hardwired inside the phone and not removable, which eliminates some of the security risk for physical SIM swaps, but port-out scams remain a security concern. Its 2023 order also says bad actors have convinced carriers to reassign a virtual SIM to a device they control.

The locks T-Mobile, Verizon and AT&T offer

• T-Mobile: SIM Protection, which T-Mobile says prevents bad actors from moving your number to another device, is free for postpaid customers. Port Out Protection, it says, blocks unauthorized users from transferring your lines to another carrier, and is free for postpaid, prepaid, business and Metro by T-Mobile customers. On a postpaid account, turn on SIM Protection in the T-Life app or at T-Mobile.com under Security, and add Port Out Protection to each line under Manage add-ons.
• Verizon: SIM Protection blocks your lines from all transactions requiring a new SIM, including SIM swaps and device upgrades, Verizon says, and Number Lock prohibits the port out of your number. Both are at no cost to you, it says, and Number Lock doesn't help prevent SIM card changes. Only the Account Owner or an Account Manager can turn them on or off, in the My Verizon app or website, under Security.
• AT&T: Wireless Account Lock blocks SIM and eSIM swaps and changes, and transferring your number to another carrier, among other changes, AT&T says. It calls the lock a free feature in the AT&T app if you have AT&T Wireless service. Only users with primary or secondary access to the account can turn it on or off. On a phone that's active on the account, open the app, tap the person icon, then Wireless account lock, and swipe to lock.
• Switching phones or carriers? Turn the lock off first. AT&T says you won't be able to transfer your number while Wireless Account Lock is on. Verizon says Number Lock must be off to port out, and SIM changes stay blocked for 15 minutes after you turn off SIM Protection. T-Mobile says only the Primary Account Holder can remove its locks on a postpaid account, and you'll get an error if you change SIMs with SIM Protection on.

How to prevent SIM swapping, step by step

1. 1

   Set a PIN or passcode on your phone account. The FTC says to set up a PIN or password on your cellular account, and to check your provider's website for how. T-Mobile calls it an account PIN/Passcode, and Verizon an Account PIN. AT&T says every account has a passcode, and some wireless accounts can add an extra security passcode for signing in online.

2. 2

   Turn on your carrier's lock, from the list above. If your carrier isn't listed, check its website or call it to ask what it offers. If you turn a lock off to switch phones, turn it back on when you're done. Verizon encourages that for SIM Protection.

3. 3

   Where an account offers it, use an authenticator app, a security key or a passkey instead of a code by text. The FTC says an app's passcode isn't susceptible to a SIM card swap attack, and a texted code is better than nothing if it's the only option. In guidance aimed at senior government and political figures, CISA and the FBI say security keys, where feasible, are the most effective, and passkeys are an acceptable alternative.

4. 4

   Never read a code or your PIN to a caller. The FTC's advice: "Never share a verification code. Ever." If a caller says they're from a company you know, hang up and call a number you trust, like the one on your bill, as the FCC advises.

5. 5

   Keep the details scammers ask for to yourself. The FCC says to guard personal details that can be used to verify your identity, and keep them off social media. Where scammers can find your number, and what helps: How do scammers get my phone number?

6. 6

   If your phone suddenly has no service, contact your carrier right away. If you're the target of a SIM swap, the FTC says to contact your provider immediately to take back control of your number.

7. 7

   Once you have your number back, change your account passwords, and check your credit card, bank and other financial accounts for unauthorized charges or changes. The FCC says to contact your bank and file a police report. If a scammer may have your Social Security, credit card or bank account number, the FTC says to see the steps at IdentityTheft.gov.

What do the FCC's SIM swap rules require?

Rules the FCC adopted on November 15, 2023 say wireless carriers must use secure methods reasonably designed to confirm it's you before moving your number to a new phone or another carrier. They must notify you immediately of a SIM change or port-out request, before acting on it, and offer you a lock at no cost. They must also give you an easy way to report fraud, and documentation of it if you ask. Carriers don't have to follow them until the FCC publishes a compliance date, and we found none as of October 16, 2026.

When do carriers have to follow those rules?

Not until the FCC publishes a compliance date in the Federal Register, and when we searched it on October 16, 2026, we found none. The rules took effect January 8, 2024, except the parts that needed a paperwork review, including the notices and locks, which wait for the FCC to announce their effective date. The other parts were due July 8, 2024, but on July 5, 2024 the FCC's Wireline Competition Bureau waived that date. It said compliance with all of the rules will not be required until the Office of Management and Budget completes its review and the FCC publishes a notice in the Federal Register announcing the compliance date. That office approved the paperwork on January 15, 2025.

Do carriers have to do anything before then?

Some existing duties apply. In a December 2023 advisory, the FCC's Enforcement Bureau reminded carriers of their duties to protect customer information, and said a carrier's failure to reasonably protect it, including through allowing fraudulent SIM swap schemes, can independently violate the Communications Act and FCC rules. FCC rules already require carriers to notify customers immediately when a password, online account or address of record is created or changed.

How do I know if my number was taken?

The FCC says loss of service, your phone going dark or only allowing 911 calls, is typically the first sign of SIM swap or port-out fraud. The FTC says an unexpected notice from your carrier that your SIM card was activated on a new device could be a sign too. If either happens, contact your carrier right away, on a number you trust, not one from a text.