How to protect yourself from a SIM swap

Your phone number lives on your carrier's systems, not on the SIM card. A SIM swap moves it to a SIM the attacker holds, and a port-out moves it to a different carrier. Either way, your phone loses service and the attacker receives your texts and calls.

The FBI describes three ways criminals do it: social engineering, where they impersonate you to a carrier employee using personal details they found online; insider threats, where they pay a carrier employee; and phishing carrier staff to get into internal systems. Once they have the number, they hit "forgot password" on your email, bank, and exchange accounts and receive the reset codes themselves.

The IC3 received 971 SIM swap complaints in 2025, with $17.4 million in reported losses, or about $17,900 per complaint. That is down from 1,075 complaints and $48.8 million in 2023.

All three major US carriers offer a free lock that blocks SIM changes (on T-Mobile, postpaid accounts only), and each has a way to block port-outs, sometimes as a separate setting. Turn on both kinds. You will need to switch them off yourself before you upgrade your phone or move to a new SIM.

A carrier lock lowers the odds of a swap, and removing SMS codes from your accounts makes a successful swap far less useful. The FBI recommends strong multi-factor authentication methods, such as physical security tokens or standalone authenticator apps, and Google's help page says codes sent by text or call can be vulnerable to phone number-based hacks.

Start with your email, because email resets everything else.

The FBI's first piece of SIM swap advice is to keep information about your financial holdings, including cryptocurrency, off social media and public forums. Attackers pick targets who look worth the effort, and an exchange account protected by SMS is one of the fastest payouts: take the number, reset the email, reset the exchange password, withdraw.

Bitcoin in your own hardware wallet has no phone number attached, and no carrier employee can reset a seed phrase. Moving long-term savings off exchanges, as in my hardware wallet guide, removes the biggest prize a SIM swapper is looking for, and the carrier locks above protect what stays behind.

On November 15, 2023, the FCC adopted rules requiring wireless carriers to use secure methods to authenticate a customer before a SIM change or port-out, to notify customers of those requests, and to offer every customer, at no cost, the option to lock their account against SIM changes and ports. Authentication may not rely on readily available biographical or account information.

Those rules are not yet in force. As of November 2026, the Code of Federal Regulations still says compliance with both the SIM change and the port-out sections is not required until a compliance date is set, and none has been. The carrier features above work today, so use them.