SIM swapping
In plain terms
Your phone number is transferred to a SIM card someone else holds. Your phone loses signal, and verification codes sent by SMS arrive on theirs instead.
Definition
SIM swapping consists of getting your phone number transferred to a card controlled by the attacker, who then receives calls and SMS verification codes meant for you.
How it works
The attacker first gathers enough personal information to pose as you with the carrier — details that are often public, or obtained through prior phishing. They then request the number be transferred to a new SIM, claiming a lost phone or a device change. As soon as it's activated, your phone loses signal: that's the most immediate sign, and it comes shortly before reset attempts begin. The attacker then uses "forgot password" on your accounts and receives the codes by SMS. This attack is why SMS is the weakest second factor.
Warning signs
- Sudden, unexplained loss of mobile signal while the phone still works otherwise
- Unable to call or receive texts with no known carrier outage
- A carrier notification about a SIM card change you didn't request
- Reset emails received right after the signal loss
- Unusual prior contact asking for personal information or an ID document
How to verify
If signal disappears for no reason, put the SIM in another device or check with another line whether there's a local outage. If there's no outage, call the carrier immediately from another line: the gap between the transfer and its exploitation is short.
What to do
Ask your carrier to add a confidential code or a port-out block on the line. Replace SMS-based two-factor authentication with an authenticator app or a security key wherever possible, since these don't depend on the number.
If it already happened
Call the carrier from another line to have the transfer canceled, then contact your bank. From a clean device, change the passwords of sensitive accounts starting with email, and remove the number as a recovery method wherever possible. File a police report and report the incident to the relevant authority.
Frequently asked questions
- Why does my phone suddenly have no signal?
- A number can only be active on one SIM at a time. If a transfer has taken place, your SIM is deactivated instantly. That's why a sudden loss of signal, with no known outage, deserves an immediate call to the carrier from another line.
- Should I give up on SMS-based two-factor authentication?
- It's better than nothing and still preferable to a password alone. But as soon as a service offers an authenticator app or a security key, prefer it: these methods don't depend on the number and so aren't affected by this attack.
Related attacks
Official sources
This article is part of the Credentials and accounts family. Last updated: 2026-08-31.