SIM swap, what to do

Your phone number was stolen in a SIM swap when the carrier moved it to a SIM or an eSIM you do not hold. A port-out is the cousin of that scam. Someone asks a different carrier to take the number. Either way, your phone goes quiet and their phone starts receiving your calls and texts. That includes password-reset codes.

The FCC’s 2023 order describes both tricks. The attacker never needs your handset. They talk the wireless company into redirecting the number. US rules now tell providers to authenticate the customer before a SIM change or a port, to notify the customer when a request is made, and to offer a lock that blocks those requests. The lock only helps if it was already on. The call you make today is what gets the number back.

The longer checklist is Phone number stolen in a SIM swap. If the handset itself is gone, use Phone lost or stolen as well. The email account is the usual next target, because email can reset everything else. Use Personal email account hacked as soon as a reset mail shows up that you did not start.

Who you call, and which form you file, depends on the country. The shape is the same. Carrier first, then email, then the bank.

Call the carrier from a phone that still works

Use a friend’s phone, a work line, or a landline. Look up the carrier on a bill, on the back of your own phone plan, or in an app you already trust. A number inside a text that arrived with the outage can be the scammer.

Say the number may have been moved without your permission. Ask them to freeze further SIM changes and ports, reverse the one that just happened, and put a fraud note on the account. Ask whether it was a SIM replacement or a transfer to another carrier, and what time it went through. Write down the case number and the name of the person you spoke to.

Keep every text the carrier sent about a new SIM, a new device, or a transfer. Those are the evidence.

In Australia, the ACMA’s stolen-number page (updated 24 July 2025) is more specific. Ask whether someone ported the number without consent, and ask the telco to reverse the port. If the number is on a SIM the other person bought, ask the telco to deactivate that SIM and send you a new one. Australian telcos have to confirm identity before a port or a SIM swap, under the mobile pre-porting standard and the customer identity authentication determination. A code by SMS, a call to the mobile, or an identity document are examples the ACMA lists. Those checks failed or were bypassed if you are reading this. The call still has to happen.

Secure email before the signal comes back

Waiting for bars to return leaves the codes in the other person’s pocket. From a computer or a tablet you trust, open your email the way you usually do. Change the password. Sign out other sessions. Remove recovery phone numbers you do not recognise. Add a recovery method that does not depend on this SIM.

CISA’s mobile guidance (November 2025) says to stop using SMS as a second factor. The messages are not encrypted. Someone who can take the number can read them. CISA wrote that guidance for highly targeted people, and they also say the practices apply more broadly. The SMS line is the one that matches this incident.

CISA’s order of operations matters. Enroll an authenticator app, a passkey, or a hardware key first. Then turn SMS off on that account. Turning the app on does not automatically remove the text option. A leftover text fallback is enough for the next swap. Start with email, the bank, and the password manager. Those three reset everything else.

Then tell the bank, from the number on the card or from the bank’s own app. Say the mobile number is compromised. Ask them to stop approvals that arrive by phone or by text until you say otherwise. Check for transfers, new payees, and password resets you did not make. A number that comes back does not reverse a payment that already left.

What Verizon, T-Mobile, and AT&T offer

These are the locks you turn on after the line is yours again. They are also the settings to ask about while you are on the phone. Names differ. A prepaid line often uses a different menu from a monthly plan.

Verizon. Number Lock is free. It stops the mobile number from moving to another line or another carrier until you turn it off. SIM Protection, on the same Security page in My Verizon, is the switch for a SIM change or an equipment change. You can turn Number Lock on by dialing *611, or in My Verizon under Security. If Verizon texts you that a move was requested and you did not ask for it, call the number in that message. Verizon also says they never ask you for your Number Transfer PIN. Customer service is 800-922-0204. SIM Protection’s own page says a number with it on is blocked from SIM swaps, upgrades, and bring-your-own-device changes. After you turn SIM Protection off, Verizon keeps SIM changes and upgrade orders blocked for another 15 minutes.

T-Mobile. Their fraud page tells current customers to contact T-Mobile as soon as they see fraud on the account. SIM Protection is free on postpaid accounts. It blocks a move of the number onto another device. In the T-Life app, open the Manage tab, the gear, Security, then SIM Protection. Only the primary account holder can remove it. Port Out Protection is a separate free add-on, including on prepaid and Metro by T-Mobile. Add it to each line. In T-Life, that checkbox is under Manage, See Plans, Manage add-ons.

The account PIN is a third control, for when you call customer service. Only the primary account holder can change it. T-Mobile wants 6 to 15 digits that are not a run of numbers, not a repeat, and not your phone number, your billing account number, your tax ID, or your date of birth. Change it from the T-Life app or the mobile site while the phone is on the T-Mobile network, with Wi-Fi off. The page lists 1-800-937-8997 for help getting a transfer PIN. That is a support line for a PIN, not a promise that a transfer can be undone.

AT&T. Wireless Account Lock is free in the AT&T app, on a device that is active on the wireless account. Open the app, tap the person icon, then Wireless account lock, and swipe to lock. It covers every phone, tablet, watch, hotspot, and laptop on the wireless account. Other AT&T services, such as home internet, are outside that switch. Primary and secondary users can toggle it. Other users cannot. AT&T emails the primary holder and texts each active wireless number when the lock changes. Prepaid uses a different path in the same article: Profile & Settings, Account Info & Preferences, then a one-time code by text. AT&T’s announcement of the lock says it blocks billing changes, number transfers, device purchases, and a SIM swap onto a different device. AT&T says they will not call or text you and ask you to turn the lock off.

If your carrier is none of these, ask for the same two locks in their words. One lock blocks a new SIM. The other blocks a move to a different company. CISA also says to set a carrier PIN or passcode, then store a new account password in a password manager. Save the fraud number and the account number somewhere other than this phone.

Report the money, in the right country

A SIM swap is often the start of a payment, not the end of the story. Report unauthorized charges to the bank or the card company the same day. Steps and deadlines differ by country. Use the process your bank publishes.

United States. The FCC order is about the phone company, not the bank. For the money, call the bank. If new credit accounts are the worry, T-Mobile’s fraud page points at a security freeze or a fraud alert with the three bureaus: Equifax at 1-888-766-0008, Experian at 1-888-397-3472 or 1-888-397-3742, and TransUnion at 1-800-680-7289. The same page lists the FTC at 1-877-382-4357. A freeze can slow a loan or a new phone plan you apply for yourself. That is the tradeoff their page describes.

United Kingdom. Ofcom says that if you already shared information or sent money, call the bank on the number printed on the card, use the bank’s website or app, or call 159 where your bank supports it. Then report to Report Fraud online or on 0300 123 2040. In Scotland, report to Police Scotland on 101. Contact the mobile provider through a number you looked up yourself. Ofcom will not call you and ask for bank details. Citizens Advice, on 0808 223 1133 on weekdays, is the support line Ofcom lists if the scam has knocked you sideways. In Scotland that support line is Advice Direct Scotland, 0808 164 6000.

Australia. After the telco and the bank, the ACMA says to report fraud to local police or the Australian Federal Police, and to report cybercrime to the Australian Cyber Security Centre. IDCARE, on 1800 595 160, is the support service they name for identity crime. Scamwatch is the place they name for the scam report.

When the number is back on your SIM

Make one test call and receive one test text. Then ask the carrier to confirm that no other SIM and no pending port are still active. Change the account PIN to something that is not your birthday and not part of the phone number. Turn on the SIM lock and the port lock, under whatever names that carrier uses.

Walk the important accounts again. Email, bank, password manager, and social logins should list only your devices. Anywhere SMS is still the only second factor, replace it, then disable the text option. CISA notes that some sites fall back to SMS during recovery even after you enroll a stronger method. Check the recovery settings, not only the login screen.

The phone in your hand may be fine. Resetting it does not move the number back, and it can erase texts you wanted to keep. Treat the carrier account as the thing that was taken.

If service returns and the locks are on, open Phone number stolen in a SIM swap and finish the prepare list. If a mailbox was reset while the number was gone, do Personal email account hacked before you put the phone down.

Related playbooks

• Phone number stolen in a SIM swap. Your phone suddenly loses service because someone moved your number to another SIM or mobile provider.
• Phone lost or stolen. Your phone is gone, and it is signed in to your email, your bank, your messages, and the codes that protect everything else.
• Personal email account hacked. Someone else is in your email, which means they can reset the password on almost everything else you own.