Imagine your phone suddenly losing signal. You try to call, send SMS, and open the carrier's app, but everything fails. A few minutes later, an email notifies you that your account password has been changed.
One possibility to be wary of is SIM swap—a scam where the perpetrator convinces the mobile operator to transfer your number to a SIM card or eSIM that they control. After that, calls and SMS that should come to your phone are redirected to the perpetrator's device, including verification codes sent via SMS.
This attack does not always start from complex technical vulnerabilities. The perpetrator can exploit personal data available on the internet, phishing results, or information leaked from other services. Since phone numbers are often used for account recovery and two-factor authentication, the impact can extend to email, social media, digital wallets, and even bank accounts.
How does SIM swap work?
In a typical scenario, the perpetrator contacts the operator and pretends to be the owner of the number. They may claim their phone is lost or damaged, then request the number to be transferred to a new card. If the operator's verification process is successfully bypassed, the victim's SIM card stops connecting to the network.
The perpetrator then attempts to log into accounts they already know, for example, from reused passwords or data breaches. If that account sends a login code via SMS, the perpetrator can receive that code because the phone number is now in their possession.
The Federal Trade Commission warns that SIM swap can be used to take over email, social media, and financial accounts. This means that a sudden loss of signal is not a symptom to be ignored.
Signs to be suspicious of
- Your phone suddenly displays “No Service” or cannot receive calls and SMS, while other devices in the same location are functioning normally.
- You receive notifications from the operator about SIM activation, device changes, or account modifications that you did not initiate.
- An email notifies you of a password change, recovery address, or a new device accessing your account.
- Verification codes arrive repeatedly, and then several accounts suddenly request you to log in again.
- Your banking or digital wallet app alerts you to transactions or profile changes that you do not recognize.
One sign alone does not prove that a SIM swap is occurring. Network disruptions, a damaged card, or operator issues may also be the cause. However, a combination of signal loss and unfamiliar security notifications should be treated as an emergency.
What you can do before an incident occurs
1. Set a PIN or password on your operator account
Many operators provide an additional PIN or passcode to prevent sensitive changes to mobile accounts. Activate this feature and avoid using easily guessable numbers, such as birth dates or the last four digits of your ID number.
This protection is not an absolute guarantee, but it adds an extra layer of verification when someone tries to change a SIM or transfer a number. CISA also recommends using a PIN and MFA on operator accounts to reduce the risk of SIM swap.
2. Reduce reliance on SMS codes
Two-factor authentication via SMS is still better than having no additional protection at all. However, SMS relies on control of the number. If the number is illegally transferred, the verification code can also be redirected.
For your primary email, cloud accounts, social media, and financial services, use an authenticator app, passkey, or security key if available. According to the FTC, authenticator apps and security keys are more secure against SIM swap than codes sent via SMS.
3. Secure your email first
Your primary email often serves as a “backup key” for other accounts. Ensure the password is long and unique, enable two-factor authentication, and check your recovery email address and phone number. Remove recovery methods that are no longer in use.
If you use the same password across multiple services, change them gradually. Start with your email, banking, digital wallet, work accounts, and accounts that store personal data.
4. Limit personal information displayed
Avoid publicly displaying your phone number, home address, full birth date, or family details. Such information can help perpetrators answer verification questions or make their stories sound convincing when contacting the operator.
If your number suddenly stops working
- Contact your operator through official channels as soon as possible. Use a previously saved customer service number, the official app, or visit a store in person. Do not rely on numbers from SMS or suspicious search results.
- Ask the operator to check for SIM changes or number porting. Inquire when the change occurred and request recovery of the number to your card or eSIM.
- Once the number is restored, change the passwords for important accounts. Start with your primary email, financial accounts, work accounts, and social media.
- Log out of all sessions and devices. This is important to remove any perpetrators who may have successfully logged in.
- Check transactions and setting changes. Look for transfers, purchases, recovery addresses, email forwarding rules, or unfamiliar new devices.
- Contact your bank and financial service providers. Request monitoring or temporary blocking if there is suspicious activity.
If you have already given your password or code to a scammer, do not wait until losses occur. Immediately change your credentials from a trusted device and inform your contacts not to trust messages that may be sent from your account.
What does this mean for us?
Phone numbers are practical, but they should not be the only key to all accounts. Stronger protection starts with a simple combination: operator PIN, unique passwords, authentication through apps or passkeys, and a recovery email that is still accessible.
Take about 15 minutes today to check your operator account and primary email. Ensure you know how to contact your operator, have backup login methods, and do not rely solely on SMS. That small step can reduce panic if one day your phone suddenly loses signal.
Sources & further reading
- SIM Swap Scams: How to Protect Yourself
- Use Two-Factor Authentication To Protect Your Accounts
- Mobile Communications Best Practice Guidance
– Rio Yotto @rioyotto
