Password & accounts. Updated 2026-09-13. About 6 minutes to read.
Turn on your carrier's account or number lock today, then move your email and banking sign ins off SMS to an authenticator app or passkey.
A SIM swap is not a hack of your phone. It is a customer service transaction. Someone contacts your carrier claiming to be you, passes an identity check using details bought from a people search site or leaked in a breach, and has your number moved to a SIM or eSIM in their hand. Your phone drops to no service and their phone starts receiving your text messages.
From there it moves fast. They request password resets on your email, catch the codes by SMS, then walk into your bank, your crypto exchange and your cloud storage. The whole chain depends on one assumption: that a text message proves it is you.
There are two fixes and you need both. Lock the number at the carrier so it cannot be moved, and move your important accounts off SMS codes so that losing the number stops mattering.
The attacker needs your number, your name, and enough personal detail to pass the carrier check. Name, address, date of birth and past addresses are the usual questions, and many people search sites publish all of them. Some attacks skip the call centre and use a bribed or tricked retail employee.
Once the number moves, the attacker resets your email password first, because the email account is the master key to everything else.
If your phone loses service for no reason and a nearby phone on the same network is fine, treat it as an attack in progress. Do not wait to see if it comes back.
The three major US carriers offer free controls that block SIM changes and port outs until you switch them off from inside your own account. It takes about two minutes and it is the highest value step in this guide.
FCC rules adopted in November 2023, with compliance from July 2024, require US wireless carriers to authenticate customers before a SIM change or port out, notify customers of those requests, and offer a free account lock.
Australian carriers have had to run additional identity verification before porting a mobile number since an ACMA industry standard took effect in 2020. Since 30 June 2022, a second set of ACMA rules has required multi factor identity checks for high risk transactions such as SIM swaps and account changes. The ACMA has penalised carriers, including Telstra in 2024, for failing to follow these rules.
The rules raise the bar without making you immune, so add your own lock on top.
In the UK, moving a number between networks uses a PAC, a Porting Authorisation Code. You get one by texting PAC to 65075 from the phone. A STAC, requested by texting STAC to 75075, is for leaving a network without keeping the number.
The scam is simple. Someone persuades you to read out the PAC, or takes over your online account and requests one. With your PAC and your number, they can move the line to their own SIM on another network. Treat a PAC like a bank password, never share it with an inbound caller, and if a PAC arrives that you did not request, contact your network immediately because someone has just tried to move your number.
Carrier locks reduce the risk. Moving off SMS removes the prize. If none of your important accounts accept a text message as proof, a stolen number becomes an inconvenience rather than a catastrophe.
Removing your listings from people search sites makes the carrier identity check harder to pass, because the attacker loses the address, birth date and relatives they were reading off your profile.
Yes. An eSIM is provisioned remotely, so an attacker who passes the carrier check can have your line activated on their device without touching a physical card. The same locks and PINs apply, and they matter more with eSIM because no postal delivery slows the attack down.
It raises the bar without closing the door. A PIN defeats casual attempts, but a determined attacker may still talk a rushed employee around. An account lock that can only be switched off from inside your own signed in app is stronger than a PIN alone.
It removes carrier porting from the picture but moves the risk to the account that holds the number. If someone takes over that Google account, they take the number too, and many banks reject VoIP numbers. An authenticator app or passkey is the better move.
Your phone loses service, calls and texts stop arriving, and you may receive an email or message from your carrier about a SIM change or transfer. Call the carrier from another phone and ask whether a SIM change or port request was processed on your line.