SIM Swap Scams Explained: How Criminals Hijack Your Number (and How to Stop Them)

Your phone number has quietly become a master key. Banks, email providers and payment apps send one-time passwords (OTPs) to it, and many let you reset a password with nothing more than a text. A SIM swap scam exploits exactly that: a criminal moves your number onto a SIM they control, and every code meant for you lands on their phone instead. It's the main reason SMS codes are the weakest form of two-factor authentication. Here's how the scam works, the signs to watch for, and the steps that genuinely stop it.

What is a SIM swap scam?

A SIM swap scam is when a criminal convinces or bribes a mobile carrier to transfer your phone number to a SIM card or eSIM in their possession. Once that happens, your phone loses service and their phone starts receiving your calls and texts, including bank OTPs and password-reset codes.

Your number lives in your carrier's systems, not on the card itself, and the carrier can point it at a new SIM whenever a customer reports a lost or upgraded phone. Scammers abuse exactly that process.

Port-out fraud and eSIM swaps

A close cousin is port-out fraud, where the criminal poses as you and moves your number to a different carrier altogether, using the same number-portability system people use to switch providers. The rise of eSIMs adds another route: if someone can get into your carrier account or app, they may be able to request an eSIM for your number on their device without ever touching a plastic card.

How do criminals pull it off?

Most SIM swaps rely on tricking people rather than breaking technology. The FBI's Internet Crime Complaint Center describes three main methods:

• Social engineering: the criminal calls or visits the carrier pretending to be you, armed with personal details gathered from social media, data breaches or earlier scams
• Insider help: a carrier or retail employee is paid to make the switch
• Phishing: staff are tricked into installing malware that gives attackers access to carrier systems

Scammers often target you first, with a fake "KYC update" message or a call claiming to be from your bank, to collect the details they need. Spotting phishing messages is your first line of defence.

Why is your phone number such a valuable target?

Because a phone number often unlocks everything else. With your texts arriving on their phone, a criminal can hit "Forgot password" on your email, receive the reset code, and then use your email to reset other accounts, including banking, payment and crypto apps.

The losses are real. The FBI reported that between January 2018 and December 2020 it received 320 SIM swap complaints with adjusted losses of about $12 million, and in 2021 alone it received 1,611 complaints with losses of more than $68 million. Those are only the cases reported to one agency in one country, so they show the direction of travel rather than the full picture.

What are the warning signs of a SIM swap?

The clearest sign is your phone suddenly showing "No service" or "Emergency calls only" in a place where it normally works fine. If that happens and a restart doesn't fix it, treat it as urgent.

• Texts and calls stop arriving
• A message from your carrier about a SIM change, eSIM activation or port request you didn't make
• Password-reset emails or "new sign-in" alerts you didn't trigger
• Bank alerts for transactions, new payees or UPI registrations you don't recognise

This is why bank alerts by email and app notification matter, not just SMS: if your number is hijacked, text alerts go to the criminal, but an email or in-app alert can still reach you.

How do you protect yourself from a SIM swap?

The single most effective step is to stop relying on your phone number to prove who you are. Move important accounts to an authenticator app, a passkey or a security key, so a stolen number no longer opens the door.

Source: FBI IC3: SIM swap public service announcement, which recommends authenticator apps, biometrics or physical security tokens over SMS.

Start with your email, since it can reset almost everything else. Passkeys are worth turning on wherever they're offered, and a password manager makes it easy to use unique passwords so one breach can't be chained into others.

Lock down your mobile account

• Set an account PIN or passcode with your carrier and ask whether it offers a port-out or SIM-change lock
• Secure the carrier app with a strong, unique password, since it may be able to issue eSIMs
• Never read out OTPs to anyone who calls you, whatever they claim to be
• In India, check connections in your name on the Department of Telecommunications' Sanchar Saathi portal and report any number you didn't take

Sanchar Saathi also notes that under TRAI's rules, SMS on a re-issued SIM is enabled only 24 hours after activation, a short window to notice lost service and act.

What should you do if it happens to you?

Act within minutes, not hours. Contact your carrier from another phone to regain control of your number, then call your bank to freeze transfers and flag your accounts for suspicious activity.

1. Call your carrier using its official number and ask them to block the new SIM or eSIM
2. Call your bank and card providers and ask them to freeze transactions and watch for new payees
3. From a safe device, change your email password first, then other key accounts, and sign out other sessions
4. Switch those accounts to app-based codes or passkeys so the number can't be used again
5. Report it: in India, call the cyber-crime helpline 1930 or file at cybercrime.gov.in; in the US, report to the FBI's IC3; elsewhere, use your national cyber-crime reporting service

A SIM swap only works when your phone number is the key to everything. Take that power away, lock your mobile account, and a stolen number becomes far less useful.

Frequently Asked Questions