How do I protect my phone number from a SIM swap attack?

A SIM swap attack is a sophisticated form of identity theft where a cybercriminal convinces your mobile phone carrier to transfer your phone number to a new SIM card under their control. The scammer typically uses spear-phishing or leaked personal data to pass the carrier’s identity verification questions. Once they control your number, they can intercept your incoming calls and text messages, allowing them to reset your passwords and bypass SMS-based two-factor authentication (2FA) on your bank accounts, email, and social media.

Protecting yourself requires taking proactive security measures with both your cellular provider and your digital accounts. Your first line of defense is to secure your cellular account directly. Call your carrier and request a port freeze or transfer lock, which prevents your number from being moved to a new device or carrier without strict, in-person verification. You should also set up a unique, complex PIN or passcode on your cellular account that is completely separate from your phone’s lock screen PIN. Never reuse passwords or PINs across different services.

Your second, and most important, defense is to move away from SMS-based two-factor authentication entirely. Because text messages can be intercepted via SIM swapping, they are the weakest form of multi-factor authentication. Instead, switch your digital accounts to use authenticator apps like Google Authenticator or Microsoft Authenticator, which generate codes locally on your physical device rather than receiving them over the cellular network. For high-security accounts like your primary email and financial portals, the absolute gold standard of protection is a physical hardware security key like a YubiKey security key, which requires a physical tap on your device to authorize logins, making remote account takeovers virtually impossible.