SIM swapping: what it is and how to protect yourself
SIM swapping is a scam: a criminal gets a duplicate of your SIM by pretending to be you. Your original SIM stops working and your SMS messages go to the scammer's phone.
With those SMS messages, they can get into your email, social media or banking. That is why it is best not to rely on SMS as your only second factor.
You lose signal for no reason and see bank transactions you don't recognise: call your mobile provider and your bank. Then report it.
How SIM swapping works
Your phone does not need to be hacked. The deception happens at the mobile provider, using personal data the scammer already has.
They get it through phishing, smishing or vishing: fraudulent emails, SMS messages and phone calls.
They pretend to be you when contacting the provider. They often claim they lost their phone or need a replacement card.
When the duplicate is activated, the old card is deactivated. You are left without calls, SMS or mobile data.
With them, they get into your social media, your email or your online banking. Then they act in your name.
Signs it has happened to you
The most common signs are:
- You suddenly lose signal and cannot call or send SMS.
- Verification code SMS messages stop arriving.
- Your provider tells you your line has been activated on another device.
- Bank transactions appear that you don't recognise.
It can be a network outage. If you also get bank alerts or stop receiving codes, treat it as suspicious and call your mobile provider.
What to do in the first minutes
Use another phone. Ask the provider to cancel the duplicate and give you your line back. Ask the bank to block the affected accounts.
Start with your email and banking. Do it from a device you trust.
Save screenshots, emails and messages. Report it to the police in your country so it can be investigated.
How to protect yourself
You cannot stop a criminal from trying to impersonate you. You can make your phone number useless to them.
- Drop SMS as a second factor where you can. An authenticator app, such as Google Authenticator or Microsoft Authenticator, is a better option.
- Use long, different passwords. No personal data and no reuse across services.
- Check your bank transactions regularly.
- Distrust unexpected messages, calls and links. They are the source of the data used to impersonate you.
If you want to go one step further, a physical security key does not depend on your phone number either. We explain it in what 2FA is and how to protect your accounts. If you prefer an app, see how Google Authenticator works.
Two options to get started:
YubiKey 5C NFC
Security key with a USB-C connector and NFC. It works with modern laptops and phones, and supports FIDO2.
Connector: USB-C · NFC: Yes
🇪🇸 Spanish company
ChipNet FIDO2
FIDO2 key with a USB-A connector and no NFC. A basic option from a Spanish company.
Connector: USB-A · NFC: No
If you keep crypto on an exchange, do not use SMS as a second factor. Here is a step-by-step guide to Binance with a passkey and a security key.
The PIN protects your physical card if your phone is stolen. It does not stop a provider from issuing a duplicate to someone else. Use it, but it does not replace the steps above.
Frequently asked questions
What is the difference between a normal duplicate and SIM swapping?
If you lose your phone, your provider issues a duplicate in your name. In the scam, someone else requests it by impersonating you.
How do I know if my SIM has been duplicated?
The most common sign is suddenly losing signal. Your SMS messages may also stop arriving, or your provider may send you an alert.
Does changing the SIM PIN protect me?
It protects your physical card, not the duplicate request. It is a good measure, but on its own it does not stop this scam.
Is SMS better than no second factor?
Yes. SMS stops many basic attacks. But it is the factor you lose if your SIM is duplicated.
SMS is better than nothing, but it should not be your only safeguard.
If you can, replace SMS with an authenticator app or a security key for email, banking and exchanges.
It does not stop someone from trying to impersonate you with your provider. But it removes what they are after: your codes.
As an Amazon Associate, I earn from qualifying purchases.
