Your phone number has quietly become one of the most important keys to your digital life. Banks send login codes to it, email accounts use it for password resets, and messaging apps treat it as your identity. That is exactly why criminals want it. In a SIM swap attack, a fraudster convinces your mobile operator — or bribes or tricks someone inside the process — to move your number onto a SIM card they control. Within minutes, every call and text message meant for you goes to them instead, including the one-time codes that protect your accounts.
How a SIM swap attack actually works
The attack usually starts long before the swap itself. Criminals gather personal details from data breaches, social media profiles and phishing messages: your full name, date of birth, address and sometimes answers to common security questions. Armed with this information, they contact the mobile operator pretending to be you, claim the phone was lost or damaged, and request the number be transferred to a new SIM. Once the transfer completes, your own phone loses signal — often the first and only warning — while the criminal begins resetting passwords. Email is usually the first target, because controlling email unlocks almost everything else. From there, banking apps, wallets and social accounts can fall in quick succession. This is also why it is worth regularly checking which mobile connections are issued in your name, so unknown numbers do not go unnoticed.
Warning signs your number may have been targeted
The clearest sign is sudden loss of service: your phone shows “no signal” or emergency calls only, in a place where coverage is normally fine. Other signals include unexpected text messages about account changes you did not request, password-reset codes arriving that you never asked for, and being locked out of apps that were working an hour earlier. Treat any of these as urgent. Minutes matter in a SIM swap, because the attacker is racing to move money before you regain control. More consumer guidance is available on the TAFCOP portal resources we publish for mobile users.
How to protect yourself today
Several practical steps dramatically reduce your risk. First, ask your operator to set a PIN or password on your account that must be quoted before any SIM change, and never share it. Second, move important accounts away from SMS codes wherever possible: authenticator apps and hardware keys are far harder to defeat, a point emphasised in consumer guidance from the U.S. Federal Communications Commission and in security advice published by CISA. Third, reduce your public footprint — birthdays, addresses and pet names posted openly online become answers to security questions. Finally, use a separate, private email address for financial accounts and protect it with the strongest authentication you have.
It also helps to know what your operator will never do. No legitimate provider asks customers to share one-time codes, PINs or passwords by phone, text or social media, and no genuine support agent needs you to install a screen-sharing app to “verify” your SIM. Any contact that creates urgency — act now or lose your number — is using the fraudster’s favourite tool. Slow down, end the conversation, and contact the operator through the official number printed on its website or your bill.
What to do if it happens to you
If your signal vanishes unexpectedly and you suspect a swap, act immediately. Contact your operator from another phone and demand the transfer be reversed and the account frozen. Then call your bank’s fraud line and ask for outgoing transfers to be blocked. Change passwords starting with email, then banking, then everything else, and review recent account activity for changes to contact details or new payees. Report the incident to your local cybercrime or police portal and keep records of every call. Speed genuinely limits damage: many victims who react within the first hour lose nothing.
The bottom line
SIM swap fraud succeeds because a phone number was never designed to be a security key, yet we use it as one. Until systems change, the defence is a mix of operator-level locks, app-based authentication and quick reactions to the warning signs. Spend fifteen minutes today setting an account PIN and moving your bank to an authenticator app — it is some of the highest-value security work you will ever do.