SIM-swap protection

How attackers hijack your phone number to take over exchange and email accounts, the warning signs, and how to lock your number down.

Last reviewed 2026-10-27 · 2 min read

On this page
  1. How it usually happens
  2. Warning signs
  3. How to protect yourself
  4. If you have been SIM-swapped

A SIM swap happens when an attacker convinces your mobile carrier to move your phone number to a SIM card or eSIM they control. From that moment, your calls and SMS messages, including password reset links and 2FA codes, go to them.

Crypto holders are a favourite target, because one hijacked number can unlock an exchange account in minutes.

How it usually happens

  • The attacker gathers personal details about you from data leaks, social media or public records.
  • They contact the carrier pretending to be you, or bribe or trick an employee, and request a new SIM or a number transfer (port-out) to another carrier.
  • Once the number is theirs, they reset your email and exchange passwords via SMS.

Warning signs

  • Your phone suddenly shows "No service" or "SOS only" in a place where it normally works.
  • You receive a message from your carrier about a SIM change or port request you did not make.
  • You get unexpected password reset emails.

If this happens, contact your carrier immediately from another phone and then secure your email and exchange accounts from a trusted device.

How to protect yourself

  1. Stop using SMS for 2FA wherever an authenticator app or security key is available. See two-factor authentication.
  2. Remove your phone number as a recovery method on email and exchange accounts where you can.
  3. Ask your carrier about account protection. Many carriers offer a port-out PIN, a SIM lock, a number lock, or an account passcode required for any SIM change. Names and availability differ by country and carrier.
  4. Use a separate number, or none at all, for crypto accounts. A number you never post publicly is harder to target.
  5. Share less publicly. Your full name, birthday, address and phone number together make social engineering much easier.

If you have been SIM-swapped

  1. Get the number back through your carrier and add the strongest protection they offer.
  2. From a clean device, change passwords on your email, then exchanges, then everything else.
  3. Review active sessions and connected devices on each account and log them out.
  4. Check exchange withdrawal history and address allowlists for changes.
  5. File a police report: carriers and exchanges may need one.