The short answer
A SIM swap moves your phone number onto an attacker’s SIM card. Once it lands, every SMS code sent to that number arrives on their device instead of yours — and because so many services treat “controls this phone number” as proof of identity, that one move can unlock a password reset, a second factor, and an account recovery flow in sequence.
Your phone number was never designed to be an identity credential. It became one by accident, and the fix is to stop relying on it wherever you are allowed to.
How the takeover actually works
The attack is social engineering against your mobile operator, not a technical break of anything.
First, groundwork. The attacker needs enough about you to pass a carrier’s identity check: full name, date of birth, address, account number, sometimes the last few digits of a payment card. This comes from breach data, social media, or a phishing message that asked you to “confirm your details”.
Then the port. They contact your carrier as you and request the number be moved to a new SIM — a replacement for a lost phone, or a transfer to a different operator. A carrier agent who accepts the answers completes it. In some documented cases the agent was bribed or was the attacker’s accomplice, which is why “but I have a PIN” is not a complete defence.
At that point your handset silently loses service and theirs gains your number.
Then the cascade. Password reset to your email, code sent by SMS, mailbox taken. From your mailbox they enumerate your banks, brokers and exchanges, and reset those too. The phone number is rarely the target; it is the key that opens the recovery paths for everything else.
The first sign, and it is easy to miss, is your phone dropping to “no service” and staying there. Not a dead battery, not a bad area — no service, indefinitely, while WiFi still works.
Why SMS is the weak factor
An authentication factor is only as strong as the process that can reassign it. SMS delivery is protected by your carrier’s account-recovery procedure, which is staffed by people optimising for customers who genuinely lost their phones. It was never built to resist a targeted attacker with your date of birth.
Two consequences that are easy to miss:
SMS as a second factor is weak but not worthless — an attacker still needs your password as well, so it beats a password alone. SMS as an account recovery method is far worse, because it often replaces the password entirely. A service that lets you reset the password using only an SMS code has quietly made your phone number the whole credential, and the strength of your password stops mattering.
So the priority is not just moving off SMS for login. It is finding every place SMS can reset something.
What to change, in order of effect
1. Lock the number at your carrier. Ask for a port-out PIN, a transfer lock, or whatever your operator calls it — the names differ by country and provider. It is normally free, takes one call or a settings toggle, and is the only control that addresses the attack at its source rather than its consequences. Ask specifically what an agent can override, and under what conditions.
2. Move your email off SMS. Your mailbox is the real prize, because it is the recovery path for everything else. Secure it with an authenticator app or a hardware key, and then check its recovery settings — an account protected by a security key but recoverable by SMS is protected by SMS.
3. Replace SMS codes with something bound to a device. In rough order of resistance: a hardware security key, then a passkey, then a time-based code from an authenticator app, then SMS. Anything in the first three is unaffected by somebody else holding your number.
4. Audit every account’s recovery path, not just its login. This is the step people skip. Go into each important account and look at what can be used to get back in: phone number, backup email, security questions, printed recovery codes. Remove the phone number where the service allows it. Store recovery codes somewhere that is not the phone.
5. Remove your number where it is not needed. Many services keep a phone number on file for marketing or convenience and will happily use it for recovery later. Fewer places holding it means fewer paths in.
Where your bank will not let you
Some banks mandate SMS and offer nothing else. This is common, it is outside your control, and pretending otherwise is not useful. Practical mitigations when you are stuck with it:
Ask what non-SMS options exist — many banks support an in-app approval, a card reader, or a national electronic ID scheme, and it is often available without being the default. Ask whether a verbal password or telephone passcode can be added to your bank account, so a caller who has your number still cannot pass identification. Set up transaction alerts through a channel other than the compromised one, and consider whether the number your bank holds needs to be the same number you publish, use for two-factor codes, and hand to every retailer.
If it happens
Speed dominates everything. The window between losing service and losing your mailbox is short.
Contact your carrier from another line and say the words “I believe my number has been ported without authorisation” — that phrase routes you to the right process faster than describing symptoms. Then call your bank’s fraud line, not its general number, and ask for a freeze rather than a warning on the account. Then change the password on your email from a device you still control, and check its forwarding rules and recovery settings, because a mailbox is often left with a quiet forward in place after the intrusion.
Report it to your national police or fraud reporting service. Beyond the individual case, a documented report is what eventually forces carrier procedures to improve.
The uncomfortable part
You cannot fully solve this yourself. The decisive control sits with a mobile operator whose identity checks you do not set, cannot audit, and did not agree to. Everything on the list above is you reducing your dependence on a process you have no authority over.
Which is the honest reason to do step 1 and step 2 this week rather than reading further. Lock the number, get your email off SMS, and the cascade loses the two links it depends on.
Related: what you actually agree to when an app connects to your bank covers the connected-app list worth reviewing at the same time, and screen scraping or a real API explains why an app holding your banking password is a different class of exposure from one holding a token.