SIM Swap and Port-Out Fraud: How to Lock Your Number

Your number moves to someone else’s phone.

In a SIM swap, a criminal convinces your carrier to move your phone number to a SIM card or eSIM they control. In port-out fraud, they open an account with another carrier and transfer your number there. Either way, your calls and texts, including the one-time codes that banks, email, and social media send by text, go to them. The FCC warns that this is how criminals get into financial and other private accounts. An eSIM removes the physical card a thief could steal, but not the risk of a fraudulent transfer.

No service, or a notice you did not expect.

Your phone suddenly has no service, or shows emergency calls only, when it normally works there. Or you get a notice about a SIM change or number transfer you did not request. The FCC calls loss of service — the phone going dark or only allowing 911 calls — typically the first sign. Treat it as urgent: the scammer is racing to reset as many financial and social media accounts as possible before you notice.

FCC rules from November 2023.

On November 15, 2023, the FCC adopted rules requiring wireless providers to use secure methods of authenticating a customer before redirecting the phone number to a new device or provider, and to notify customers immediately whenever a SIM change or port-out request is made on their account. The rules set a baseline and leave providers flexibility to offer stronger fraud protection, so ask your carrier what it offers beyond the minimum, such as an account or number lock, and turn it on.

Four settings with your carrier and your accounts.

Steps from the FCC’s guidance:

1. Add a PIN or password to your wireless account, different from any other PIN you use, and ask whether a separate number-transfer PIN is required for port-outs.
2. Turn on the account lock or port-out protection if your carrier offers it.
3. Turn on alerts: email and text notifications on financial and other important accounts, so an unauthorized change reaches you quickly.
4. Share less: the FCC says to keep details used to verify identity — the last four digits of your Social Security number, your phone number, date of birth, car, pet’s name, mother’s maiden name — off social media, and not to give personal information to anyone who calls or texts asking for it.

Then reduce what a stolen number unlocks: move important accounts from text-message codes to an authenticator app, a security key, or a passkey, as the two-factor guide ranks them.

Carrier first, then the accounts.

The FCC’s steps: contact your phone company, from another phone or in a store; contact your bank and other financial institutions; file a police report; and place a fraud alert on your credit reports and get copies of them. Then change the passwords on email and financial accounts and check their recovery phone numbers. The data breach checklist explains fraud alerts and credit freezes. You can file a complaint with the FCC for free, and report identity theft to the FTC.

Close the old door behind you.

When you replace a phone, erase it before passing it on; the FCC says to always wipe eSIM data from a phone you are replacing. Unexpected calls asking you to “confirm” a SIM change or read back a code are part of the scam; hang up and call the carrier on the number on your bill. Fewer unknown calls helps too; see how to stop robocalls.