Your phone number can be taken over. How SIM swap fraud works

The problem

Many of our accounts send a text message code when we sign in or reset a password. That makes the phone number valuable. If a criminal can get control of your number, those codes go to them instead of you.

This is called SIM swap or port-out fraud. It does not need you to share anything on a call. It works by persuading a mobile provider to move your number somewhere else.

How it can happen

The FCC explains that carriers must now take steps against this. In November 2023, the FCC adopted rules on SIM swap and port-out fraud. They require wireless providers to verify a customer's identity using secure methods before moving a phone number to a new device or provider, and to alert customers right away when a SIM change or port-out request is made on their account. The rules set baseline requirements and let providers choose their own fraud protection measures.

The FTC explains that a scammer who has a password and a verification code together can move money out of savings or investment accounts.

How to avoid it

1. Ask your provider what protection it offers for SIM changes and number transfers, and use it. The FCC leaves the choice of measures to providers, so the options differ.
2. Look out for alerts. Because providers must notify customers about SIM change and port-out requests, a text or email about one you did not make deserves an immediate call to your provider on a number you know.
3. Treat a sudden loss of service as urgent if the phone cannot make calls for no clear reason. Contact your provider from another phone.
4. Never share a code. The FTC says anyone who asks for your verification code is a scammer.
5. Hang up on callers who claim to be your provider and ask for your account PIN or a code. Ring the number on your bill.
6. Tell your bank if you think your number has been taken, and change passwords for your key accounts.
7. Report it. Use ReportFraud.ftc.gov, and see how to report a scam in the US for other steps.

If you have already shared codes or let someone in, follow what to do after you shared a code or gave someone access.

Things to watch

• A text or email from your provider about a SIM change you did not request.
• A phone that suddenly cannot make calls or send texts.
• Messages saying a password reset was requested.
• A caller who knows your details and wants a PIN or code.
• Codes arriving that you did not request.

A related scam, in which a stranger asks you to read out a code, is covered in the Google Voice code article.