SIM swap protection needs two layers: reduce the chance that someone can move the phone number, and reduce the damage if the number is moved anyway. Secure the carrier account, use any available port or SIM-change lock, replace SMS-only recovery on important accounts where stronger options exist, and keep an offline response plan.
Understand what is at risk
A fraudulent SIM change can move calls and text messages for a phone number to another device. Sudden loss of calls, texts, and mobile data or an unexpected carrier notice about a new SIM can be warning signs. The Federal Trade Commission explains that a person controlling the number may receive text-message login codes and use them against email, financial, or social accounts (FTC SIM swap guidance).
Make a short list of accounts that use the mobile number for sign-in, password reset, alerts, or customer contact. Prioritize the primary email account, password manager, financial services, cloud accounts, social profiles, and carrier account itself. Do not copy passwords or recovery codes into this list.
Strengthen the carrier account
Set a unique carrier-account password and enable a separate account PIN or passcode when offered. Remove former account managers and obsolete authorized lines. Confirm the email address and alternate contact used for carrier notices, and protect that email with strong authentication.
Ask the carrier which controls apply to both SIM changes and number ports. Names vary: number lock, port freeze, transfer lock, or account takeover protection. Record how the control is enabled, what it blocks, who can disable it, and the recovery process if the phone is lost. The FCC's SIM swap and port-out order requires covered wireless providers to offer customers an account-lock option that blocks SIM changes and number ports until the customer deactivates it, subject to limited exceptions (FCC 23-95). Actual menus and eligibility still vary by provider and account type, so verify the live carrier instructions.
Do not use answers to public biographical questions as account verification if the carrier offers stronger choices. Keep carrier support numbers and the account number in a protected offline record so help is reachable when the phone cannot receive a code.
Reduce reliance on the phone number
For critical accounts, review whether an authenticator app, passkey, or hardware security key can replace SMS as the primary second factor. Store backup methods according to the provider's instructions and test them before removing the old method. The FTC specifically warns that text-message verification might not stop a SIM swap and suggests an authentication app or security key for sensitive accounts (FTC SIM swap guidance).
Changing authentication can lock you out if recovery is incomplete. Verify at least one independent recovery path from another trusted device before making the phone number secondary. Avoid using the same mobile number as the only recovery method for both the main email account and the password manager.
Verify notices and change controls
Confirm which channels the carrier uses for SIM-change and port-out notices and whether they arrive before or after a request. The FCC order requires customer notification of SIM-change requests before the provider performs the change, with specified exceptions, and establishes processes for reporting and remediating fraud. Save legitimate carrier sender details from the carrier's own site or app; do not trust an unexpected message merely because it uses a familiar logo.
Never approve a transfer, disclose a one-time code, or call a number supplied by an unexpected caller or message. Contact the carrier through its official app, website, bill, or a previously recorded support number.
Rehearse the loss-of-service response
Write an ordered response that works without the affected phone: use a separate device to contact the carrier, report the suspected fraudulent change, restore control of the number, secure the primary email, change exposed passwords, revoke unknown sessions, and review financial and other sensitive accounts. The FTC advises contacting the carrier immediately, changing account passwords after regaining the number, and checking financial accounts for unauthorized changes.
Preserve the time service stopped, notices received, carrier case number, affected accounts, and actions taken. If the carrier cannot resolve a number-porting or service complaint, the FCC Consumer Inquiries and Complaints Center provides a phone-issue complaint route (FCC complaint center).
Review after legitimate changes
Before replacing a phone, changing an eSIM, or switching carriers, document which locks must be temporarily removed and when they will be restored. After the change, verify calls, texts, data, carrier login, account notices, and the protection setting. Recheck the list of accounts that still rely on SMS.
Completion check
Protection is ready when the carrier account has unique credentials, available SIM and port controls are understood and enabled, critical accounts have tested recovery that does not depend only on the number, carrier notices reach a protected channel, and an offline incident plan can be followed from another device.
Sources
- SIM Swap Scams: How to Protect Yourself — Federal Trade Commission
- FCC 23-95: Targeting and Eliminating Unlawful Text Messages, SIM Swap and Port-Out Fraud — Federal Communications Commission, Nov. 15, 2023
- FCC Consumer Complaints — Federal Communications Commission