What to do after a SIM swap or phone number port-out

What a SIM swap and a port-out are

A SIM swap is when someone persuades or deceives a mobile carrier into moving your phone number onto a SIM card (the small chip, or its digital eSIM equivalent, that ties a phone to a number) that the attacker controls. A port-out is related: the attacker transfers your number from your carrier to a different carrier, where they hold the account. In both cases the result is the same. Calls and text messages meant for you go to the attacker's device, and your phone loses service.

Neither attack requires access to your phone. The attacker usually impersonates you to a carrier representative or store employee, uses personal details gathered from data breaches or social media, or bribes an insider. The phone number is the target because so many accounts treat it as proof of identity.

Warning signs of a SIM swap

SIM swaps are designed to be quiet, but they leave signals. Treat any of these as urgent:

• Sudden loss of service: your phone shows "No service" or "SOS only" while other phones nearby work normally.
• Unexpected carrier notices: an email or text about a SIM change, an eSIM activation, a port-out request or an account PIN change you did not make.
• Password-reset messages: reset codes or "new sign-in" alerts for email, banking or social accounts that you did not request.
• Account lockouts: passwords that suddenly stop working, or contacts who say they received odd messages from you.

Speed matters. The attacker's goal is to use your number to reset passwords before you notice, often within the first few hours.

Why a stolen phone number unlocks so much

A phone number is often the weakest link in account security. Many services send password-reset codes by text message and use SMS codes as the second factor in multi-factor authentication (MFA, a second proof of identity beyond the password). Whoever controls the number can receive those codes.

Attackers typically follow a predictable order. They reset the email account first, because email is the master key for other password resets. Then they move to banks, payment apps, cryptocurrency exchanges and social media. SIM swaps are also a common path to registrar account takeover: once the attacker controls the email and phone number on a domain registrar account, they can change the DNS or transfer domains away. If you own domain names, check them early and read our domain name theft guide. Confirmed Stolen tracks verified cases on the stolen domain names list.

How often SIM swaps are reported

Federal figures show fewer reported cases each year, though losses remain substantial. The FBI received 971 SIM swap complaints in 2025 with $17,366,758 in reported losses, down from 982 complaints and $25,983,946 in 2024, and 1,075 complaints and $48,798,103 in 2023, according to the FBI IC3 2025 Internet Crime Report. In 2022 the FBI logged 2,026 SIM swap complaints and $72,652,571 in losses, according to the FBI IC3 2024 Internet Crime Report.

Older adults are the exception to that decline. Victims aged 60 and over filed 222 SIM swap complaints in 2025, up from 205 in 2024 and 174 in 2023, even as total SIM swap complaints fell; their 2025 losses were $6,741,791, according to the FBI IC3 2025 Internet Crime Report. If an older relative depends on text-message codes for banking, help them set up a carrier PIN and an authenticator app.

The regulator sees a similar volume. The FCC received approximately 300 SIM swap or port-out fraud complaints in 2020, 400 in 2021 and 500 in 2022, according to FCC 23-95, Protecting Consumers from SIM-Swap and Port-Out Fraud.

UK data show a sharp rise. Unauthorized SIM swaps reported to the UK National Fraud Database rose 1,055% in 2024, to nearly 3,000 from 289 in 2023, and account takeover filings exceeded 74,000, up 76%, according to Cifas, Fraudscape 2025. UK unauthorized SIM swaps rose a further 38% in 2025, and telecoms accounts now make up 62% of UK account takeover cases, according to Cifas, Fraudscape 2026 Report. These are UK figures filed by Cifas members and are not directly comparable to US complaint counts.

Every one of these numbers counts only reported cases. Many victims never file.

Your carrier's duties under FCC rules

In 2023 the Federal Communications Commission adopted rules aimed directly at SIM swap and port-out fraud in its Report and Order FCC 23-95. In general terms, the order requires wireless carriers to:

• use secure methods to authenticate a customer before changing a SIM or porting a number to another carrier;
• notify customers when a SIM change or port-out request is made on their account;
• give customers the option to lock their accounts against SIM changes and port-outs;
• train staff and keep procedures for handling suspected fraud.

These rules give you a basis for asking the carrier what happened. Ask how the request was authenticated, whether a notice was sent, and what account lock options are available. Check the order and your carrier's current policies for exact details, because implementation varies by carrier. If the carrier did not follow its obligations, say so in your FCC complaint.

Getting the number back and locking the account

Call the carrier from a different phone. Explain that you believe your number was moved without authorization, and ask for the fraud or account security team. Then ask for each of the following and write down the answers:

• a case or ticket number for the incident;
• the date, time and channel of the unauthorized change, such as store, phone or online;
• restoration of the number to your SIM or eSIM;
• a port-out freeze or number lock, whatever the carrier calls it;
• a new account PIN or passcode, plus any extra verification note on the account.

If the number was ported to another carrier, your original carrier will usually have to work with that carrier to bring it back. Ask how long that will take and how you will be notified. Keep calling until the number is restored and locked.

Reporting a SIM swap

Report through several channels, because each serves a different purpose:

• FBI IC3: file at the Internet Crime Complaint Center, which collects the federal SIM swap figures cited above.
• FCC: file a consumer complaint through the FCC consumer center about the carrier's handling.
• Local police: a report number helps with bank disputes and insurance claims.
• FTC: if your identity was used to open accounts, use IdentityTheft.gov and our identity theft guide.

Keep copies of every confirmation, carrier case number and bank dispute reference in one place.

Moving your accounts off text-message codes

The lasting fix is to stop treating your phone number as a key. Move MFA on your most important accounts to an authenticator app such as Google Authenticator, Microsoft Authenticator or Authy, a hardware security key, or a passkey (a sign-in credential stored on your device and unlocked with your fingerprint, face or device PIN). These methods stay tied to a device you hold, not to a number a carrier can move.

Start with email, then banking and investment accounts, then your password manager, cryptocurrency exchanges and domain registrar. Remove your phone number as a recovery option where the service allows it, and store backup codes offline. A SIM swap that reaches only a phone number, and nothing else, is an inconvenience rather than a loss.