CyberRamen

security noodle bar
← Security Awareness Hub Protect my accounts

SIM Swapping

If your phone number is your second factor, your number is a target.

In a SIM swap, an attacker convinces your mobile carrier to move your number onto their SIM. Suddenly your calls and texts — including SMS security codes — go to them. This is why SMS is the weakest form of two-factor authentication, and why this page sits next to the 2FA page.

TL;DR
  • SIM swapping hijacks your phone number, not your phone — so SMS codes go to the attacker.
  • The giveaway is sudden, unexplained loss of mobile signal when you should have coverage.
  • Move your important 2FA off SMS onto an authenticator app or hardware key.
  • If it happens, call your carrier from another phone immediately to reclaim the number, then secure email and bank.

How it works

The attacker gathers enough personal detail about you (often from earlier phishing or data breaches) to impersonate you to your carrier — or to a single susceptible employee. They request a replacement SIM or a port to a new device. Once your number is on their SIM, your phone loses signal and theirs starts receiving your texts and calls. Then they trigger password resets on your accounts and catch the SMS codes.

What to actually do (prevention)

  1. Use app-based or hardware 2FA for anything important — especially email and bank. Reserve SMS only for accounts that offer nothing better.
  2. Set a PIN/passcode with your mobile carrier if they offer one, so a SIM change requires it.
  3. Reduce what's findable about you — the swap relies on the attacker answering "security questions" with your own data.
  4. Treat any "your SIM will be deactivated" message as suspicious — that's also a phishing lure.

Signs it's happening

  • Your phone shows no service / SOS only unexpectedly, and it isn't a network outage.
  • You stop receiving expected calls and texts.
  • You get a "SIM activated" or "number ported" notification you didn't request.
  • Account-reset alerts start arriving by email at the same time.

If it's already happened

  1. From another phone, call your mobile carrier, report the swap, and demand the number be locked and restored.
  2. Secure your email immediately (it's the keystone — see that page), switching its 2FA off SMS.
  3. Call your bank if any financial account uses SMS codes.
  4. File a plainte (Police Grand-Ducale) if money moved or identity was misused.

🇱🇺 In Luxembourg

  • Contact your mobile operator's support line first — speed is everything to reclaim the number.
  • Financial loss → bank, then plainte (Police Grand-Ducale).
  • Phishing that fed the swap → SPAMBEE / CIRCL.
  • LuxTrust-based bank approvals are stronger than SMS codes — prefer them where offered.

If you read one thing

Get your bank and email off SMS codes. That single change makes a SIM swap mostly worthless to an attacker.

Pairs with: Two-Factor Authentication · Email Account Compromise.