This article is brought to you by Aura.
Watch the video to see how we protect you online.
This article is brought to you by Aura. Watch the video to see how we protect you online.
Start Free Trial
4.7 stars on Trustpilot
Close Button
What is Aura? (1:10)

How To Prevent SIM Swapping and Port-out Scams

A SIM card swap is a gateway fraud; scammers can easily hijack your phone number — and then steal your identity. Here’s how to prevent SIM swapping.

How to prevent SIM swapping: Header image

Aura’s app keeps you safe from scams, fraud, and identity theft. Try Aura for free.

4.7 stars as of Dec. 2023

In this article:

    In this article:

      See more

      Aura’s digital security app keeps your family safe from scams, fraud, and identity theft.

      See pricing
      Share this:

      What Is SIM Swapping?

      SIM swapping, or SIM hijacking, occurs when attackers take control of your mobile number. They trick your cell phone provider into transferring your number to their mobile device. 

      The attacker then uses your phone number to access other online accounts that belong to you. Using text messages, they “recover” access to accounts (like your Gmail) in concert with other information that they have gathered about you from phishing emails, SMS two-factor authentication (2FA), or leaked data from the Dark Web.

      In turn, they can easily gain access to:

      • Bank accounts
      • Emails
      • Photos
      • Texts
      • Social media accounts
      • Cryptocurrency exchange accounts
      Port-out fraud is often confused with SIM swapping, but they are two different things
      • Porting fraud occurs when a scammer transfers your number to another service provider. 
      • SIM swaps refer to transferring your account to a scammer's new SIM card.

      There are instances in which you may have a legitimate reason to request a duplicate SIM. If your existing SIM chip malfunctions or if you somehow misplaced the SIM, your carrier’s support team can map your phone number to a new card’s Integrated Circuit Card Identifier (ICCID).

      If you’re switching to a new carrier but are still in the same geographic area, simple port-outs can be completed in a day.

      {{show-toc}}

      How Do You Authenticate a SIM Swap?

      How can an attacker impersonate you and swap your SIM so easily? SIM swap attacks are so successful because carrier representatives are easy to trick.

      The attacker can call your provider’s support line, offer a plaintive story about losing your SIM card, and get them to transfer your number. If the attacker feels threatened, they can just hang up and try again with another agent.

      An empirical study by Princeton University documented six authentication challenges that attackers must overcome to complete a SIM swap:[*]

      1. Personal information: Street address, email address, date of birth.
      2. Account information: Last four digits of a payment card number, activation date, last payment date and amount.
      3. Device information: IMEI (device serial number), ICCID (SIM serial number). 
      4. Usage information: Recent numbers called (call log).
      5. Knowledge: PIN or password, answers to security questions.
      6. Possession: SMS one-time passcode, email one-time passcode, or other multi-factor authentication (MFA) code.
      Swapping to a new SIM
      Porting to a new carrier
      Process
      • Contact your cell phone provider.
      • Tell your provider that you want to change the number for your SIM card.
      • Provide a reason for the SIM swap.
      • Depending on your provider, you may have to provide a one-time password or PIN.
      • The carrier approves or denies the swap.
      • Check if the existing number can be transferred to the new carrier.
      • Generate a number transfer PIN.
      • Tell the new carrier which lines to move.
      • Use the PIN to authorize any lines on the account.
      Timeline
      Instant
      Between 10 minutes and 24 hours

      Here's How Scammers Hijack Your SIM Card

      How do scammers have enough information to convince a customer service representative that they are you? 

      SIM swap attacks don’t happen overnight. Scammers harvest data about you before they attempt to impersonate you. They use several tactics — such as social engineering via phishing emails or malware and extensive social media research.

      For example, the scammer may send an email claiming to be your service provider. They’ll ask you to fill out some information to keep your account active. You could unwittingly share personal information like your date of birth, password, address, etc. 

      If the scammer somehow installed malware on your mobile phone, they can record your keystrokes and see any passwords or answers to security questions that you enter. Fraudsters can buy your information off the Dark Web, thus arming themselves with any information needed to to switch your number to a new SIM card.

      📚 Related: How Can Social Security Identity Theft Occur? [9 Ways]

      SIM Swapping on Postpaid Vs. Prepaid Accounts

      • Authentication procedures to sign up for prepaid SIM cards tend to be more porous than with postpaid SIMs. Prepaid accounts can be registered without prior credit checks or proof of real-world identification.
      • Some providers like T-Mobile offer a NOPORT option that throttles a port-out request. At the time the Princeton paper was published, T-Mobile did not offer NOPORT on prepaid SIMs.
      • While postpaid accounts now require Number Transfer PINs (see below), prepaid accounts (like AT&T prepaid SIMs) do not.

      📚 Related: What To Do With an Old SIM Card (Don't Throw It Out!)

      5 Signs That Indicate a SIM Swap Attack

      SIM swapping will cause your phone to act up. Here are some signs that you might be a victim:

      • Service changes. When your provider tells you that your SIM card or phone number has been activated elsewhere, that's the first sign. 
      • Inability to send or receive texts and phone calls. Once the scammer activates your SIM on another device, your phone number becomes unusable. 
      • Security notifications. Receiving alerts about changes to your profile data, such as passwords and security questions, is another sign. Failed login attempts from unrecognized sources are yet another clue that you’ve been hacked.
      • No access to your online carrier account. Scammers can lock you out of your carrier account. That way, you cannot file a complaint, lock your phone, or access your private information.
      • Inability to use apps on your phone. SIM swap attacks prevent you from logging into your phone apps and accounts.
      • Unusual activity on your social media accounts. SIM swap attacks usually target victims who have valuable online accounts — like a sizable audience on Twitter, LinkedIn, or Instagram. Strange online activity from social media accounts can indicate account takeovers.

      📚 Related: Did Someone Open a Cell Phone Account In Your Name? Do This!

      What Phone Carriers Do to Prevent Unlawful SIM Swapping

      Single-use passcodes to request a service call

      • T-Mobile customers are required to set up an individual 6–15 digit PIN to verify their identity when calling customer service.[*]
      • These authentication codes also help verify the legitimacy of any account changes.

      Number Transfer PIN (NTP)

      • A Number Transfer PIN is a code generated when porting a postpaid number to another carrier.
      • This authentication method ensures that a SIM swap or port-out request is from a genuine customer.

      All three major carriers now use NTPs for authentication:

      • Verizon rolled out NTPs and Number Locks in July 2020.[*]
      • AT&T followed suit in September 2021.[*]
      • T-Mobile added NTPs for port-outs in April 2022.[*]

      SMS verification to change SIMs

      • Carriers like AT&T built a risk-scoring model to identify high-risk requests by customers for SIM changes and port-outs.[*] If a SIM swap request meets (or exceeds) specific thresholds in their risk model, AT&T sends a no-charge SMS confirmation for the customer to approve or reject a pending SIM swap.

      Account takeover protection 

      • Verizon provides customers with a feature called Number Lock to prevent SIM swaps. When you activate a Number Lock on your account, the number cannot be transferred until you remove the lock.

      Two employee sign-off

      • If other authentication methods aren’t available, carriers like Verizon require two employees to sign off on a SIM swap or port-out transaction. AT&T responded that such a step would hinder legitimate SIM swap requests and not actively prevent social engineering or collusion.

      Multiple authentication protocols 

      In a statement released by Verizon, the carrier states that they are training customer care employees to identify and present unauthorized SIM change attempts through multiple authentication protocols.[*

      These protocols include:

      • Push notification-based authentication.
      • Face ID or fingerprint recognition to log in securely to the carrier’s native app.
      • Answering security questions.

      In stores, retail employees are also required to scan a customer’s ID using technology that looks for indications of authenticity. 

      What Can You Do to Prevent SIM Swapping?

      Set up 2FA via an authenticator app

      • Use an authentication app like Google Authenticator (or a similar tool) to secure all of your online accounts.
      • Browse the 2FA Directory to learn which apps and websites support this important layer of authentication.

      Be wary of phishing emails, texts, or phone calls

      • Keep an eye out for phishing emails and other ways scammers can wrest your data from you.
      • Don’t click on any links from emails or texts from people you don’t know. Reputable companies (like your credit card company or carrier) will not ask for your personal information through email.

      Use biometric authentication, password manager

      • Create unique, complex passwords and store them in a password manager. Download its browser plug-in, so you always have easy access to your passwords.
      • SIM cards may be easy to steal, but faking biometrics is not. Turn on Face ID authentication for your devices to keep your devices secure and your data uncrackable.

      Set up a SIM PIN and carrier alerts

      • When you buy a SIM card, you also get a PIN for it. This four-digit code activates the SIM card when you insert it into your phone.
      • Change the PIN from its default number to a new one that only you know. Learn how to change your SIM PIN on Apple and Android devices.
      • Double-check that your mobile carrier will alert you in case of a SIM swap or port-out. Many providers will send a text message asking you to confirm a swap. 

      Place a port freeze or number lock 

      • Call your cell phone provider and ask for a port freeze, and lock the account to your current SIM. If you have Verizon, you can lock your SIM from your MyVerizon mobile app.
      • T-Mobile also offers Account Takeover Protection for free to keep your number safe from unauthorized port-outs.

      Switch to a burner number for simple transactions 

      • Use a no-contract, temporary number to maintain privacy if you need to give out your number for non-essential transactions. Apps like Burner and Hushed will give you a second number that you can use for calls and texts from your smartphone.
      • Aura also lets you generate email aliases to hide your actual email address so that you can prevent unwanted or spam emails from crowding your inbox.

      Restrict what you post online

      • The more you share on social media, the easier it is for scammers to learn who you are. Don’t share your phone number, Social Security number, information about financial assets, or daily locations. 
      • Run a free privacy scan to see what personal details of yours have been exposed in a data breach and remove them.

      Remove your cell phone as an account recovery option

      • Go into all your online accounts and set your primary email address as a recovery option. If a scammer only controls your cell phone number, it’ll be harder to take over accounts when your cell phone is not a recovery option.

      📚 Related: How To Block Websites on iPhones and iPads [4 Ways]

      Report SIM Swap Fraud Right Away

      1. Alert your carrier. Call your phone provider immediately. Remember that you can’t make phone calls anymore, so you need to borrow someone’s phone. Explain your predicament and ask your provider to remove your number from the stolen SIM. 
      2. Write down the service representative’s ID number, name, and case ID number. Keep this information for your records and future conversations with the police.
      3. Request that your service provider retains all logs. Ask for the phone’s International Mobile Equipment Identity (IMEI) number, time of call, and the names of everyone involved in fulfilling the SIM swap request. Save this information for your police report. 
      4. Notify your banks and other financial service providers. Alert your bank, investing accounts, and any other financial institutions about the unlawful SIM swap.  
      5. Lock down your accounts. Write down a list of all your online accounts, like personal email, cryptocurrency exchange, payment apps, and online banking accounts. Starting with your primary email address, go down the list and change the login credentials for every account. Prioritize accounts that you know the attacker has access to or has tried to get access to. 
      6. File a police report. Visit your local police department’s website and file a police report online (if possible) or in person. Then report the attack to the Internet Crime Complaint Center (IC3) on www.ic3.gov. 
      7. Place a fraud alert on your credit reports. Contact one of the three credit bureaus (Equifax, Experian, or TransUnion) and request a fraud alert. You can do this online in under 30 minutes.  
      8. File a report on the BBB Scam Tracker. This tool collects and presents scam data to prevent others from falling prey to similar attacks. 
      9. Don’t engage with the attacker. Attackers may attempt to extort you after swapping your SIM. Avoid having any conversation with them. Record — but ignore and don’t respond to — any messages. 

      If you have a cell phone, whether it’s prepaid or postpaid, you’re at risk of a SIM swap attack. Monitoring your finances and other important accounts is one way to soften the blow after such attacks.

      And for precautions that you can’t manage on your own, there’s always Aura. Identity protection services like Aura double down on monitoring, alerts, and recovery

      Aura also offers $1 million in identity theft insurance coverage along with 24/7 support from experienced fraud resolution specialists who can walk you through an identity theft recovery plan.

      Ready for ironclad identity theft protection? Aura is free for 14 days.

      Award-winning identity theft protection with AI-powered digital security tools, 24/7 White Glove support, and more. Try Aura for free.

      Related Articles

      What to do if your phone is stolen.
      Fraud

      Stolen Phone? Don't Panic! Follow These 11 Steps Now

      Scammers can do more damage than you think with a stolen phone. Here’s what to do if your phone is stolen to protect your identity and more from fraudsters.

      Read More
      January 16, 2023
      Illustration showing a warning symbol coming out of the top of a smartphone
      Internet Security

      How To Know if Your Phone Is Hacked (and What To Do)

      Scammers know your phone is a goldmine of sensitive accounts and personal information. Here’s how to know if your phone is hacked and what to do about it.

      Read More
      December 22, 2023

      Try Aura—14 Days Free

      Start your free trial today**