How Carrier Security Locks Prevent Unauthorized SIM Swapping Attacks

A text message with a login code used to feel like a second lock on the front door. Then attackers learned to move the whole door. A SIM swap does not break into your phone. It convinces your carrier to hand your phone number to a SIM card the attacker controls, and from that moment every SMS code, every password reset link and every call meant for you goes to someone else. I first took this threat seriously after a friend lost access to his email in under twenty minutes, not because his password was weak, but because his number had been moved while his phone sat on his desk showing No Service.

Carrier security locks exist to stop that exact move. They add a check that a smooth-talking stranger cannot pass with a name, a birth date and a confident voice. This guide explains how a SIM swap works, what each kind of carrier lock actually blocks, how to set the locks up on your own account, how to move your most important logins away from SMS, and what to do in the first minutes if a swap is already under way. The steps work on Android, and the ideas apply no matter which carrier bills you each month.

Read this as a working checklist, not a scare story. Most people need about half an hour to put the main protections in place, and most of that time is waiting on hold or digging out an account PIN. The payoff is quiet: nothing dramatic happens, your number stays where it belongs, and an attacker who tries the usual tricks hits a wall instead of a welcome mat.

How a SIM swap attack actually works step by step

A SIM swap, sometimes called SIM swapping or a port-out attack, is a social engineering attack aimed at your carrier rather than at your phone. The attacker does not need your handset, your SIM card or your password. They need enough personal detail to sound like you on a support call or in a carrier shop, and they need a carrier process that lets a number move on the strength of that performance. Once the number moves, the attacker receives your calls and texts, and your own phone loses service because the network now routes your number to their SIM.

The damage that follows is fast because so many services still treat a phone number as proof of identity. A password reset sent by SMS lands in the attacker’s inbox. A bank that sends a one-time code by text hands the attacker the key to the account. An email provider that offers SMS recovery gives away the mailbox, and from the mailbox the attacker can reset almost everything else. That chain is why a SIM swap is often the first step in a larger account takeover, not the whole crime by itself.

What the attacker needs before the call

Attackers usually start with information that is easy to find or buy: your full name, your phone number, your date of birth, your home address, and sometimes the last four digits of a payment card or a government ID number. Data breaches, social media profiles, phishing pages and people-search sites all feed this stockpile. A surprising amount of it comes from the victim directly, posted in a birthday message, a job profile, or a photo of a new car with the plate and the dealership visible in the background.

With those details in hand, the attacker rehearses a story. They may claim they lost their phone on holiday, that the screen is smashed, or that they bought a new handset and need the number moved to a fresh SIM. The story changes, but the goal stays the same: persuade a support agent or a shop employee that they are you, and that the move is urgent. Urgency is the tell. A real customer who lost a phone is stressed, but an attacker leans on urgency to push the agent past the normal checks.

The port-out request and the carrier agent trap

There are two main flavours of this attack. In a SIM swap, the attacker asks the same carrier to move your number to a new SIM on the same network, often an eSIM they can activate remotely. In a port-out attack, the attacker asks a different carrier to take your number away, using a port-out PIN or account details to authorise the transfer. Both end the same way: your number answers to someone else. The port-out version can be harder to notice quickly, because your old carrier may only send a confirmation text to the number that is already leaving.

Support agents are the trap in the middle. They handle hundreds of genuine number moves, they work under time pressure, and they are trained to help. An attacker who knows your details, stays calm, and answers security questions smoothly can sound exactly like a genuine customer. Carriers have tightened their checks in recent years, adding PINs, one-time codes and account locks, but the human step remains. That is why a technical lock matters more than a polite request to be careful: a lock turns a judgement call into a hard stop.

Why SMS codes fall first in a SIM swap

SMS was designed to deliver short messages, not to prove who you are. A one-time code sent by text proves only that the phone receiving it holds your number at that moment. After a swap, that phone belongs to the attacker. The code itself is not broken, the channel is. The attacker does not need to read your messages on your handset, crack an app, or guess a password. They simply become the destination for the message.

This weakness is why security teams have been pushing people away from SMS for high-value logins for years. An authenticator app generates its codes on your device, a hardware key proves possession of a physical object, and a passkey ties the login to your device and your biometrics. None of those move when your number moves. SMS can stay useful for low-risk alerts, but it should not be the only thing standing between an attacker and your bank or your main email account.

The first hour after a swap

The first hour decides how much damage a swap does. In the first minutes the attacker usually tries password resets on your email, then on banking, crypto, cloud storage and social accounts, in that order. Email first, because it unlocks the rest. If your email offers SMS recovery, a single reset can hand over the mailbox, and from there the attacker can search for account names, reset passwords, and lock you out by changing the recovery details themselves.

Your phone gives you the earliest warning: signal bars vanish, calls fail, and texts stop arriving even on Wi-Fi calling. Many victims first notice the problem when a call drops or a banking app asks for a code that never arrives. That silence is the signal to act at once, from another phone or a computer, by calling the carrier and asking for the number to be frozen and returned. Every minute spent restarting the handset or waiting for the signal to come back is a minute the attacker uses to reset another account.

What a carrier security lock is and what it blocks

A carrier security lock is a setting on your mobile account that stops a number, a SIM or a device from being changed without an extra secret that only you should know. It is not one single switch. It is a small set of related protections, and each one blocks a different step in an attack. A SIM lock ties a handset to one network. An account PIN stops strangers from changing account details. A number lock, sometimes called a port-out freeze, stops the number from leaving the carrier at all until you lift the freeze yourself.

Think of these locks as a chain across three doors. The account PIN guards the account itself. The number lock guards the exit. The SIM PIN guards the physical card in your handset. An attacker who gets past one door still faces the next, and that friction is often enough to make them move on to an easier victim. No single lock is perfect, and carriers implement them with different names and different menus, but together they change a SIM swap from a phone call into a project.

Number transfer PIN versus account PIN versus SIM PIN

People mix these three up, and the confusion is exactly what attackers exploit. An account PIN is a passcode you set with your carrier, used to prove you own the account when you call support or change a plan. A number transfer PIN, also called a port-out PIN, is a separate code generated when you want to move your number to another carrier; it is usually temporary and expires after a short period. A SIM PIN is a four-digit code stored on the SIM card itself, asked for when the phone restarts, and it stops someone who steals your handset from using your SIM in another phone.

Each one answers a different question. The account PIN answers who is allowed to change this account. The transfer PIN answers whether this number is allowed to leave. The SIM PIN answers whether this card can be used in a new handset. You need all three in place for the chain to hold, because an attacker who learns one secret should still be stopped by the others. Write them down somewhere safe that is not your phone, and never use the same four digits for all three.

How a port-out block stops the number leaving

A port-out block, or number lock, is the strongest single protection against the transfer flavour of this attack. When it is on, the carrier refuses any request to move your number to another network until you turn the lock off yourself, usually from the carrier app or website after signing in with your account credentials. An attacker who calls support and asks for a port-out gets a refusal, not a negotiation, because the system itself will not issue the transfer PIN while the lock is active.

The practical effect is simple: the number cannot leave, so the attacker cannot become the new destination for your calls and texts. Some carriers also send you an alert when someone tries to lift the lock or requests a transfer while it is on, which gives you an early warning that someone is probing your account. Turn the lock on and leave it on. Lift it only for the hour you actually need to switch networks, then turn it straight back on at the new carrier once the move is done.

Types of carrier lock that stop SIM swap attacks

Carriers sell these protections under different names, and the names change from one country to another, but the functions fall into four clear groups. Learning the groups helps you ask for the right thing even when the support agent uses a different label. Ask about each group by function, not by brand name: can someone change my SIM without my PIN, can someone move my number out, can someone change my account details, and can someone use my SIM in another phone.

The table shows why a single lock is not enough. A device SIM lock, for example, stops you using a carrier phone on a rival network, but it does nothing to stop an attacker moving your number to a new SIM on the same network. That is a different door, and it needs a different lock. If you bought a phone tied to one network and later want to use it elsewhere, read the guide on unlocking a carrier-locked phone before you pay off the handset or ask for an unlock code, because the unlock process and the account checks around it are part of the same security picture.

Carrier SIM lock and the handset tied to one network

A carrier SIM lock, often just called a SIM lock, is applied to a handset bought on a contract or an instalment plan. It stops the phone working with a SIM from another network until the carrier removes the lock, usually after the handset is paid off or a set period has passed. It protects the carrier’s financing, and it gives you a small security benefit: a thief who steals the handset cannot simply drop in another SIM and use it elsewhere.

Do not confuse this with SIM swap protection. A SIM-locked phone can still have its number moved to a new SIM by the carrier, because the lock is about the handset, not the number. Check your handset status in the carrier app or by testing a SIM from another network, and ask the carrier for the unlock conditions in writing if you plan to travel or switch networks later. Keep the unlock code or confirmation email somewhere safe, separate from the phone itself.

Account PIN and passcode protection

The account PIN is the lock most people skip, and it is the one attackers test first. It is a four to eight digit code, or sometimes a longer passcode, that support staff should ask for before they change anything on the account: a new SIM, a new address, a plan change, or a number move. Without a PIN set, an agent may accept other details, such as a date of birth or an address, and those are the details attackers already have.

Choose a PIN that is not your birth year, your house number, or the last four digits of your phone number. Do not reuse the PIN from your bank card or your voicemail. If your carrier offers a longer alphanumeric passcode, take it. A six-digit random PIN is far harder to guess than a four-digit one, and a support agent who hears a confident stranger reciting your birth date will still be stopped by a PIN that stranger cannot produce.

Number lock and port-out freeze explained

The number lock is the lock that directly answers the port-out attack. On major US carriers it appears as Number Lock, Port Freeze, or Transfer Lock, and on carriers elsewhere it may sit under account security, number security, or transfer protection. The effect is the same: the number stays put. Turn it on for every line on the account, including lines for children, older relatives, and spare handsets, because attackers often target the least guarded line and then use it to reset a shared family account.

Check the lock every few months, and check it again after any plan change, handset upgrade, or support call, because some account changes can reset security settings without warning. Add a calendar reminder for the same day each quarter. It takes two minutes to open the app and confirm the lock is still on, and that two minutes is the cheapest insurance in this whole guide.

Which lock stops which attack in practice

Match the lock to the threat. A same-network SIM swap is stopped by a strong account PIN plus a SIM-change alert, because the attacker must pass the account check to get a new SIM issued. A port-out attack is stopped by the number lock, because the transfer cannot start while the lock is on. A stolen handset is slowed by the SIM PIN and the screen lock, because the thief cannot use your SIM in another phone without the PIN. No lock covers every case, which is why the set matters more than any single item.

If your carrier does not offer a number lock, say so in a complaint and consider whether that carrier deserves your high-value accounts. Most large carriers now offer one, and the ones that do not are telling you something about how they rank security against convenience. Your number is the key to your email and your bank, so a carrier without a port-out freeze is a weak link you should not accept quietly.

How to set up carrier account PIN, number lock and port-out protection

Setting these locks up takes longer to read about than to do. The steps below follow the same order on most carriers: sign in, find the security page, set the PIN, turn on the number lock, then set the SIM PIN on the handset itself. Do the carrier steps on a computer if you can, because the app sometimes hides security settings behind menus that are easier to see on a larger screen, and you can save confirmation screenshots to a safe folder as you go.

Before you start, gather three things: your carrier account login, a pen and paper or a password manager for the new PINs, and a second device or a trusted contact you can call if something goes wrong. Do not set a PIN you will forget in a week. A forgotten PIN is not a disaster, the carrier can reset it with identity checks, but a reset during an emergency is exactly the delay you want to avoid.

1. Sign in to your carrier account on the official website or app, and open the profile or security section, usually labelled Account Security, Number Security, or Privacy and Security.
2. Set or change your account PIN to a random six-digit code you do not use anywhere else, and save it in your password manager under the carrier name.
3. Find Number Lock, Port Freeze, or Transfer Lock and switch it on for every line on the account, then confirm each line shows Locked or Protected.
4. Turn on SIM-change alerts and transfer alerts by text and email, using an email address that does not rely on SMS for recovery.
5. On your Android phone, open Settings, then Security and privacy, then SIM card lock, and set a SIM PIN that is different from your account PIN.
6. Restart the phone once and enter the SIM PIN when asked, so you know it works and you remember the prompt.
7. Log out, log back in, and check that the number lock still shows as on, because some carriers ask for a second confirmation before the lock takes effect.

Setting an account PIN with your carrier

Each carrier puts the PIN in a slightly different place. On T-Mobile the setting sits under account security as an account PIN and number transfer PIN, and the app will walk you through creating both. On Verizon it appears under account security as an account PIN, with Number Lock on a separate page. On AT&T it appears as a wireless passcode and a separate transfer lock. The names differ, the idea does not: find the security page, set the PIN, and test it by calling support from another phone and seeing whether the agent asks for it before discussing the account.

If the carrier only offers a four-digit PIN, use a random one and change it once a year. If it offers a longer passcode, use at least eight characters with a mix that you can still remember. Never set the PIN to the same digits as your voicemail PIN, your screen lock, or your bank card, because an attacker who learns one of those through a different breach would then hold the key to your carrier account as well.

Turning on number lock and port freeze

Open the number security page and look for a toggle next to each line. Switch it on, confirm with your account password or a code sent to your email, and check that the status changes to locked. Some carriers lock the number at once, while others take up to an hour to apply the change across their systems, so do not test it by trying a genuine transfer in the same minute. Wait, then check the status again from a fresh login.

Keep a note of how to lift the lock, because you will need it when you genuinely switch networks. The usual path is the same security page, a sign-in, a confirmation code to your email, and a toggle off. Lift it only when the new carrier is ready to start the port, and turn the equivalent lock on at the new carrier as soon as the number arrives. A number that sits unlocked for a weekend while you sort out a new plan is a number an attacker can take.

Adding a SIM PIN on your Android phone

A SIM PIN is set on the handset, not in the carrier account. On most Android phones, open Settings, then Security and privacy, then More security settings, then SIM card lock, and choose the SIM you want to protect. You will be asked for the current PIN first, which is often 0000 or 1234 from the carrier, and then for the new PIN twice. Pick a code you can remember, different from your screen lock, and write it down somewhere safe before you restart.

The SIM PIN asks for itself each time the phone restarts or the SIM moves to another handset. Three wrong guesses usually lock the card, and you will then need the PUK code printed on the original SIM card holder to bring it back. Keep that PUK code with your other account records, not in the phone case. If you lose the PUK as well, only the carrier can issue a replacement SIM, and that process takes time you will not want to spend during a holiday.

Test your locks without breaking your line

Test gently. Call support from another phone, give your name, and see whether the agent asks for the account PIN before discussing anything. That confirms the PIN is live. Check the number lock status in the app the next day. Restart the handset once to confirm the SIM PIN prompt appears. Do not test by requesting a genuine port-out or a new SIM, because a test that goes wrong can cut your own service and take hours to fix.

Write down what you set, where you set it, and the date. A short note in a password manager, labelled with the carrier name and the line, saves a frantic search later. Tell one trusted person where the note lives, in case you are ever unable to act yourself. This is not paranoia, it is the same logic as telling a neighbour where the spare key is.

Move two-factor authentication off SMS to stronger methods

Carrier locks make a SIM swap much harder, but they do not make it impossible, and a determined attacker may still find a way through a shop, a rogue employee, or a carrier process that has not caught up. The second layer is to make the swap useless even if it succeeds. That means moving your most important logins away from SMS codes, so that a stolen number no longer opens your email, your bank, or your cloud accounts.

Start with the accounts that can reset everything else: your main email, your bank, your password manager, your cloud storage, and any crypto or investment account. Those five matter more than the other fifty combined. Work through them one at a time, in that order, and do not stop halfway. A half-finished move leaves the most important account on SMS and gives the attacker exactly the door they need.

Why SMS two-factor authentication is the weak link

SMS two-factor authentication, or 2FA, sends a code to your number and asks you to type it in. It is better than no second factor at all, and for a low-risk account it is fine. For a high-value account it is the weakest option on the list, because the code travels over the mobile network to whoever currently holds the number. After a swap, that person is the attacker, and the code arrives in their hands in seconds.

The other options do not share that weakness. An authenticator app generates codes on your device using a shared secret, so the codes never travel over the network at all. A hardware security key proves you hold a physical object, and a passkey ties the login to your device with biometrics. All three keep working after a SIM swap, because none of them depends on your number. That is the test to apply to any second factor: if your number moved tomorrow, would this still keep the attacker out.

Authenticator app setup in ten minutes

Pick an authenticator app you trust, such as Google Authenticator, Microsoft Authenticator, or a similar app from a reputable maker, and install it on your main phone. Open the security settings of your email account, choose authenticator app as the second factor, and scan the QR code shown on screen. The app will start generating six-digit codes that change every thirty seconds. Type the current code back into the website to confirm the pairing, then save the backup codes the site offers in your password manager or on paper in a safe place.

Repeat the same steps for your bank, your password manager and your cloud account. Keep the authenticator on a second device as well, or save the setup key securely, so that losing your phone does not lock you out of everything at once. Test the login once from a computer after the change, using the authenticator code instead of SMS, and confirm that SMS is no longer offered as a fallback. If the site still offers SMS as a backup, an attacker can choose the weaker path, so remove it where the site lets you.

Hardware security keys and passkeys for high-value accounts

For the accounts that matter most, a hardware security key is the strongest option most people can buy. It is a small USB or NFC device, from makers such as YubiKey or Google Titan, that you tap or plug in to prove you hold it. Register the key in the security settings of your email and password manager, keep a second key in a safe place as a backup, and store both away from the phone they protect. A key costs less than a takeaway meal for two in many countries, and it stops phishing as well as SIM swaps, because the key checks the real site address before it answers.

Passkeys are the newer version of the same idea, built into Android and modern browsers. A passkey is stored on your device, protected by your fingerprint or face, and used to sign in without a password at all. Enable passkeys on your email and password manager where they are offered, and keep a synced copy in your password manager so you can sign in from a new device. The combination of a passkey for daily use and a hardware key as a backup is, for most people, the strongest practical setup available today.

How to spot a SIM swap while it is happening

Spotting a swap early is a skill, because the attack is silent by design. Your phone does not show a warning that says your number has moved. It simply loses service, and the attacker hopes you blame the network, restart the handset, and wait. Learning the signs in advance means you act in minutes instead of hours, and those minutes are often the difference between a blocked attack and a drained account.

The signs fall into two groups: signs on the phone itself, and signs in your accounts. Watch for both, and treat any one of them as a reason to check the other. A lost signal plus a password reset email you did not request is not a coincidence, it is a pattern, and patterns deserve an immediate response, not a wait-and-see attitude.

Warning signs on your phone and network

The clearest sign is a sudden loss of service that does not match your location. Your phone shows No Service or Emergency Calls Only in a place where it normally has full bars, calls go straight to voicemail, and texts fail to send. Restarting does not bring the signal back, and a different phone with the same carrier still works in the same spot. That combination points to the number, not the handset or the local mast.

Other signs include a message from your carrier saying a SIM change or number transfer was requested, a new eSIM activation you did not start, or a login code arriving for an account you did not try to open. Treat any of those as urgent. Do not reply to the message and wait. Call the carrier from another phone, or use Wi-Fi calling from a computer, and ask whether a SIM change has been made on your line in the last hour.

Warning signs in email and bank accounts

Account signs often arrive before the phone signs do, because the attacker works through email first. Look for password reset emails you did not request, alerts that your email recovery details changed, or notifications that a new device signed in to your bank. A flood of marketing emails can also be a smokescreen, designed to bury the one alert that matters in a pile of noise. Search your inbox for the words password, recovery, sign-in, and transfer, and read those messages first.

Check your bank and email from a computer on Wi-Fi, not from the phone that has lost service, and look at recent activity, not just the balance. An attacker who has your email may change the recovery address, add a forwarding rule, or create a filter that hides future alerts. Those changes are quiet, and they are designed to keep you blind while the attacker works through the rest of your accounts.

The fifteen-minute response plan when you suspect a swap

Keep this plan short enough to remember under stress. First, call your carrier from another phone and ask them to freeze the line, reverse any SIM change, and put a note on the account that no changes are to be made without in-person identity checks. Second, from a computer, change the password on your main email account and remove any forwarding rules or recovery numbers you do not recognise. Third, call your bank and ask them to freeze online transfers until you confirm the number is back under your control.

Do those three things before you try to work out how the attacker got in. The how can wait. The number, the mailbox and the bank cannot. Once the immediate bleeding is stopped, work through your other accounts one by one, changing passwords and checking recovery details, and keep a written list of what you changed so you do not miss one in the rush.

How to recover after a SIM swap and lock everything down again

Recovery is slower than the attack, and that is normal. The attacker needed one phone call to move your number. You will need several calls, several password changes, and several checks to take it back and make sure nothing was left behind. Take it in order, keep notes, and do not rush the checks at the end, because a missed forwarding rule or a changed recovery email can hand the account back to the attacker weeks later.

Start with the carrier, because until the number is back, every SMS code still goes to the attacker. Then take back the email, because the email unlocks the rest. Then the bank and the password manager. Then everything else, in order of value. Write each step down as you finish it, with the time, so you have a record for the carrier, the bank, and the police if you need to report the crime later.

Call the carrier from another phone and reclaim the number

Call the carrier’s fraud or security line, not the general sales line, and say clearly that you are the victim of an unauthorised SIM swap and you need the number returned to your SIM at once. You will be asked for identity documents, account details, and your account PIN. Have them ready. Ask the agent to reverse the SIM change, to put a fraud flag on the account, and to confirm in writing, by email, that the number is back on your SIM and that no further SIM or port changes will be made without in-person identification.

Ask for a new SIM if the old one was replaced, and ask for the port-out lock to be turned on before you hang up. If the agent cannot help, ask for a supervisor and for the case reference number, and write both down. If you are near a carrier shop, going in person with photo ID can be faster than another phone call, because the staff can check your documents face to face and issue a new SIM on the spot.

Reclaim email, bank and crypto accounts in the right order

Once the number is back, change the password on your main email account from a computer you trust, turn on authenticator or hardware-key 2FA, and check the recovery email, recovery phone, forwarding rules, and recent sign-in activity. Remove anything you do not recognise. Search the sent folder for messages you did not send, and check the trash for alerts the attacker may have deleted to hide their work.

Then call your bank and any investment or crypto provider, explain the swap, and ask them to review transactions from the last twenty-four hours, to reverse anything unauthorised, and to put a note on the account. Change those passwords too, and move their 2FA to an authenticator app or hardware key. For crypto accounts, move funds to a fresh wallet if you have any doubt that the attacker saw a seed phrase or a login, because a compromised wallet cannot be made safe by a password change alone.

File reports, freeze credit and watch for a second attempt

Report the crime to the police and to your carrier’s fraud team, and keep the reference numbers. In the United States, also file a report with the Federal Trade Commission and consider a credit freeze with the major credit bureaus, because an attacker with your personal details may try to open accounts in your name next. A freeze stops new credit from being opened without your say-so, and you can lift it temporarily when you genuinely need credit.

Watch the account for at least a month after the attack. Attackers sometimes wait, hoping you will relax and leave a changed recovery detail in place. Check your email forwarding rules and your bank alerts weekly, keep the number lock on, and change your account PIN to a fresh code. If you receive another SIM-change alert, act at once, because a second attempt often follows the first within weeks, aimed at the same details the attacker already holds.

Social engineering tricks attackers use on carrier staff

Understanding the tricks helps you defend against them, and it helps you talk to your carrier about what went wrong. Attackers rarely use technical tools against the carrier. They use stories, confidence, and patience. They call several times, learning a little more on each call, until one agent gives them the opening they need. That slow approach is called pretexting, and it works because each call on its own looks harmless.

Some attackers also buy help from inside. There have been cases where carrier employees were bribed to move numbers, and cases where attackers posed as employees to get internal tools. You cannot control that risk directly, but you can reduce it by using locks that even an insider cannot bypass without the PIN, and by asking your carrier to add a note that changes require in-person ID. A carrier that takes insider risk seriously will have controls for it, and a customer who asks about those controls is a customer the carrier remembers.

Pretexting, insider help and SIM swap as a service

Pretexting is a invented reason to ask for help: a lost phone, a broken screen, a new job abroad, a dying relative who needs the number kept alive. The story is chosen to create sympathy and urgency, and the attacker rehearses it until it sounds natural. They may call at a busy time, when the agent is under pressure to clear the queue, or late at night, when fewer supervisors are on duty. If one agent refuses, they hang up and call again, hoping the next agent is less careful. That persistence is the point.

In recent years, SIM swapping has also become a service sold online, where a buyer pays a fee and a seller with carrier contacts does the swap. The buyer may never speak to the carrier at all. That distance makes the crime easier to scale, and it means the attacker targeting you may be a customer of a service, not a lone hacker. The defence does not change, though: locks, non-SMS 2FA, and alerts are the controls that stop the swap, whoever makes the call.

What to say and not say when you call support yourself

When you call support for a genuine change, be the customer who makes the agent’s job easy and safe. Have your account PIN ready, give it when asked, and do not offer extra personal details the agent did not ask for. If the agent asks for a code sent to your email, use that channel, not SMS, where possible. If an agent offers to skip a check to save time, say no and ask them to follow the normal process. A skipped check today is a habit that an attacker can use tomorrow.

Never read your PIN, your transfer PIN, or a one-time code to someone who called you. Carriers do not call customers and ask for those codes. If you receive a call claiming to be from your carrier and asking for a code, hang up, call the carrier back on the number printed on your bill, and report the call. That single habit blocks a whole family of scams that start with a friendly voice and end with an empty account.

Carrier SIM swap protection checklist for every line you own

A checklist only helps if you actually work through it, so treat this section as a task list, not a summary. Go line by line, tick each item off, and date the list when you finish. Keep it with your other account records, and repeat it every three months and after any handset change. The whole list takes about half an hour the first time, and about five minutes on each repeat, because the locks stay in place once they are set.

• Account PIN set on the carrier account, random and different from your other PINs, saved in a password manager.
• Number lock or port-out freeze switched on for every line, including family lines and spare lines.
• SIM PIN set on each Android handset, different from the screen lock and the account PIN, with the PUK code saved safely.
• SIM-change and transfer alerts turned on by email and by text to a trusted contact if possible.
• Authenticator app or hardware key set up for email, bank, password manager, cloud and crypto accounts.
• SMS removed as a recovery option on high-value accounts where the site allows it, and backup codes saved on paper.
• Recovery email checked, with its own strong password and its own authenticator, so it cannot be taken through SMS either.
• Credit freeze considered, and fraud alerts placed where your country offers them, with the reference numbers saved.
• Carrier fraud line number saved in your contacts and in a note on another device, so you can call it from any phone.
• Trusted person told where your PIN notes and backup codes live, in case you cannot act yourself one day.

That list looks long, and that is the point. Each item closes a door the attacker would otherwise try. If you only do three things today, do these: turn on the number lock, set a proper account PIN, and move your email to an authenticator app. Those three alone stop the most common version of this attack, and the rest of the list turns a hard target into a target most attackers will skip. If you are planning a genuine network change soon, read the guide to switching carriers while keeping your number before you lift any lock, so you know the exact order: lift the lock, start the port, then lock the number again at the new carrier the same day.

Frequently asked questions about SIM swap protection

Can a carrier lock stop a SIM swap completely?

No single lock can promise a complete stop, because a determined attacker may find a carrier process or a person who bypasses it, and no system is perfect. What the locks do is change the attack from a single phone call into a much harder task, and they give you alerts when someone tries. Combined with authenticator or hardware-key 2FA, they make a successful swap both unlikely and far less damaging, because the attacker gains a number that no longer opens your important accounts.

Does a SIM PIN stop a SIM swap attack?

A SIM PIN does not stop a SIM swap, because the swap happens at the carrier, not on your handset. The SIM PIN stops someone who steals your physical SIM from using it in another phone. It is still worth setting, because it protects the card in your hand, but do not mistake it for swap protection. For swap protection you need the account PIN and the number lock, which work at the carrier level where the swap itself takes place.

How do I know if my number lock is actually on?

Sign in to your carrier account on the website or app, open the number security or transfer protection page, and look for a status that says locked or protected next to each line. Take a screenshot and save it with the date. If the page is unclear, call support from another phone and ask the agent to confirm the lock status without asking them to change anything. Check again after any plan change or handset upgrade, because those events can reset settings.

What should I do first if my phone suddenly shows No Service?

Do not wait for the signal to return. Borrow another phone or use a computer on Wi-Fi, call your carrier’s fraud line, and ask whether a SIM change or transfer was made on your line in the last hour. Then change your email password from that computer, check for forwarding rules you did not create, and call your bank. A sudden loss of service in a place where you normally have coverage is the earliest warning sign of a swap, and the first fifteen minutes matter more than the next fifteen hours.

Is SMS two-factor authentication still worth using at all?

Yes, for low-risk accounts where nothing better is offered, SMS 2FA is still better than no second factor. It stops casual password guessing and it stops an attacker who only has your password. For email, banking, your password manager and crypto, move to an authenticator app, a hardware key or a passkey, and remove SMS as a fallback where the site allows it. Use SMS only where it is the only option, and keep the number lock on so that option is harder to abuse.

What should I do today if I only have ten minutes?

Open your carrier app, turn on the number lock for your main line, and set a proper account PIN if you have not already. Then open your email security settings and switch its second factor to an authenticator app. Those three steps take about ten minutes, they need no new hardware, and they close the two doors attackers use most. Put the rest of the checklist on your calendar for the weekend, and work through it with a cup of coffee and your password manager open.

Your number is not just a way for friends to reach you. It is the key that many services use to decide you are you, and that makes it worth protecting with the same care you give to your bank card. Set the locks, move your logins off SMS, and check the locks every few months. The work is quiet, the cost is small, and the day you need it, you will be glad the wall was already there.