untrappable.Check

SIM swap scam: how your number gets stolen

Editorially reviewed · Last updated September 8, 2026

Yes — this is a scam. Do not give mobile-account secrets to an unverified caller. A PIN is one protection, not the only barrier against SIM-swap or port-out fraud.

Exhibit · Phone call

Incoming call
Spam Risk
(866) 555-0138
maybe: Wireless Fraud Dept
Voicemail transcript

“Hi, I'm calling from the fraud prevention team about your wireless account. We've flagged a port-out request on your line from another state and we can cancel it, but I need to verify you first. Can you confirm your account PIN and the last four of your Social? If we don't cancel it in the next few minutes the transfer goes through.”

Illustrative phone call · not an original screenshot

Other versions you might get: The same attack arrives without any call at all. Scammers walk into a store or phone the carrier themselves, posing as you with details bought from a data breach — the FBI calls that social engineering, and it also documents criminals paying off carrier employees to make the swap from the inside. A softer version is a text or email asking you to “confirm your account” on a look-alike carrier login page, harvesting the PIN that way. You may never hear from anyone: the first sign is your phone going quiet.

What to do right now

  1. Hang up and call your carrier yourself, on the number printed on your bill or in the carrier's own app. The FCC's rule for this scam is blunt: if someone calls or texts asking for personal information, don't give it — hang up and call the business on a number you trust.
  2. Ask your carrier about account and transfer protections. Add an account PIN or available SIM/port lock and enable alerts. Check its current procedures; do not rely on a claimed universal implementation date for regulatory protections.
  3. Get your codes off SMS. The FBI recommends strong multi-factor authentication — biometrics, a physical security token, or a standalone authenticator app — precisely because text-message codes land on whichever device holds the number. Start with your email and bank; email is the account that resets everything else.
  4. Stop feeding the profile. The FBI says not to advertise financial assets or crypto holdings online, and the FCC says to keep the answers scammers need off social media: the last four of your Social, your date of birth, your car, your pet's name, your mother's maiden name.
  5. If your phone has already gone dark: contact your carrier immediately to get the number back, then change the passwords on your email and financial accounts, tell your banks to watch for suspicious logins and transfers, file a police report, and place a fraud alert with one of the three credit bureaus — Equifax, Experian or TransUnion — which will share it with the other two. Report it at ic3.gov and file a complaint at consumercomplaints.fcc.gov.

Reduce the risk of another scam

Hang up and verify the claim through a number you find independently. If you paid or shared account details, start with what to do after a scam. Blocking and reporting can reduce unwanted contact, but they cannot stop every attempt or tell you how the sender found you.

● Public service · free steps first

Take the free protection steps first

A suspicious message does not tell us how someone found your details. If you shared personal information, start with the official recovery guidance. You can also freeze your credit for free.

Decide what protection you need

Start with the free controls above. Compare what a paid service would add only after deciding which problem remains.

Compare free and paid protection →

No purchase needed. How we use evidence.

Frequently asked

My phone suddenly says No Service — have I been SIM swapped?
Loss of service can have ordinary causes or indicate an unauthorized SIM change or port-out. Use another phone or Wi-Fi to contact your carrier promptly, especially if you see unexpected account alerts. If a transfer was unauthorized, secure email and financial accounts tied to the number and review activity.
What is a SIM swap scam, exactly?
It's the theft of your phone number rather than your phone. The FBI describes it as criminals targeting mobile carriers to move your number onto a SIM card they control — by impersonating you with personal details they've gathered, by phishing carrier staff, or by paying an insider. Once the number moves, your calls and texts divert to their device, and they use “forgot password” and account-recovery flows plus SMS two-factor codes to take over your email, bank and crypto accounts. Port-out fraud is the same theft done through a different door: instead of a new SIM at your carrier, they open an account at a different carrier and have your number ported to it.
Does an eSIM protect me from SIM swapping?
An eSIM does not prevent someone from deceiving a carrier into an account change or transfer. A transfer lock or PIN and authentication that does not depend on SMS can reduce risk, but none guarantees prevention.
How do I stop a SIM swap before it happens?
Three things, in order. First, call your carrier and set a port-out PIN or password on the account — the FCC lists this as the proactive step, and it's the credential the whole scam is built to extract. Second, move two-factor authentication off SMS: the FBI recommends biometrics, a physical security token, or a standalone authenticator app, and email plus banking are where to start. Third, turn on both email and text alerts for financial accounts, so a change you didn't make reaches you somewhere other than the phone number under attack. And never give account details to someone who called you, however convincing the fraud-department story is.
I've been SIM swapped — what do I do first?
Call your carrier from any other phone and get the number back; nothing else works until you control the number again. Then, in the FBI's and FCC's order: change the passwords on your online accounts starting with email, contact your banks and card issuers to flag suspicious logins and transactions, file a police report, and place a fraud alert on your credit reports at Equifax, Experian or TransUnion — the one you notify tells the other two. Report it to the FBI at ic3.gov and file a free complaint with the FCC at consumercomplaints.fcc.gov. Keep a written timeline as you go; your bank will ask for it.

Related scams

TextScam

T-Mobile text scam: is that T-Mobile message real?

Got a T-Mobile text about a free gift, a failed payment, or a suspended line? Here's the verdict and exactly what to do.

TextScam

Verizon text scam: is that Verizon message real?

Got a Verizon text about a bill credit, a failed payment, or account verification? Here's the verdict and exactly what to do.

TextScam

AT&T text scam: is that AT&T rewards text real?

Got an AT&T text offering a reward, a bill credit, or asking you to sign in? Here's the verdict and exactly what to do.

TextScam

Google Voice scam: never send that verification code

A “buyer” wants you to text back a Google code to prove you're a real person? Here's the verdict and what to do.

Sources

  1. 01Criminals Increasing SIM Swap Schemes to Steal Millions of Dollars from US Public— FBI Internet Crime Complaint Center
  2. 02Port-Out Fraud Targets Your Private Accounts— Federal Communications Commission
  3. 03Cell Phone Fraud— Federal Communications Commission
  4. 04Internet Crime Complaint Center (IC3)— FBI
  5. 05Official security and fraud guidance— docs.fcc.gov
  6. 06What To Do if You Were Scammed— consumer.ftc.gov

Pass it on

Help protect someone else

If this could have fooled you, it can fool someone you know — a parent, a friend, the family group chat. It's safe to forward, and stands on its own as a record for a bank or the police.