SIM-swap attack: your phone number was just stolen

A SIM swap does not touch your phone — it social-engineers your carrier. Someone claiming to be you asked for "their" number on a new SIM, and the carrier obliged. From that moment, calls and texts — including one-time codes — route to the attacker.

It is one of the fastest-moving attacks a person can face, because it is usually the setup for draining specific accounts the attacker has already scoped. Minutes matter; the checklist keeps them productive.

Do this now

1. Call the carrier's fraud line. From any other phone. State it is an unauthorized SIM swap, get the number reversed, and have them lock the account against further changes with a PIN only you hold.
2. Secure email from a safe device. Change the password and revoke sessions before the attacker uses your number to reset it — if they already have, use the provider's account-recovery flow immediately.
3. Call the bank. Tell them your number is compromised, freeze suspicious activity, and remove the number as a verification factor until this is over.
4. Move critical accounts off SMS. Banking, email, crypto, work: switch second factors to an authenticator app or passkey now, and remove the phone number as a recovery method where you can.
5. Read the reset trail. The reset emails that arrived show you exactly which accounts were targeted — work through that list, changing credentials and checking activity.
6. Report and paper it. Police or national fraud service report, carrier case number, bank case numbers. If money moved, those references anchor the disputes.

What not to do

• Do not wait for the signal to "come back on its own" — every quiet minute is working time for the attacker.
• Do not do recovery from a device whose sessions may already be hijacked; use one you trust.
• Do not put SMS 2FA back on critical accounts after recovery.
• Do not assume it ended when the number returns; the accounts touched in between stay suspect.
• Do not skip the carrier lock — unprotected accounts get swapped twice.

Preserve the evidence

Whatever else happens, these are the artifacts the investigation — and any insurance claim, dispute, or prosecution — will be built from:

• The exact time service dropped and when it was restored.
• Every password-reset and login-alert email received during the window.
• Carrier fraud case number and what they say about how the swap was authorized.
• Bank and account activity logs for the gap.

Keep a clear head

A SIM swap is a sprint, and sprints invite panic. The paradox is that the attacker is counting on you fumbling for fifteen minutes — working a list beats improvising at speed. Say the steps out loud if you are alone; it slows the heart rate and keeps the order straight.

The violation of watching resets arrive for your own accounts is real. Once the number is locked and email is yours, the attack's engine is off — the rest is cleanup, not crisis.

Questions victims ask