A SIM swap or port-out scam moves your phone number to a SIM or account the attacker controls, and with it every SMS code your accounts send. Protect yourself in two directions: make your carrier account harder to hijack with a PIN, and move your important logins from SMS to an authenticator app, a security key or a passkey.
How SMS codes protect an account, and where they fall short
Two-factor authentication asks for something you have on top of your password. A code by text proves you hold the phone number at that moment. That stops anyone who only stole your password.
| Protects against | Weak spot | |
|---|---|---|
| Code by SMS or call | Stolen passwords | Whoever takes over the number gets the code |
| Authenticator app | Stolen passwords, number hijacking | Can still be typed into a fake site |
| Security key or passkey | Stolen passwords, hijacking, fake sites | You need the device with you |
CISA calls FIDO/WebAuthn the only widely available phishing-resistant method, and also says any MFA is better than no MFA.
What SIM swapping is
- Collecting details The attacker gathers what your carrier asks for: address, birth date, parts of ID numbers, from social media or leaked data.
- Calling your carrier Posing as you, they ask to move the number to a new SIM or port it to another provider.
- Your phone goes dark The FCC names it as the first sign: no service, or emergency calls only.
- Codes go to them Now password resets and login codes by SMS reach the attacker, who races to change your passwords.
Five steps that make a swap harder
- Add a PIN or password to your mobile account if you do not have one. Ask your carrier which protections it offers.
- Move key accounts off SMS: email, cloud storage and social accounts to an authenticator app, a passkey or a security key.
- Save backup codes where you can reach them without your phone. Google, for example, gives you ten, each usable once.
- Turn on alerts by email and text for important accounts, so a change you did not make is noticed at once.
- Share your main number less. The FCC lists your phone number among the details to keep off social media.
Never use a temporary number for two-factor codes
A two-factor number has to reach you for as long as the account exists. A temporary number is closed after one code and can later belong to someone else, so the next login code would go to a stranger or nowhere.
| Your own number | A one-time number | |
|---|---|---|
| Two-factor login | Yes, ideally replaced by an app or key | Never |
| Password reset by SMS | Yes | Never |
| A sign-up you need once | Possible, but your number spreads | Yes: keeps your main number out of one more database |
That is the privacy side of the same idea: the fewer places hold your main number, the less there is to collect for a swap. Where one-time numbers fit and where they do not: temporary phone numbers.
Common questions
What is SIM swap protection?
Measures that make it harder to move your number without you: a PIN or password on your carrier account, and logins that do not depend on SMS.
Is SMS two-factor authentication safe?
Safer than a password alone, weaker than an authenticator app or security key, because a hijacked number receives the codes.
How do I know if I have been SIM swapped?
Your phone suddenly has no service or only allows emergency calls, often followed by password-reset messages you did not request.
Can I use a virtual number for 2FA?
Not a temporary one. Two-factor codes must reach you for years, and a number for one code is gone after it.