How To Prevent SIM Swapping and Port-out Scams

Here's How Scammers Hijack Your SIM Card

How do scammers have enough information to convince a customer service representative that they are you? 

SIM swap attacks don’t happen overnight. Scammers harvest data about you before they attempt to impersonate you. They use several tactics — such as social engineering via phishing emails or malware and extensive social media research.

For example, the scammer may send an email claiming to be your service provider. They’ll ask you to fill out some information to keep your account active. You could unwittingly share personal information like your date of birth, password, address, etc. 

If the scammer somehow installed malware on your mobile phone, they can record your keystrokes and see any passwords or answers to security questions that you enter. Fraudsters can buy your information off the Dark Web, thus arming themselves with any information needed to to switch your number to a new SIM card.

📚 Related: How Can Social Security Identity Theft Occur? [9 Ways] →

SIM Swapping on Postpaid Vs. Prepaid Accounts

• Authentication procedures to sign up for prepaid SIM cards tend to be more porous than with postpaid SIMs. Prepaid accounts can be registered without prior credit checks or proof of real-world identification.
• Some providers like T-Mobile offer a NOPORT option that throttles a port-out request. At the time the Princeton paper was published, T-Mobile did not offer NOPORT on prepaid SIMs.
• While postpaid accounts now require Number Transfer PINs (see below), prepaid accounts (like AT&T prepaid SIMs) do not.

📚 Related: What To Do With an Old SIM Card (Don't Throw It Out!) →

5 Signs That Indicate a SIM Swap Attack

SIM swapping will cause your phone to act up. Here are some signs that you might be a victim:

• Service changes. When your provider tells you that your SIM card or phone number has been activated elsewhere, that's the first sign. 
• Inability to send or receive texts and phone calls. Once the scammer activates your SIM on another device, your phone number becomes unusable. 
• Security notifications. Receiving alerts about changes to your profile data, such as passwords and security questions, is another sign. Failed login attempts from unrecognized sources are yet another clue that you’ve been hacked.
• No access to your online carrier account. Scammers can lock you out of your carrier account. That way, you cannot file a complaint, lock your phone, or access your private information.
• Inability to use apps on your phone. SIM swap attacks prevent you from logging into your phone apps and accounts.
• Unusual activity on your social media accounts. SIM swap attacks usually target victims who have valuable online accounts — like a sizable audience on Twitter, LinkedIn, or Instagram. Strange online activity from social media accounts can indicate account takeovers.

📚 Related: Did Someone Open a Cell Phone Account In Your Name? Do This! →

What Phone Carriers Do to Prevent Unlawful SIM Swapping

Single-use passcodes to request a service call

• T-Mobile customers are required to set up an individual 6–15 digit PIN to verify their identity when calling customer service.[*]
• These authentication codes also help verify the legitimacy of any account changes.

Number Transfer PIN (NTP)

• A Number Transfer PIN is a code generated when porting a postpaid number to another carrier.
• This authentication method ensures that a SIM swap or port-out request is from a genuine customer.

All three major carriers now use NTPs for authentication:

• Verizon rolled out NTPs and Number Locks in July 2020.[*]
• AT&T followed suit in September 2021.[*]
• T-Mobile added NTPs for port-outs in April 2022.[*]

SMS verification to change SIMs

• Carriers like AT&T built a risk-scoring model to identify high-risk requests by customers for SIM changes and port-outs.[*] If a SIM swap request meets (or exceeds) specific thresholds in their risk model, AT&T sends a no-charge SMS confirmation for the customer to approve or reject a pending SIM swap.

Account takeover protection 

• Verizon provides customers with a feature called Number Lock to prevent SIM swaps. When you activate a Number Lock on your account, the number cannot be transferred until you remove the lock.

Two employee sign-off

• If other authentication methods aren’t available, carriers like Verizon require two employees to sign off on a SIM swap or port-out transaction. AT&T responded that such a step would hinder legitimate SIM swap requests and not actively prevent social engineering or collusion.

Multiple authentication protocols 

In a statement released by Verizon, the carrier states that they are training customer care employees to identify and present unauthorized SIM change attempts through multiple authentication protocols.[*] 

These protocols include:

• Push notification-based authentication.
• Face ID or fingerprint recognition to log in securely to the carrier’s native app.
• Answering security questions.

In stores, retail employees are also required to scan a customer’s ID using technology that looks for indications of authenticity. 

What Can You Do to Prevent SIM Swapping?

Set up 2FA via an authenticator app

• Use an authentication app like Google Authenticator (or a similar tool) to secure all of your online accounts.
• Browse the 2FA Directory to learn which apps and websites support this important layer of authentication.

Be wary of phishing emails, texts, or phone calls

• Keep an eye out for phishing emails and other ways scammers can wrest your data from you.
• Don’t click on any links from emails or texts from people you don’t know. Reputable companies (like your credit card company or carrier) will not ask for your personal information through email.

Use biometric authentication, password manager

• Create unique, complex passwords and store them in a password manager. Download its browser plug-in, so you always have easy access to your passwords.
• SIM cards may be easy to steal, but faking biometrics is not. Turn on Face ID authentication for your devices to keep your devices secure and your data uncrackable.

Set up a SIM PIN and carrier alerts

• When you buy a SIM card, you also get a PIN for it. This four-digit code activates the SIM card when you insert it into your phone.
• Change the PIN from its default number to a new one that only you know. Learn how to change your SIM PIN on Apple and Android devices.
• Double-check that your mobile carrier will alert you in case of a SIM swap or port-out. Many providers will send a text message asking you to confirm a swap. 

Place a port freeze or number lock 

• Call your cell phone provider and ask for a port freeze, and lock the account to your current SIM. If you have Verizon, you can lock your SIM from your MyVerizon mobile app.
• T-Mobile also offers Account Takeover Protection for free to keep your number safe from unauthorized port-outs.

Switch to a burner number for simple transactions 

• Use a no-contract, temporary number to maintain privacy if you need to give out your number for non-essential transactions. Apps like Burner and Hushed will give you a second number that you can use for calls and texts from your smartphone.
• Aura also lets you generate email aliases to hide your actual email address so that you can prevent unwanted or spam emails from crowding your inbox.

Restrict what you post online

• The more you share on social media, the easier it is for scammers to learn who you are. Don’t share your phone number, Social Security number, information about financial assets, or daily locations. 
• Run a free privacy scan to see what personal details of yours have been exposed in a data breach and remove them.

Remove your cell phone as an account recovery option

• Go into all your online accounts and set your primary email address as a recovery option. If a scammer only controls your cell phone number, it’ll be harder to take over accounts when your cell phone is not a recovery option.

📚 Related: How To Block Websites on iPhones and iPads [4 Ways] →

Report SIM Swap Fraud Right Away

1. Alert your carrier. Call your phone provider immediately. Remember that you can’t make phone calls anymore, so you need to borrow someone’s phone. Explain your predicament and ask your provider to remove your number from the stolen SIM. 
2. Write down the service representative’s ID number, name, and case ID number. Keep this information for your records and future conversations with the police.
3. Request that your service provider retains all logs. Ask for the phone’s International Mobile Equipment Identity (IMEI) number, time of call, and the names of everyone involved in fulfilling the SIM swap request. Save this information for your police report. 
4. Notify your banks and other financial service providers. Alert your bank, investing accounts, and any other financial institutions about the unlawful SIM swap.  
5. Lock down your accounts. Write down a list of all your online accounts, like personal email, cryptocurrency exchange, payment apps, and online banking accounts. Starting with your primary email address, go down the list and change the login credentials for every account. Prioritize accounts that you know the attacker has access to or has tried to get access to. 
6. File a police report. Visit your local police department’s website and file a police report online (if possible) or in person. Then report the attack to the Internet Crime Complaint Center (IC3) on www.ic3.gov. 
7. Place a fraud alert on your credit reports. Contact one of the three credit bureaus (Equifax, Experian, or TransUnion) and request a fraud alert. You can do this online in under 30 minutes.  
8. File a report on the BBB Scam Tracker. This tool collects and presents scam data to prevent others from falling prey to similar attacks. 
9. Don’t engage with the attacker. Attackers may attempt to extort you after swapping your SIM. Avoid having any conversation with them. Record — but ignore and don’t respond to — any messages. 

If you have a cell phone, whether it’s prepaid or postpaid, you’re at risk of a SIM swap attack. Monitoring your finances and other important accounts is one way to soften the blow after such attacks.

And for precautions that you can’t manage on your own, there’s always Aura. Identity protection services like Aura double down on monitoring, alerts, and recovery. 

Aura also offers $1 million in identity theft insurance coverage along with 24/7 support from experienced fraud resolution specialists who can walk you through an identity theft recovery plan.

Ready for ironclad identity theft protection? Aura is free for 14 days.