SIM Swap Protection: Keep Criminals Off Your Number

If your phone suddenly shows “Emergency calls only” while everyone around you has full bars, treat it as an alarm, not an annoyance. That is often the first visible sign of a SIM swap, and good SIM swap protection is mostly about making that moment rarer and shorter.

How a SIM Swap or Port-Out Actually Happens

A SIM swap does not hack your phone. It attacks the process your mobile operator uses to replace lost SIMs or move numbers between networks. It usually goes like this:

1. The criminal gathers your name, date of birth, address and sometimes your ID number. This usually comes from leaked data, social media or a phishing call.
2. They contact your operator or a retail agent, claim to be you, and ask for a replacement SIM because the old one was “lost.” A forged ID, or a careless or bribed staff member, does the rest.
3. Or they request a port-out, which moves your number to another operator where they control the new SIM.
4. Your own SIM goes dead. Your calls and texts now reach them.
5. They open your email, bank or wallet, tap “forgot password,” and receive the reset code by SMS.

Once the new SIM is live, this can take minutes. The damage depends on how many of your accounts accept an SMS code as proof that you are you.

Warning Signs That Someone Is Moving Your Number

• Your signal vanishes and the phone shows “No service” or “Emergency calls only” in a place where it normally works, while Wi-Fi still connects.
• Your operator texts you about a SIM replacement or number transfer you did not request. Read these messages instead of swiping them away. They sometimes arrive just before the change takes effect.
• You get password reset emails or new sign-in alerts you did not trigger, especially for email, banking or mobile money.
• Someone calls claiming to be from your operator and asks you to read out a code to “verify” your SIM. Never read a code to anyone.

Losing signal in a basement is normal. If your SIM goes dead where coverage is usually fine, and you also see any other sign on this list, act on it.

Carrier Locks and PINs to Request From Your Operator

Operators differ by country, so treat this as a list of questions for customer care or an official service centre, not exact menu steps.

• SIM PIN: Turn on the SIM lock in your phone’s security or SIM settings. It stops a thief who has your handset from using the SIM in another phone. It does not prevent a swap done at the operator. If you enter the PIN wrong too many times you will need the PUK code, so find out where yours is before you turn the lock on.
• Account or port-out PIN: Many operators let you add a passcode that must be given before any account change or transfer to another network. Some call this a number lock or port freeze.
• Stricter ID checks: Ask whether a SIM replacement on your number can require an in-person visit with original ID.
• Change alerts: Ask whether you will be notified of SIM changes, and check that the contact details on file are current.

In Bangladesh, SIM registration is linked to your national ID and fingerprint, and each operator has its own replacement and number-portability procedure. Rules in India, Pakistan and elsewhere vary too. Ask your operator exactly what ID and verification a replacement requires, so you know what an attacker would need to fake. The FCC’s guide on how to protect yourself from SIM swapping is written for US customers, but most of its advice applies elsewhere.

SIM Swap Protection Starts With Your Accounts, Not Your SIM

Operator locks reduce the risk but cannot remove it, because the weak point is often a person at a counter. The stronger move is to make your number less useful to a thief. If your number does not unlock your email or bank, most attackers give up.

1. Start with your main email account, because it can reset almost everything else. Switch its second step from SMS to an authenticator app. Our guide to setting up two-factor authentication without headaches explains how.
2. Add passkeys wherever they are offered. Read how to set up passkeys without getting locked out first, so your recovery does not depend on one phone.
3. Remove your phone number as a recovery option wherever another method exists. If you leave SMS recovery on, an attacker can use it to get around your authenticator app.
4. Save your recovery codes offline. Our piece on backup codes you should store now explains where to keep them.

Some banks and mobile financial services, such as bKash or Nagad, still tie login to your number, and you cannot change that. For these, use a strong app PIN, never share one-time codes, and avoid keeping large sums in a wallet that depends on one SIM.

Keeping Your Phone Number Out of Public Profiles

Attackers choose targets they can research. A few habits make you harder to profile:

• Hide your number on Facebook, Instagram and LinkedIn, and limit who can find you by searching for it.
• Keep your number out of public groups, marketplace listings and comments. Use in-app chat instead.
• Consider a second SIM for deliveries and sign-ups, and keep your main number for banking.
• Be suspicious of any caller who asks for your date of birth, NID number or a one-time code, even if they already know your name.

The First Hour After Your Signal Drops

1. Take two minutes to rule out an outage. Restart the phone and ask someone nearby on the same network whether their signal works.
2. Call your operator from another phone. Say you suspect an unauthorised SIM swap or port-out, ask them to block the number, and ask when the SIM was last changed. Write down the time and the agent’s name.
3. Secure your email first, using a laptop or another device. Change the password, sign out of other sessions, and check that the recovery phone and email have not been changed.
4. Next, call your bank and mobile money provider to freeze cards and transactions. Use the number printed on your card or listed on the official website.
5. Then go through social media, cloud storage and any shopping accounts with saved cards.
6. Visit your operator with your ID to restore your SIM and get a reference number. File a police report if money was taken.

None of this makes a swap impossible. It does mean that if someone takes your number, it leads them to a locked door rather than your inbox.