SIM Swap Attacks: How to Protect Yourself in 2026

What is a SIM swap attack?

A SIM swap (or SIM hijacking) is when an attacker convinces your mobile carrier to transfer your number to a SIM card they control. Once successful, they receive your SMS messages, including 2FA codes for your bank, email, and crypto accounts.

The scale of the problem

• FBI IC3 reports $72M lost to SIM swap in 2025 alone
• Average victim loses $10,000+
• Recovery rate is just 11%

How the attack works

1. Attacker gathers personal info from data brokers, social media, or phishing
2. They call your carrier, impersonate you, claim the phone was lost/stolen
3. Carrier ports your number to the attacker's SIM
4. They trigger password resets on your accounts using SMS 2FA
5. They drain your bank accounts, crypto wallets, social media

Warning signs

• Your phone suddenly loses signal in an area with coverage
• You get unexpected "SIM activated" notifications
• Bank/email alerts about login attempts or password resets
• Friends receive strange messages from your number

9 prevention strategies

1. Set up a carrier PIN

Call your carrier and set up a "port-out PIN" that must be provided for any number transfer.

2. Use authenticator apps instead of SMS 2FA

Google Authenticator, Authy, or hardware keys like Yubikey.

3. Don't link your phone number publicly

Remove it from social media profiles.

4. Use a separate number for high-value accounts

Keep your "real" number for trusted contacts only.

5. Freeze your credit

Equifax, Experian, TransUnion all offer free credit freezes that prevent account opening.

6. Use a password manager with unique passwords

So a SIM swap doesn't cascade across services.

7. Enable carrier-specific protections

AT&T: AT&T Mobile Security app

Verizon: Number Lock

T-Mobile: Account Takeover Protection

8. Monitor your accounts

Set up transaction alerts on every financial account.

9. Use confidential email addresses

Where supported, set email as the 2FA method instead of phone.

If you suspect an attack

1. Call your carrier immediately from another phone
2. Lock down financial accounts
3. File a report with the FTC and IC3
4. Change passwords on all critical accounts
5. Consider identity theft protection service

Long-term solution

Use RCVSMS for non-essential online accounts, keeping your real number for trusted contacts only. This way, even if a service is compromised, your SIM stays safe.