The first sign is silence. Your phone drops to "No Service" — not for the ninety seconds of an elevator ride, but for twenty minutes at a desk with full coverage. Somewhere else, someone has walked into a carrier store with a story about a lost handset, or paid a shop employee, and had your number moved onto a SIM card in their hand. Their phone now receives every code standing between a stranger and your accounts.
That is a SIM swap, and notice what did not happen. Nobody broke encryption, cracked a password, or exploited a bug. A SIM swap is a customer-service attack. The weak part is a person at a counter, measured on how fast they close tickets, who genuinely does help customers replace lost phones every day. The attacker needs a name, a birth date, a billing address and confidence.
The warning sign almost everyone explains away
Losing signal is so ordinary that nobody treats it as an alarm, which is what makes it useful. The moment your number is ported, your handset is cut off and stays cut off. No warning arrives, because warnings travel over the network you no longer have.
So the rule is persistence, not the event. Signal that drops and returns is weather. Signal that reads "No Service" and stays there while everyone around you is online, and does not return after a restart, deserves five minutes of suspicion. Get on Wi-Fi and check your email: if reset messages you never requested are arriving, this is an account takeover in progress.
SMS is weak, but do not switch it off
It has become fashionable to dismiss SMS codes entirely. That advice is wrong in a specific, harmful way. Text-message 2FA defeats every attack that works at scale: credential stuffing, password reuse after a breach, phishing pages that capture only a password. Someone holding your leaked password can do nothing with it if a code must reach your phone.
What SMS cannot survive is a targeted attacker willing to spend an hour on you personally. So keep SMS where it is the only option offered, and get it off the accounts that can unlock everything else.
The ladder, weakest to strongest
SMS codes sit at the bottom, because they are bound to a phone number and a phone number can be reassigned by a stranger over a counter. Email codes are slightly better — no carrier to socially engineer — but they are only as strong as the mailbox receiving them.
TOTP authenticator apps are a real step up. The rotating code comes from a secret held on your device, with no network path to hijack; porting your number gets an attacker nothing. Setup takes about a minute per account, and a free online TOTP authenticator shows the mechanism working. We compared authenticator apps and SMS codes separately.
Hardware keys and passkeys sit at the top, for a reason beyond SIM swaps: they are bound to the site's actual domain. A perfect-looking phishing page cannot use them, because the key refuses to answer a site it was not registered with.
Hardening, in order of return
- Ask your carrier for a port-out PIN or number lock. Operators name it differently — port freeze, transfer PIN, SIM protection — but the effect is the same: no transfer without a secret that is not on your bill. Ask whether an in-store request can override it, because that is the path a real attack takes.
- Remove your phone number as a recovery method wherever something stronger exists. A number kept "just in case" is a fallback for whoever holds the number, and it downgrades everything else on the account.
- Keep recovery codes offline — printed and filed, not in the mailbox they are meant to recover, and not in a screenshot on the phone that might be stolen. The point of 2FA recovery codes is to survive losing the device.
- Give the password manager a master credential worth its job. Everything lives behind it, so make it long, unique and generated rather than invented: a random passphrase generator beats any phrase you would compose yourself.
- Fix the order. Email first, then the password manager, then bank and crypto. Those four can reset nearly everything else you own, and none of them should depend on a text message.
The first hour, if it happens
Call your carrier from another line — a colleague's phone, a landline, anything. This is the first call, not the second, because the number is the attacker's instrument: while they hold it, every reset you make can be undone by another code they intercept. Say "SIM swap" and "fraudulent port," and ask for the number to be restored and locked.
Then your email, from a device you trust: change the password, sign out all sessions, and inspect filter and forwarding rules, since attackers routinely leave one behind to keep receiving copies after being locked out. Then the bank and any exchange account, by phone, to freeze transfers. Keep notes with timestamps.
Frequently asked questions
Can I be SIM swapped if I use an eSIM?
Yes. An eSIM removes the physical card but not the process that provisions it, and that process still runs through customer service. The defence is unchanged: a port-out PIN or account lock, and treating a persistent loss of service as an alarm rather than a glitch.
Should I turn off SMS 2FA everywhere right now?
No. Turn it off only where you have replaced it with something stronger, and leave it where it is the only second factor offered. Prioritise the accounts that can reset others: email, password manager, bank, crypto.
Would I be told immediately if my number were ported?
Not by any alert, because alerts arrive over the network you have just lost. The loss of service is the signal, which is why persistent unexplained "No Service" is worth checking rather than shrugging at. Confirm over Wi-Fi by looking for reset emails you did not request.
