Your phone shows “No Service.” You restart it. Nothing. You try to make a call and get an error message. You assume it’s a network outage — until you notice your email won’t load, your bank app has logged you out, and a password reset email you never requested is sitting in your inbox.
Then it hits you: your phone number is gone. Someone else has it.
This is called SIM swapping, or SIM hijacking. And if you are reading this while it is happening, you have minutes — not hours — to limit the damage.
I spent 17 years inside bank fraud investigations. I have reviewed account takeover cases that started exactly this way: a victim loses cell service, and by the time they borrow a phone to call their carrier, the scammer has already reset their email password, accessed their bank account, and initiated a transfer.
The FBI’s Internet Crime Complaint Center (IC3) logged 971 SIM swap complaints and over $17.3 million in losses in 2025 alone. The actual number is almost certainly higher, because many victims never realize a SIM swap was the entry point. They just see missing money and assume their bank account was hacked directly.
This is your damage-control plan. Not “change every password immediately” — that can make things worse if done in the wrong order. The right sequence matters.
“Your phone number is the master key. If someone else has it, your accounts are already at risk.”
— Rebecca Harlow
Key Takeaways
SIM swapping happens without your involvement. The scammer contacts your carrier, impersonates you, and requests a new SIM card. Your service goes dead. Their phone starts receiving your calls and texts.
The scammer’s first targets are your email and your bank. With access to your phone number, they can intercept one-time passcodes, reset passwords, and take over accounts.
Call your carrier first — from a different phone. Ask them to reverse the SIM swap and freeze further changes to your account. This is the step that restores your access to everything else.
Do not change every password yet. Change your email password first, from a trusted device. Your email is the recovery key for everything else. If the scammer still controls your phone number, changing bank passwords won’t help — they can reset them again.
A SIM-swapped transaction is usually an unauthorized transaction under Regulation E. If the scammer used your phone number to access your bank account and initiate a transfer, you may have liability protections. Say so clearly when you call your bank.
File reports with the FTC, IC3, and your carrier’s fraud department. The carrier may have liability under FCC rules, and your reports create the record you will need for any dispute.
What Is Actually Happening to Your Phone
SIM swapping is not a hack of your phone. It is a con against your mobile carrier.
Here is the sequence, step by step:
1. The scammer gathers your personal information. Your name, address, date of birth, and sometimes the last four digits of your Social Security number. They get this from data breaches, phishing messages, or purchased lists of personal data. They may already have your information from a previous scam.
2. They contact your carrier. Posing as you, they say their phone was lost or damaged and they need a new SIM card — or in the case of eSIM, they request a remote provisioning of your number to a new device. If the carrier’s verification is weak, the request goes through.
3. Your service dies. Theirs begins. The carrier deactivates your SIM and activates a new one controlled by the scammer. Your phone shows “No Service.” Their phone starts receiving your calls and texts.
4. They go after your accounts. With your phone number, they trigger password reset requests for your email, bank, social media, and cryptocurrency accounts. Every one-time code goes to them. They reset your email password first, then use that email to reset everything else.
5. They move your money. Bank transfers, Zelle payments, cryptocurrency withdrawals. The window between “service dead” and “money gone” can be under 15 minutes. With eSIM remote provisioning, the entire cycle can be completed in under five minutes.
You are not losing your mind. You are losing your number. And the scammer is using it to dismantle your digital life.
The Red Flags: How to Know It’s a SIM Swap
The most common warning sign is sudden, unexplained loss of cellular service. But other signals may precede it:
You receive a carrier notification about a SIM change or number porting request you did not make. FCC rules require carriers to notify customers when a SIM change request is made on their account. If you get this notification and didn’t request it, act immediately.
You are suddenly logged out of apps that use your phone number for verification. Banking apps, messaging apps, and social media may log you out when your number is reassigned.
You stop receiving calls or texts, but the people who try to reach you say the calls go straight to voicemail or ring endlessly.
You receive password reset emails you did not request. This means the scammer is already trying to get into your accounts.
Your two-factor authentication codes stop arriving. Because they are going to the scammer’s phone instead of yours.
If any of these happen, assume the worst. Call your carrier from a different phone immediately.
The First 60 Minutes: What to Do in Order
This sequence is designed to stop the bleeding before you try to clean up. Do not skip steps. Do not start with “change all passwords.”
Step 1: Call Your Carrier From a Different Phone (Minutes 0–10)
Use a landline, a friend’s phone, or any device that is not your hijacked number.
Call your carrier’s customer service or fraud department. The number is on their website or your bill. Tell them exactly this: “My phone number was stolen through a SIM swap. I did not authorize this. I need you to reverse the SIM transfer immediately and freeze any further changes to my account.”
Ask them to:
Reverse the unauthorized SIM swap and restore service to your device — the first step is simply verifying your identity and restoring your original SIM or eSIM profile.
Place a port freeze or SIM lock on your account. This prevents anyone from porting your number out again or requesting another SIM change without additional verification. Most major carriers now offer this at no cost.
Set a carrier account PIN or password if one is not already in place. This PIN must be provided verbally before any account changes are made.
Block “charge to bill” activity, which prevents the scammer from making purchases billed to your mobile account.
Ask how the swap happened. Which store or channel was used? What verification did the scammer provide? This information matters for your report.
Do not hang up until your service is restored or the carrier confirms the reversal is in process. Get the name of the representative, a reference number, and written confirmation if possible.
Step 2: Secure Your Email Account From a Trusted Device (Minutes 10–25)
Your email is the master key. If the scammer gets into your email, they can reset every other password you own.
Use a computer or tablet that you trust — not the hijacked phone. Log in to your primary email account. If you can still log in:
Change your password immediately. Use a password you have never used before. Long, random, unique.
Sign out of all active sessions. Most email providers have a “security” or “devices” section. Sign out of every device that is not yours.
Check for forwarding rules. Scammers often set up automatic forwarding so they continue receiving your messages even after you lock them out. Delete any forwarding address you do not recognize.
Check your recovery email and phone number. If the scammer changed your recovery information, change it back. If they set their own phone number as your recovery number, remove it.
Enable multi-factor authentication that does not rely on SMS. Use an authenticator app or a hardware security key. SMS codes are the vulnerability the scammer just exploited.
If you cannot log in to your email — the scammer changed the password — use your provider’s account recovery process. This may require verifying your identity through a backup method. If you have a recovery email that the scammer has not accessed, use that.
Step 3: Secure Your Bank and Financial Accounts (Minutes 25–45)
Now that your email is locked down, move to your money.
Call your bank’s fraud department using the number on your card or statement. Do not use any number you find in a text message or email — the scammer may have sent you a fake one.
Say this: “My phone number was hijacked through a SIM swap. The scammer used it to access my account and initiate transactions without my authorization. I need to file a Regulation E dispute for unauthorized transactions.”
Then ask:
What transactions occurred during the hijack window? Get dates, amounts, and recipients for everything.
Can any pending transfers be stopped?
Was my contact information changed? If the scammer changed your phone number or email on the account, change it back.
Was my password changed? If so, reset it now.
Why this matters legally: A SIM-swapped transfer is usually an unauthorized electronic fund transfer under Regulation E. You did not initiate it. You did not authorize it. The scammer used a fraudulently obtained access device — your phone number — to initiate the transfer. The CFPB has clarified that fraudulently induced credential sharing can qualify as unauthorized, and a SIM swap is even clearer: you did not share anything. The scammer stole your number from your carrier.
If the transaction is classified as unauthorized, your liability is capped at $50 if you report within 2 business days, or $500 if you report within 60 days of the statement.
Ask specifically: “Is this being processed as an unauthorized transaction?” If the bank says it is “authorized,” push back. “I did not initiate this transfer. My phone number was stolen. This qualifies as an unauthorized transaction under Regulation E.”
Repeat this process for:
Credit card issuers
Investment and retirement accounts
Payment apps (Zelle, Venmo, Cash App, PayPal)
Cryptocurrency exchanges
Step 4: Secure Your Other Critical Accounts (Minutes 45–60)
Once email and banking are locked down, move to everything else that uses your phone number for verification:
Social media accounts. Change passwords and enable non-SMS MFA.
Messaging apps. WhatsApp, Signal, and Telegram use your phone number as your identity. If the scammer controls your number, they may be able to register your account on their device. Check whether your account is still logged in on your device, and use the app’s security settings to log out all other devices.
Cloud storage and password managers. If the scammer accessed your email, they may have reset passwords for these too.
Any account with stored payment information. Review and remove any payment methods you do not recognize.
Step 5: File Your Reports (Minutes 60–90)
Once your accounts are secured, file the reports that create your legal record.
File with your carrier’s fraud department. Ask for a written confirmation of the unauthorized SIM swap, including the date, time, and channel used. This document may be necessary for your bank dispute.
File with the FTC at ReportFraud.ftc.gov. Describe what happened: your phone number was hijacked, your accounts were accessed, and money was taken. The FTC report generates a recovery plan and becomes part of the Consumer Sentinel Network.
File with the FBI’s IC3 at ic3.gov. SIM swap is a federal crime. The IC3 collects reports and may coordinate with carriers and financial institutions.
File a police report with your local department. Bring your carrier confirmation, your FTC report, and any bank records showing unauthorized transactions.
Report to IdentityTheft.gov if your personal information was exposed. A SIM swap means the scammer had enough of your personal data to impersonate you to your carrier. That data may be used for other fraud.
Why You Should Not “Change Every Password” First
Most online advice tells you to change all your passwords immediately after a SIM swap. That advice is incomplete and can backfire.
If you change your bank password while the scammer still controls your phone number, you may lock yourself out of your own account. The bank’s password reset process will send a code to your phone number — which the scammer receives. You will have changed the password, and the scammer will immediately change it again.
The correct order is:
Restore your phone number. Call your carrier first.
Secure your email. This is the recovery key for everything else.
Secure your financial accounts.
Secure everything else.
If you cannot restore your phone number quickly, secure your email from a trusted device and then contact your bank. The bank can verify your identity through other means — security questions, in-person verification, or a callback to a different number.
The Legal Framework: Your Protections
SIM swap sits at the intersection of telecom regulation and financial regulation. Here is what protects you.
FCC Rules on SIM Changes
The FCC adopted rules in November 2023 requiring wireless carriers to use secure methods of authenticating a customer before redirecting a phone number to a new device or provider. Carriers must also immediately notify customers whenever a SIM change or port-out request is made on their account.
These rules are not perfect. Carriers have been slow to implement strong authentication, and the Princeton CITP study found that 39 out of 50 attempted SIM swaps succeeded across five major U.S. prepaid carriers using insecure authentication. But the rules give you a basis for complaint if your carrier failed to protect your account.
Regulation E and Unauthorized Transactions
If a SIM swap leads to unauthorized transactions from your bank account, Regulation E applies. The scammer obtained access to your account through a fraudulently obtained device — your phone number. You did not authorize the transfer. You did not initiate it.
Under Regulation E, the bank must investigate promptly and determine whether an error occurred within 10 business days. If it cannot, it may take up to 45 days — but must provide provisional credit within 10 business days.
Your liability is capped at $50 if you report within 2 business days of learning of the loss, or $500 if you report within 60 days of the statement showing the unauthorized transfer.
The key language for your bank dispute: “This transaction was not initiated by me or by anyone acting with my authority. My phone number was hijacked through an unauthorized SIM swap. The scammer used that number to access my account and initiate a transfer without my authorization. This is an unauthorized electronic fund transfer under Regulation E.”
Carrier Liability
The March 2025 arbitration award of $33 million against T-Mobile for a SIM-swap-enabled cryptocurrency theft has changed the legal landscape. The arbitrator found that the carrier’s weak authentication enabled the theft.
You are not likely to win a $33 million arbitration. But the precedent matters. If your carrier failed to follow its own security procedures — or the FCC’s authentication requirements — you may have a claim. At minimum, your complaint to the carrier and the FCC creates a record that supports your broader dispute.
After the Immediate Crisis: Preventing the Next One
Once your number is restored and your accounts are secured, take these steps to make sure it does not happen again.
Enable a carrier port freeze or SIM lock. Most major carriers offer this at no cost. It requires additional verification before any SIM change or number port can occur. Ask your carrier specifically for a “port freeze” or “SIM lock.”
Switch from SMS-based two-factor authentication to an authenticator app or hardware key. SMS codes are the vulnerability that made the SIM swap so damaging. An authenticator app generates codes on your device, not through your phone number. A hardware key is even stronger.
Set a carrier account PIN. This PIN must be provided verbally before any account changes. Do not use your birthday or a common number. Store it somewhere safe.
Use a password manager. Unique passwords for every account make it harder for a scammer to move from one breached account to another.
Monitor your accounts for at least 90 days. Check bank statements, credit reports, and email settings weekly. Scammers sometimes wait weeks before using stolen information.
Tell your family and contacts. The scammer may use your number to impersonate you and ask your contacts for money or gift cards. Warn them.
No comments yet.