Key takeaways

If your phone suddenly loses service for no reason, call your mobile carrier from another phone right away. Your number may have been moved to a SIM someone else controls.

  • The FBI says criminals move your number to a SIM they control, then use text-message codes to reset passwords and take over accounts.
  • Use an authenticator app, a security key, or biometrics instead of SMS codes where you can.
  • Contact your carrier first, then your bank, then change passwords. Report to your national reporting service.

Got a name, website, or phone number from the sender? Check the scam directory.

How a SIM swap and account takeover work

The FBI’s Internet Crime Complaint Center (IC3) explains that criminals move a victim’s phone number to a SIM card they control. They do it by posing as the victim to the carrier, by bribing a carrier employee, or by phishing carrier staff so malware gives them access to carrier systems. Once the number is moved, the victim’s calls and texts go to the criminal.

The criminal then requests password resets on the victim’s email and other accounts and uses the text-message codes sent for two-factor authentication to take control of them. IC3 recorded 1,611 SIM swap complaints in 2021 with adjusted losses above $68 million. That compares with 320 complaints and about $12 million in losses between January 2018 and December 2020.

Australia’s Scamwatch describes the same chain: scammers gather personal details from phishing, data breaches, or social media, impersonate you to your mobile provider, and receive the bank SMS codes and one-time PINs that follow. Scamwatch also covers account takeover without a SIM swap, where reused or weak passwords, malware, or phishing give the attacker access directly. Leaked details from a breach feed both: see what to do after a data breach.

Eight warning signs

  1. Your phone suddenly loses service. Scamwatch lists a phone that suddenly loses service or shows SOS mode as a warning sign. IC3 also tells people to watch for the unexpected loss of text or call service. Treat it as urgent, not as a network glitch.
  2. Codes or reset emails you did not request. IC3 says criminals send “forgot password” and account recovery requests once they hold your number. Verification codes or password reset emails you never asked for mean someone is trying to get in.
  3. A message from your carrier about a change you did not make. Scamwatch lists contact from your mobile provider about a number change you did not request. Do not reply through the message. Call the carrier on the number from your bill or its official app.
  4. You are locked out of email or social media. Scamwatch lists being unable to log in to devices, email, or social media accounts as a sign of takeover. Email is the key to every other reset, so act on this first.
  5. Unusual activity in your accounts. Scamwatch also lists unusual account activity. Check recent logins and transactions, and ask your bank to flag your accounts for suspicious logins.
  6. A caller who asks for your PIN or account password. IC3 advises never giving an account password or PIN to someone who calls and asks for it. Hang up and call your carrier’s customer service line yourself.
  7. Expected payments that do not arrive. Scamwatch lists expected payments that never arrive, or a refund you are told was paid but did not land, as signs that your accounts or details have been interfered with.
  8. Your holdings or personal details are public online. IC3 advises not publicizing cryptocurrency or other financial holdings on social media or forums, and limiting personal information you post, including your phone number and address. It makes you a more attractive target.

How to harden your accounts before it happens

  1. Move off SMS codes where you can. IC3 recommends stronger multi-factor methods such as biometrics, security keys, or authenticator apps.
  2. Protect your email first. A takeover of email lets an attacker reset almost everything else. Use a unique password and the strongest sign-in method it offers.
  3. Use a different strong password for every account, and do not save passwords or login details in mobile apps, as IC3 advises.
  4. Ask your mobile carrier which extra protections it offers on your account, and set them up. Options differ by carrier and country.
  5. Do not give your carrier PIN or account password to inbound callers. Hang up, then call the number on your bill.

If you think your number was swapped

These steps follow the order IC3 gives, with the FTC’s account recovery advice added. Use another phone or a computer if yours has no service.

  1. Contact your mobile carrier immediately. Ask whether your number was moved, and ask them to restore it and deactivate the unknown SIM. Scamwatch’s guidance matches this.
  2. Change your online passwords. Start with email, then banking, then everything else. If you can still log in, the FTC says to create a new strong password for the affected account, change it anywhere you reused it, and turn on two-factor authentication.
  3. Call your bank and card issuers. Use the numbers on your cards or the official app. Ask them to flag your accounts for suspicious logins or transactions.
  4. If you cannot log in, use the FTC’s guidance on getting back into a hacked account, which links to recovery steps for popular services.
  5. Report it. IC3 asks victims to report to local law enforcement or an FBI field office and file at ic3.gov. See the list below for other countries.
  6. Watch for follow-ups. If a “recovery” service contacts you, see recovery scams.

Where to report

More help from official sources

Scambaba is an independent educational project. Reporting and recovery options depend on where you live. How these guides are researched is on the editorial policy.

Frequently asked questions

What is a SIM swap?

It is when a criminal gets your phone number moved to a SIM card they control. The FBI says they do it by impersonating you to the carrier, bribing a carrier employee, or phishing carrier staff. Your calls and texts then go to the criminal.

Why do scammers want my phone number?

Many accounts send password reset links and login codes to your number or to your email. With your number, the criminal can request resets and receive the codes, as IC3 describes.

How do I know if my SIM was swapped?

The first sign is often a phone that suddenly loses service or shows SOS mode. Other signs include codes or reset emails you did not request, a carrier message about a number change you did not make, and being locked out of accounts.

Is an authenticator app safer than text codes?

IC3 recommends stronger multi-factor methods such as biometrics, security keys, or authenticator apps over SMS codes, because a swapped number does not hand over those methods.

Can I get my money back?

Sometimes. Act fast: contact your carrier, then your bank, and ask for transactions to be stopped. Recovery depends on the bank, the payment method, and how quickly you report. Report to your national service whatever the outcome.