🎯 The Goal: Your phone number is the weakest link in your security. In a SIM swap, a hacker calls your carrier pretending to be you ('lost my phone, transfer my number to this new SIM') — and the moment they succeed, every SMS code for your bank, email, and crypto flows to THEIR device. One convincing phone call beats all your careful passwords. The fix: a carrier PIN, set today.
📵 Step 1: See how the heist works — it's social, not technical. The attacker gathers your basics (name, address, birthday — all leaked or public), calls the carrier's support line, and sweet-talks a tired rep into porting 'their' number. Your phone suddenly shows 'No Service'; theirs starts receiving your texts. Within the first hour they hit your email's 'forgot password' → SMS code arrives (to them) → email captured → then banks, then everything. Victims report losing accounts and five-figure sums in an afternoon. High-risk targets: anyone with crypto, a good username, or money — which is to say, everyone.
🔒 Step 2: Lock the carrier account (the 10-minute fix). Call your carrier (or use the app) and demand: 1. A PORT-OUT PIN / security PIN — a code required for ANY number transfer or SIM change (all major carriers offer this; many don't enable it by default). 2. 'Do not port or swap without in-store photo ID' notes where offered. 3. A unique password on the carrier account itself (it's an account too, and it guards your number). While you're in there: turn OFF SMS-recovery visibility where possible. Then the bigger structural fix: migrate your 2FA off SMS entirely — authenticator apps or passkeys (see those lessons) make a stolen number nearly worthless.
🚨 Step 3: Know the symptoms and the first-hour response. Symptoms of an active swap: phone drops to 'No Service / SOS' in a normal coverage area, 'SIM changed' or 'number transfer initiated' emails/texts you didn't request, sudden password-reset emails. THE FIRST HOUR MATTERS: 1. Call the carrier from ANY other phone immediately: 'my number was fraudulently ported — reverse it now.' 2. From a safe device, change email passwords and kill SMS-recovery on email + banks. 3. Alert your bank; freeze anything with money. 4. File with local police + the FTC's identity-theft site — banks move faster with a report number. 5. Afterwards: consider a credit freeze (free, at the big bureaus) — the number theft usually precedes wider identity theft.
📋 The SIM-Swap Defense Card: TODAY: carrier PIN set ✓ carrier account password unique ✓ 2FA moved from SMS to authenticator app/passkeys on email, banks, crypto ✓. KNOW: 'No Service' + reset emails = act in minutes, from another phone. NEVER: post your number publicly, answer 'security questions' with real findable facts (mother's maiden name is on genealogy sites — lie consistently and store the lies in your password manager), keep SMS as the recovery for anything you'd cry about losing. One phone call by you today, or one phone call by a stranger later — the PIN decides which.