Key Takeaways

  • What is it? An attacker calls your mobile carrier (Verizon, T-Mobile, Orange) pretending to be you and convinces them to transfer your phone number to a new SIM card they control.
  • The Danger: Once they have your number, they use "Forgot Password" on your email and bank. The 2FA SMS codes go to them, not you.
  • The Prevention: Never use SMS for 2FA. Use an Authenticator App (Google Auth, Authy) or a Hardware Key (YubiKey).

Jack Dorsey (CEO of Twitter) was hacked via SIM Swap. If it can happen to him, it can happen to you.

How the Attack Works

1. Recon: The hacker finds your details (DOB, Address) online (from data breaches or social media).
2. The Call: They call the carrier support line: "Hi, I lost my phone. Can you activate this new SIM card for me?"
3. The Switch: The support agent verifies the basic info (which the hacker has) and flips the switch.
4. Game Over: Your phone loses signal. The hacker's phone gets the signal. They reset every password you have.

Carrier PIN / Port Freeze

Call your carrier NOW and ask to set up a "Port Freeze" or a "PIN Code" for SIM changes. This means no one can move your number without that specific code.

Frequently Asked Questions (FAQ)

How do I know I've been swapped?
Your phone will suddenly say "No Service" or "Emergency Calls Only" in a place where you usually have signal. If this happens, call your carrier immediately from another phone.
Are eSIMs safer?
Slightly, because there is no physical card to steal, but the attack vector is usually Social Engineering the support staff, which works for eSIMs too.

Learn about rooting risks.
Read Jailbreak Guide