How To Prevent SIM Swapping: 7 Tips & Best Practices

According to the FBI Internet Crime Report, SIM card swap scams in the U.S. caused over $25 million in cash losses in 2024. The U.K. alone saw a 1,055% surge in SIM swaps in 2024. This data underscores why SIM swapping is a global threat today. Considering its frequency and the potential risk for your personal and financial security, learning how to prevent SIM swapping is more important than ever.

In this guide, you’ll learn about:

• How SIM swapping works and how it can affect you
• How to know if your SIM was swapped
• How to prevent SIM swap attacks

What Is SIM Swapping?

SIM swapping, also known as SIM jacking or SIM hijacking, is a fraudulent practice that involves a scammer taking over your phone number and associated accounts by:

1. Assuming your identity
2. Convincing your mobile carrier to port your number to a SIM card that the scammer can control

SIM swapping is often confused with port-out fraud, but the key difference between the two is the network involved. During a SIM swap, scammers deceive the mobile carrier into transferring the victim’s phone number to a SIM card on the same carrier network, whereas port-out fraud involves moving the number to a different carrier altogether. In both cases, the attacker wants to gain control of your phone number, but the route the transfer takes is the main distinction.

By hijacking your phone number, the scammer could gain access to your calls, text messages, emails, and social media accounts. Worse, they could:

• Take over your mobile banking accounts
• Pass any SMS-based two-factor authentication (2FA)
• Sell access to your phone number and associated accounts on the black market

How Does SIM Hijacking Differ From Other Attacks?

Unlike other types of attacks, such as phishing or malware, SIM swapping typically relies more on social engineering and human involvement. Scammers often harvest your personal information and impersonate you to carry out the attack, with AI increasingly helping them scale both research and impersonation tactics. In doing so, SIM swapping simultaneously exploits technological gaps and individuals within the telco system to take over your phone number.

One of the biggest dangers of SIM swapping is that it can often go unnoticed until the attacker has already achieved their objective. Your phone suddenly loses service, or you notice unusual activity in your accounts—by the time you catch on, significant damage may already have occurred. It can also be difficult to quickly regain control of your phone number and accounts.

Additionally, not knowing what to do after a SIM swap and being unfamiliar with protection practices may make you more vulnerable to repeated attacks.

How Does a SIM Swap Scam Work?

A SIM swapping scam occurs in three key stages:

1. Harvesting your data
2. Contacting the carrier
3. Account takeover via a SIM swap

1. Harvesting Your Data

Data harvesting is often one of the first steps scammers take to carry out a SIM swapping attack. During this phase, the scammer tries to learn as much information about you as possible to be able to impersonate you down the line. The scammer harvests data via one or more of the following methods:

• Scraping your social media profiles
• Checking out forums that you’re a member of
• Making a list of the services you typically use and trust
• Launching a phishing scam (e.g., asking you to fill out a form to harvest your data)
• Buying the information from data brokers or on the black market

This information may later be used by attackers to answer security questions or prepare a convincing impersonation during verification processes. For example, they may identify personal details, such as a pet’s name or the name of your elementary school, from social media profiles and use them to correctly answer security prompts.

2. Contacting the Carrier

Leveraging the personal information they’ve collected, the scammer can reach out to your mobile carrier, pretend to be you, and ask to port your number to a new card. In many cases, the scammer creates a sense of urgency to get the customer service agent to act quickly—for example, they could fake scenarios such as:

• I’ve left my phone on the subway, and I need my number ASAP, or my mobile banking app will lock me out.
• Please help me quickly, I’m traveling and can’t access anything without my phone.
• My phone’s been stolen, and I think someone’s trying to hack me. Can you move my number to a new SIM, please?

In practice, attackers may adapt their approach based on the information they have gathered and the specific verification process used by the carrier. The agent will ask the scammer a few questions to verify the identity. If they’re convinced, your number will be ported to a new SIM card without any real authorization from you.

3. Account Takeover via a SIM Swap

Once the carrier completes the SIM swap, your original SIM is immediately deactivated, and your phone will lose service. Depending on their goal, the scammer can:

• Empty your bank accounts or cryptocurrency wallets
• Reset email and social media passwords
• Impersonate you to scam your family, friends, or coworkers
• Open new accounts in your name
• Access confidential work information

This is a common method of perpetrating a SIM swap, but it’s not the only one. In rare cases, the employee of a mobile carrier can work with the scammer to provide information. There have been cases of attempts to bribe T-Mobile and Verizon employees to help carry out SIM swaps. Employees were reportedly offered $300 for each customer number they helped hijack.

This reveals the harsh reality: your security depends not just on technology but on the integrity of people handling your data. Using reputable carrier services doesn’t amount to much if insider trust is compromised.

Tip 🔐

If you’re worried about SIM swap attacks, consider switching to Cape. We’re a privacy-first mobile carrier and follow a minimum trust framework.

Instead of passwords, your account is secured by a 24-word recovery phrase created at signup. The phase is encrypted with a private key stored locally on your device, which means only you (not even Cape) can move your number to a new phone. This prevents the insider threats and social engineering attacks that fuel most SIM swaps.

What Are the SIM Swap Attack Signs?

Typically, the more obvious signs of SIM swapping appear only after the attack, but recognizing them as early as possible is essential for limiting damage. Here are the most common SIM swapping warning signs to focus on:

How To Stop SIM Swapping Once You Notice It

If you suspect your phone has been targeted by a SIM swap attack, time is of the essence. Here are the common steps you should take to try and stop a SIM swap attack in its tracks, or at least limit its impact:

1. Inform your mobile carrier of a possible attack immediately, describing the alarming signs you’ve detected in detail. Ask the customer representative to lock your account and restore your number to your original SIM card or device.
2. Check your email account on a different, uncompromised device first, as it’s often used to reset passwords and gain control of accounts. Look for any notifications about recent logins, password changes, new trusted devices, or updates to recovery information.
3. Change your passwords promptly for all accounts connected with your compromised number. You should also switch any SMS-based 2FA to authenticator apps or other verification formats if possible.
4. Inspect your online banking and payment apps to detect any newly added cards, unauthorized transactions, or changes you don’t recognize. Contact your bank if you need to freeze any cards or block transactions.
5. Review your Google, Apple, or other core ecosystem accounts for any unusual activity.
6. Check your social media accounts and messaging platforms to spot any impersonation attempts, especially in messages or status updates.

How To Protect Against SIM Swap: 7 Helpful Tips

Here are some of the best SIM swap attack prevention methods that help you minimize the risk of these attacks and keep your accounts and device safe:

1. Take advantage of advanced security protocols
2. Be wary of suspicious emails and messages
3. Avoid oversharing your personal information online
4. Monitor your accounts
5. Set up additional carrier SIM swap protection measures
6. Avoid linking all your accounts to your phone number
7. Choose a security-focused mobile carrier like Cape

1. Take Advantage of Advanced Security Protocols

Wherever possible, use passcodes or additional verification methods to add an extra layer of security to your apps and accounts. For instance, you can set up 2FA that doesn’t rely on SMS one-time passwords but on fingerprints, tokens, or facial recognition. This is an important SIM swapping prevention technique because attackers can bypass SMS-based 2FA by intercepting text messages.

These extra measures reduce overreliance on phone-number-based verification and can make it much harder for scammers to access your accounts and complete SIM swapping.

2. Be Wary of Suspicious Emails and Messages

Scammers often use phishing to obtain your personal information, which they later use to impersonate you during verification or other account recovery processes.

Here are a few signs that could indicate an email or message you received is a phishing attempt:

• Sense of urgency: A false sense of urgency is supposed to create anxiety and get you to act fast and click on the provided link, leave your personal info, or download a file.
• Suspicious links: Links with spelling errors or random letters and numbers indicate the email or message you received is a phishing attempt.
• Claims that there are problems with your account: Such claims are a classic social engineering tactic to trick you into acting quickly, often overlooking warning signs like strange URLs or links.
• Claims you’re eligible for an award: These claims exploit curiosity and excitement to get you to share your personal information.
• Strange sender email address: The sender’s email address often contains random numbers and letters or mistakes, and can be a telltale sign of a phishing attempt.

If you suspect an email or message is a phishing attempt, don’t respond, even if it seems like it’s from a reputable source like your bank or the IRS. It’s best to directly reach out to these institutions via official channels to verify any suspicions.

3. Avoid Oversharing Your Personal Information Online

To conduct the SIM swap, scammers need to gather personal information about you, and one way they do this is by checking out your social media profiles. You could become a target if your social media accounts are filled with information such as:

• The amount of crypto you have
• Your retirement savings
• Your income
• Your contact information
• Names, pictures, and videos of family members and pets
• Photos of boarding passes or personal documents

4. Monitor Your Accounts

Signs such as sudden spikes in phishing attempts or unusual activity in your bank account could indicate that a scammer is preparing to carry out a SIM swap—or another cyberattack that could lead to data loss or have severe financial consequences. Through sophisticated SIM swapping techniques, scammers can intercept the authentication codes needed to access financial accounts and drain them.

In 2020, a T-Mobile customer was targeted in a major SIM swap attack, which enabled scammers to steal $165 million in cryptocurrency by accessing accounts linked to their phone number. Although the victim had previously enabled additional security protections on the account, the attackers were still able to bypass PIN-based authentication. More recently, in 2024, actress Sydney Sweeney was reportedly a victim of a SIM swap attack that coincided with an X account takeover on the same day.

It’s best practice to stay alert and keep an eye on all your accounts, from email to social media and mobile banking. If you spot anything unusual, act immediately to prevent the damage from escalating.

5. Set Up Additional Carrier SIM Swap Protection Measures

Some carriers allow you to set up more advanced protective measures against SIM swapping.

For example, T-Mobile’s SIM protection option adds an extra layer of security to your account—as long as the feature is enabled, no changes to your SIM are allowed without explicit authorization. If a malicious actor reaches out to T-Mobile to attempt a SIM swap, they won’t be able to complete the process since SIM protection is on. They will be asked to disable the feature through the mobile app or website, and they won’t be able to do so without your credentials.

Another method to use eSIM technology, which isn’t bulletproof but can offer stronger SIM swapping protection than a physical SIM. In many cases, switching or activating eSIMs also requires additional verification steps such as biometric authentication, passwords, or PINs, which can make it harder for attackers to carry out a SIM swap scam.

Unlike physical SIM cards, eSIMs are embedded in the device, providing greater physical security since they can’t be cloned, lost, or stolen in the same way, and activation is handled digitally, minimizing the possibility of physical SIM tampering.

6. Avoid Linking All Your Accounts to Your Phone Number

If possible, don’t link all your accounts to just one phone number. This ensures that even if a malicious actor gains access to your phone number, they won’t be able to leverage it to get a hold of your accounts through SMS-based authentication.

For extra protection, use authentication apps like Google Authenticator that generate code locally on your device without relying on your phone number or mobile network, offering more security than SMS-based 2FA.

A more convenient solution is to use secondary numbers (physical SIM or eSIM) for different services and e-commerce websites. That way, you can reduce exposure to your primary number and contain the impact on your core services in case of a breach.

Among privacy-first mobile carriers today, Cape offers two secondary numbers alongside each primary number. The additional numbers support SMS-based 2FA verification, making them suitable for linking to apps and services.

7. Choose a Security-Focused Mobile Carrier Like Cape

To minimize the risks of phone number hijacking and SIM swapping and protect your mobile identity, it’s equally important to assess the threat at the network level and opt for a security-first carrier like Cape.

Cape addresses hijacking threats directly through a built-in SIM swap protection feature. The account authentication process is designed to keep the subscriber in control by requiring a cryptographic key before any SIM changes can be made. During signup, Cape replaces usernames and passwords with a 24-word passphrase that generates a private key tied to your device. This passphrase is the only way to initiate critical account changes, such as moving your number to a different device.

While major carriers have made progress in updating their security protocols, critical flaws remain. Just recently, T-Mobile was involved in a lawsuit resulting in a $33 million settlement related to a SIM swap attack that led to cryptocurrency theft.

Another disadvantage of using traditional carriers is that they collect and store large amounts of sensitive data, often sharing it with third parties. Combined with the legacy architecture that heavily relies on user-facing verification, this increases the risk of data breaches and personal information leaks that can be used to facilitate SIM swaps.

In contrast, Cape is built around security and privacy and uses multiple advanced measures to protect your data, number, and accounts from unauthorized use.

Cape Makes Security the Standard: Here’s How

Cape is America’s privacy-first mobile carrier, providing premium, unlimited, and nationwide call, text, and data. Unlike other providers, our service is built from the ground up with privacy and security at its core.

Mainstream carriers track you and store your data, often without your consent. Cape takes a different path—we collect the absolute minimum amount of information to provide you with service.

Any information we do collect is retained for the minimum amount of time possible. Most carriers store call data records (CDRs) for years, sometimes indefinitely. Cape stores yours for just 24 hours, and we have a commitment to never sell your data.

Cape service includes security features that no other carrier offers:

• Minimal Data Collection and Retention: Cape doesn’t ask for your name, address, or Social Security number. We collect only what’s required to provide service—and keep it for the shortest time possible.
• Network Lock: Legacy protocols like SS7 enable tracking and interception. Cape verifies your device’s physical location before network attachment and automatically blocks suspicious connections.
• Identifier Rotation: Traditional carriers use a fixed International Mobile Subscriber ID (IMSI), making your device trackable. Cape automatically rotates your IMSI every 24 hours, which makes tracking a lot more harder.
• SIM Swap Protection: Cape nullifies the threat of SIM swapping by completely removing humans from the loop. During signup, you receive a 24-word phrase that generates a private key tied to your number. Only you, not even Cape, can move your number to a new device or carrier.
• Secondary Numbers: Many services ask for your phone number, but sharing it exposes you to spam, scammers, data brokers, and a variety of other risks. VoIPs, on the other hand, don’t work with 2FA, cost extra, and aren’t encrypted. Cape gives you two free SMS/MMS lines that are end-to-end encrypted. You can reserve your primary number for communicating with your close friends and family, and use Secondary Numbers for anything from shopping and signing up for discounts, to receiving secure OTPs.
• Disappearing Call Logs: Most U.S. carriers store your call and text metadata for years, sometimes indefinitely. Cape is built to forget, so call data records (CDRs) are deleted after just 24 hours.
• Encrypted Voicemail: Traditional voicemail systems are outdated, unencrypted, and another security hole bad actors can exploit to gain access to your sensitive information. Cape encrypts all voicemails, ensuring only you can access them.
• Secure Global Roaming: While roaming, your phone connects to local telecom providers to enable service that’s prone to interception. Cape provides you with peace of mind by routing your traffic through our U.S.-based mobile core to keep your identity and communications private.

These features are made possible because we’re a “Heavy” Mobile Virtual Network Operator (MVNO).

Other MVNOs (such as Mint Mobile, Cricket, etc.) simply ride on top of the mobile core, SIMs, and physical infrastructure of their underlying MNO partner. At Cape, we actually own our own mobile core and provision our own SIMs.

This gives us control over how accounts are authenticated, what data we do and don’t collect, how long we retain it for, as well as the ability to build proprietary features like Identifier Rotation. No other carrier on the market has this capability.

Reclaim Your Privacy: Switch to Cape Today

Ready to ditch traditional telcos and switch to a privacy-first mobile carrier? Visit cape.co/get-cape to sign up.

Thanks to our partnership with Proton, you can also take your privacy a step further and get Proton Unlimited or Proton VPN Plus for only $1 for the first six months.