Highlighted wordsare glossary terms — tap one for a plain-language definition.
Your phone is still in your hand. But is your number still yours? Imagine your cellular service suddenly disappears. You haven't changed carriers or bought a new phone, but your number may have been activated on someone else's device. SIM swapping can happen without taking your phone. The good news: practical protections can make number hijacking harder.
Can someone steal control of your number without your phone?
What is SIM-swap fraud?
A SIM (subscriber identity module) or eSIM (a digital SIM) helps your carrier connect your number to a device. A criminal may impersonate you or compromise the carrier's authorization process to activate your number on a SIM or eSIM they control. They may then receive calls and ordinary text messages intended for you.
- Number hijacking does not automatically unlock all your accounts. Other credentials, recovery access or account weaknesses may still be needed.
SIM swapping vs. port-out fraud
SIM swapping moves your number to another SIM or eSIM, potentially at the same carrier. Port-out fraud transfers your number to another carrier. Providers may use these terms differently.
Your number is connected to more than calls
Some services send VerificationWhat it means: Confirming a request through a separate, trusted method.Example: Calling the number on the back of your card instead of the one in the message.What to do: Save official phone numbers and app logins now, before you need them.Important: Never verify using contact details supplied in the suspicious message itself.What does this mean? or recovery codes by SMS (ordinary text message). Someone controlling your number may intercept these codes and attempt to access accounts, especially if they also know or can reset other credentials.
- Email: a criminal may try a texted Recovery codeWhat it means: A backup credential some services supply for regaining access when your normal authentication method is unavailable.Example: The list of ten one-use codes shown when you first switch on MFA.What to do: Save them in your password manager or print them and store them somewhere safe.Important: They work like passwords, so never email them or store them in shared albums.What does this mean? to access your inbox.
- Financial accounts: they may attempt a login or password reset with an intercepted code.
- Social media: they may target an account that relies on SMS verification.
- SMS authentication is often better than no additional protection, but it is not phishing-resistant. Prefer properly implemented passkeys or FIDOWhat it means: A family of open authentication standards designed to enable stronger, phishing-resistant sign-in methods.Example: A tap-to-approve security key described as “FIDO2 compatible”.What to do: Where a service lists FIDO or passkey sign-in, treat it as its strongest option.Important: FIDO is the standard behind passkeys and security keys, not a brand or an app.What does this mean? (Fast Identity Online) security keys.
- Authenticator apps reduce SIM-swap exposure, but manually entered authenticator codes can still be phished.
Three practical ways to protect your number
Protect the carrier account, the number itself and the online accounts connected to it. These are separate layers.
- A phone's SIM PIN is different from a carrier account PIN and a number-transfer lock. It does not replace carrier protections against fraudulent remote transfers.
Secure your carrier account
- Use a strong, unique password.
- Set a carrier account PIN or passcode where available.
- Enable supported multifactor authentication.
- Never give an unsolicited caller your PIN or verification code.
Lock unauthorized number changes
- Ask about SIM-change or SIM-swap protection.
- Ask separately about number-transfer or port-out protection.
- Legitimate transfers, SIM replacements or upgrades may need temporary changes to locks. Restore protection afterward.
Protect accounts connected to your number
- Prefer passkeys or FIDO security keys where supported.
- Use an authenticator app if phishing-resistant options aren't available.
- Save recovery codes securely.
- Confirm alternate recovery methods before removing SMS authentication.
Find your carrier's protections
The examples here apply primarily to the United States. Features, eligibility and instructions vary by country, carrier and account type. Use official instructions, not links from an unexpected caller or message.
Carrier features and instructions may change. Never enter your phone number, PIN, password or verification codes into Hygi.
I think my number was hijacked. What should I do?
Unexpected service loss does not automatically mean fraud: an outage, account issue or device problem may be responsible. Service loss together with an unauthorized SIM-change alert or suspicious account activity warrants immediate investigation.
- Contact your carrier immediately through its official website, app, customer-service number or a trusted alternative phone. Report a suspected unauthorized SIM change or number transfer and request recovery.
- Once you have safe access, secure email and financial accounts. Change compromised passwords, revoke suspicious sessions and check recovery methods.
- Review transactions, alerts and unfamiliar logins. Contact affected financial institutions immediately if needed.
- If information or accounts were misused, visit IdentityTheft.gov for an individualized Recovery planWhat it means: A prepared set of actions for responding to account theft, scams, lost devices, or exposed information.Example: Written steps plus saved bank and platform support numbers.What to do: Write it now and keep a copy offline where you can reach it without your phone.Important: The first hour after a compromise matters most, so don't improvise it.What does this mean?.
- Recovering your number does not automatically recover affected online accounts.
When is action urgent?
Choose a response based on what you know, not fear.
- Routine protection: no indication of fraud. Review locks, authentication and recovery options when convenient.
- Investigate promptly: an unexpected carrier-change notice or unexplained service loss. Verify through the official carrier.
- Act immediately: your carrier confirms an unauthorized transfer, or you discover Account takeoverWhat it means: When someone other than the owner gains control of an account, usually through a stolen or reused password, a phished code, or a SIM swap.Example: Friends receive money requests “from you,” and your email forwarding rules have changed on their own.What to do: From a trusted device, change the password, sign out all sessions, review recovery options, and turn on MFA.Important: Email is the master key — protect it first, because attackers reset everything else through it.What does this mean?, unauthorized transactions or related identity theft.
- Legitimate carrier transfers, SIM replacements or device upgrades may require temporarily adjusting protection. Restore it afterward.
Protect Your Number: Your Three-Step Hygi Habit
Stop before following unexpected technical instructions. You can take these steps at your own pace.
- Secure your mobile carrier account.
- Enable available SIM-change and number-transfer protections.
- Protect important online accounts with Phishing-resistant authenticationWhat it means: Authentication designed so credentials cannot simply be entered into, or replayed through, a convincing fake website.Example: A passkey that refuses to work on a lookalike login page.What to do: Choose it for email, banking, and other important accounts when it is offered.Important: Codes you type by hand are not phishing-resistant, even when they come from an authenticator app.What does this mean? whenever possible.
Your personal checklist only. Hygi has not verified or enabled any carrier setting.
Why Hygi. recommends this — the guidance above follows these published sources:
FCC
Cell Phone Fraud(opens in a new tab)SIM-swap and port-out fraud: moving service to another device versus another carrier.
FTC
SIM Swap Scams: How to Protect Yourself (October 2019)(opens in a new tab)Attack explanation, warning signs, prevention and recovery.
CISA
Mobile Communications Best Practice Guidance (December 18, 2024)(opens in a new tab)Carrier PINs and phishing-resistant authentication. This guidance particularly addresses highly targeted individuals; relevant practices can also benefit everyday consumers.
NIST
Digital Identity Guidelines: Authentication and Authenticator Management — SP 800-63B-4 (July 2025)(opens in a new tab)Phishing-resistant authentication, SMS and manually entered codes.
Verizon
Enable/Disable SIM Protection and Number Lock(opens in a new tab)Distinct SIM Protection and Number Lock features.
AT&T
Learn About Wireless Account Lock(opens in a new tab)Restrictions on sensitive account changes, including SIM changes and number transfers.
T-Mobile
Protect Your T-Mobile Account From Fraud(opens in a new tab)SIM Protection and Port Out Protection; availability and permissions vary.
FTC
IdentityTheft.gov(opens in a new tab)Personalized identity theft recovery guidance.
Brought to you by NorthBridge
Unfamiliar term? Open the Digital Safety Glossary