SIM swapping: what it is and how to protect your phone number

We know that reading about this kind of fraud can be unsettling. This article explains what it is and what you can do — which is a fair amount.

SIM swapping is a form of fraud in which someone gains control of a phone number that is not theirs, by arranging for it to be transferred to a SIM they hold.

The phone itself is not compromised, and the account is not broken into directly. The number is moved. Once that happens, the original phone loses service and calls and messages are received elsewhere.

This matters because a phone number is widely used as a recovery route — verification codes sent by text message, password reset links, and messaging accounts are commonly tied to it.

The move to eSIM has changed how this is carried out, since no physical card needs to be handled.

1. Information is gathered. A full name, identification number, date of birth, address and phone number — from social media, from published data breaches, or from the person directly through a call or message that appears legitimate.

2. A transfer is requested. Using those details, someone requests that the number be moved to a different SIM.

3. The number moves. The original phone loses signal. This is not a network fault — it is the transfer taking effect.

4. Accounts are targeted. With the number, password resets can be requested and codes sent by text message received. Messaging accounts tied to the number may also be targeted and used to contact that person's own contacts.

There is often very little time between steps three and four, which is why a sudden loss of signal is worth taking seriously.

If your phone suddenly loses service and does not recover it, while phones near you are working normally, it is worth checking whether anything has changed on your line.

Contacting your mobile provider from another phone to ask is a reasonable first step. It may well turn out to be a network issue — but checking costs little, and the first few minutes are where action makes the most difference.

Other things worth noticing:

Ask your mobile provider what is available. Providers offer different security options for a line, and what is available varies. It is worth asking yours what they can offer — for example, whether a code can be required for changes to your line, whether transfers can be restricted, and whether you can be notified if a change is requested. Using a password for your mobile account that you do not use elsewhere is also worth considering.

Limit what can be found out about you. This kind of fraud generally begins with personal details.

Consider how you receive your verification codes. Codes for your account can be sent by SMS, WhatsApp or email. SMS and WhatsApp both reach you through your phone line; email does not, which means a verified email address gives you a route that remains available if you lose access to your number. Verifying your email in the app is a straightforward way to have that option in place.

Turn on biometrics in the app. With face or fingerprint unlock enabled for opening the app and confirming transactions, having the phone number alone is not enough to move money.

Review your other accounts. Your personal email is often the recovery route for much else, so a unique password and a second verification step are worth having on it. Where a second step is available that does not rely on text messages — an authenticator app, for example — that adds a route independent of your phone line. Messaging apps commonly offer a two-step verification PIN, required before the account can be activated on a different device; it is worth checking whether yours does.

These controls are active on your account without any setup.

Tell us through the in-app chat as soon as you can, including the date and time, the amount, what you do not recognise, and any supporting material — screenshots, messages you received, receipts.

We record the report, investigate and inform you of the outcome.

If you have also reported the matter to the authorities, letting us know and including any reference number is helpful. Supporting documentation of your transactions can be requested through the same channel.

Attempts of this kind are often accompanied by calls or messages from people claiming to work here. For reference:

If you are unsure about a message, closing it and opening the app yourself is a reliable check. If the notice is genuine, it will be there.