SIM-Swap Scams: How Criminals Hijack Bank Login Codes and How to Stop Them

Your phone is more than a phone. For most people, it is also the key to their bank account. When you log in from a new device or reset a password, many banks send a one-time code by text message. That convenience is exactly what SIM-swap scammers exploit.

In a SIM-swap scam, a criminal convinces your wireless carrier to move your phone number onto a SIM card or device they control. Sometimes they impersonate you using personal details found online or stolen in data breaches. Sometimes they request a port-out, moving your number to a different carrier. Once your number is on their phone, your text messages and calls go to them, including the login codes meant for you. From there, they can try to reset passwords and get into your bank, email, and other accounts.

The good news is that a few steps can make you a much harder target. Here is how to protect yourself, one step at a time.

Step 1: Lock down your wireless account

Start with your carrier, since that is where the scam begins. Log in to your wireless account online or call customer service and ask what security options are available. Most major carriers let you set an account PIN or passcode that must be provided before changes are made. Many also offer a feature that blocks SIM changes or number transfers until you turn it off yourself. Carriers use different names for this, such as number lock, SIM protection, or port-out protection.

Turn on every protection your carrier offers. Choose a PIN that is not your birthday, the last four digits of your Social Security number, or anything easy to guess. Write it down and keep it somewhere safe, since you will need it if you upgrade your phone or switch carriers.

Do not forget your carrier's app and website login. Many phones now use an eSIM, a digital SIM that can be moved to a new device through the carrier's app or website. That makes the account login itself a target. Give it a strong, unique password, and turn on the strongest login protection the carrier offers. If you share a family plan, make sure everyone who can manage the account uses good security too, since one weak login can expose every line on the plan.

The rules have also gotten tougher on carriers. In 2023, the Federal Communications Commission adopted rules requiring wireless carriers to use stronger methods to verify customers before moving a number to a new device or carrier, and to notify customers about these requests. Those notices are useful, but your own account protections are still your best first line of defense.

Step 2: Move away from text message codes when you can

Text message codes are better than no extra protection at all, but they are the weak spot SIM-swappers target. Check the security settings in your bank's app and website to see what other options you have. Many banks and email providers now offer stronger choices, such as:

• Authenticator apps, which generate login codes on your phone without sending a text.
• Push notifications in the bank's own app, which ask you to approve a login.
• Passkeys, which use your device's fingerprint, face scan, or PIN to sign in.
• Physical security keys, small devices that plug into or tap your phone or computer.

Start with your email account, because email is often used to reset passwords for everything else. Then move on to your bank, credit card, and investment accounts. If an account only offers text codes, keep them on, since they are still better than a password alone.

Step 3: Make your passwords harder to crack

Even if a scammer has your number, they usually still need your password or a way to reset it. Use a strong, unique password for each financial account and for your email. A password manager can create and store them for you so you do not have to remember dozens of combinations.

Also review your account security questions. Answers like your mother's maiden name or your first car can often be found online. Some people use made-up answers and store them in their password manager.

Step 4: Share less about yourself online

SIM-swappers often research their targets first. Your birthday, hometown, pet names, phone number, and family members' names can all help someone pass a carrier's identity check. Review your social media privacy settings and think twice before posting details that could double as security answers.

Be cautious about where you share your phone number. Some people use a separate number, such as a free internet calling number, for online shopping sign-ups and loyalty programs, keeping their main number for banks and close contacts.

Step 5: Turn on account alerts

Set up alerts with your bank and card issuers so you hear about activity right away. Useful alerts include new logins, password changes, changes to your contact information, new payees, and large transfers. Have some alerts sent to your email as well as your phone. If your phone number is hijacked, text alerts will go to the scammer, but email alerts may still reach you.

Step 6: Learn the warning signs

A SIM swap often shows up as a sudden problem with your phone. Watch for:

• Your phone suddenly shows no service, or only emergency calls, in a place where it usually works.
• You get a notice from your carrier about a SIM change or number transfer you did not request.
• You cannot log in to your accounts, or you receive password reset emails you did not ask for.
• Friends say they got strange messages from your number.

Also be wary of unexpected calls or texts asking you to share a code that was just sent to your phone. Your bank will not call and ask you to read back a one-time code. Anyone who asks is likely trying to get into your account.

Step 7: Act fast if it happens

If you think your number has been hijacked, speed matters. Use another phone or a computer to:

• Contact your wireless carrier right away to regain control of your number and lock your account.
• Call your bank and card issuers using the numbers on the back of your cards or on their official websites, and ask them to freeze or monitor your accounts.
• Change passwords for your email and financial accounts, starting with email.
• Review recent transactions and report any you did not make.

Federal rules give consumers protections for unauthorized electronic transfers from bank accounts, but your losses can be limited more when you report problems quickly. Report the identity theft at IdentityTheft.gov, which can help you create a recovery plan. You can also file a complaint with the FBI's Internet Crime Complaint Center at ic3.gov and with the FCC. If the scammers may have your personal information, consider placing a free credit freeze with the three credit bureaus.

A few minutes of setup goes a long way

Most of these steps take only a few minutes, and many can be done from your couch. Start today by calling your carrier to set an account PIN and turn on number lock, then check the login options in your bank's app. Those two moves alone close the doors SIM-swappers rely on most.