SIM swap attack: what to do right now

1. Call your cellular carrier's fraud department from another phone right now — say you're a SIM-swap victim and ask them to lock your account and restore service to your original SIM.

   More detail

   Why this matters: every minute the attacker controls your number, they can intercept SMS 2FA codes for your bank, email, and crypto accounts. Use a friend's phone or a landline. Have your account PIN ready if you have one.

2. From a trusted computer, log in to your primary email and bank, change those passwords, and remove your phone number as a 2FA method.

   More detail

   Your phone number is currently a key the attacker holds. Removing SMS as a recovery/2FA method on your most critical accounts cuts off their easiest path in.

3. 🇿🇦 ZA

   Borrow another phone and call your carrier's fraud line right now. Vodacom 082 1944 · MTN 083 1808 · Cell C 084 140 · Telkom Mobile 081 180 · Rain via in-app support. Say: 'My SIM has been swapped without my permission. Reverse it and block any port-out on my number.'

   More detail

   Why this matters: Vodacom and MTN policy gives roughly two hours from notification to reverse a fraudulent swap — call the carrier first, then change passwords starting with email.

4. 🇮🇪 IE

   Borrow another phone and call your carrier now: Vodafone 1907, Three 1913, eir 1901, Tesco Mobile 1903. GoMo and 48 are chat/app only.

   Vodafone · 1907Three · 1913eir · 1901
   More detail

   No signal out of nowhere, or a text about a SIM swap you didn't ask for? Call your carrier, then your bank, immediately.

1. Switch 2FA from SMS to an authenticator app (Authy, Google Authenticator) or a physical security key for every critical account.

   AuthyGoogle Authenticator
   More detail

   SMS-based 2FA is exactly what SIM swappers exploit. Authenticator apps generate codes locally on your device, and security keys (YubiKey, Google Titan) are nearly impossible to phish or swap.

2. Ask your carrier to add a "Port-Out PIN" or "Number Transfer PIN" to your account.

   More detail

   All four major US carriers (Verizon, AT&T, T-Mobile, US Cellular) and most Canadian carriers support a port-out PIN that must be provided before your number can be transferred. This is the single most effective protection against future SIM swaps.

3. 🇿🇦 ZA

   From a computer, change passwords in this order: email first, then bank, then SARS/government, then crypto, then social. Switch each account's 2FA from SMS to an authenticator app — your number is no longer trustworthy.

4. 🇿🇦 ZA

   Call your bank's fraud line even if no fraud is visible yet. Use the SA bank lines from the Banking playbook.

5. 🇿🇦 ZA

   Lay a SAPS OB report. Email SAPS Cybercrime with the carrier reference number and the timeline of when your phone lost service.

   SAPS Cybercrime
6. 🇮🇪 IE

   Call your bank's fraud line, then report at your local Garda station and get the PULSE incident number.

   Garda station directory

1. Review every bank, credit card, and crypto account for unauthorized transactions during the window the attacker had your number.

2. 🇺🇸 US

   Pull your credit report and place a fraud alert — SIM swaps are often a precursor to broader identity theft.

   AnnualCreditReport.com
3. 🇨🇦 CA

   Pull your credit report from Equifax and TransUnion Canada and place a fraud alert.

   Equifax CanadaTransUnion Canada
4. 🇿🇦 ZA

   Apply for free SAFPS Protective Registration — SIM swaps are often a precursor to credit and identity fraud.

   safps.org.za
5. 🇿🇦 ZA

   Set a port-out PIN at every carrier you use. In South Africa this is sometimes called a 'number-transfer PIN' or 'RICA PIN' — ask the carrier specifically.

6. 🇮🇪 IE

   If your provider handled the swap badly, complain to it in writing and then escalate to ComReg.

   ComReg · 01 804 9668
   More detail

   Ireland has no scam-text forwarding number. Mark scam texts as spam, block the sender, and don't reply. Texts labelled 'Likely Scam' come from unregistered sender IDs.

1. Use an authenticator app or hardware key for 2FA — never SMS — on financial and email accounts.

2. Keep a carrier port-out PIN set and rotate it if you ever suspect it leaked.

Related situations