Guide

SIM swap: how a phone number is stolen

A SIM swap moves your mobile number to a criminal's SIM card, and with it every text message and call meant for you, including the codes that reset your passwords. The number is treated as proof of identity by institutions that never chose it for that purpose, which is what makes the swap worth doing.

Published 30 August 2026. Checked against the cited sources on that date.

This guide is general and describes the position as at 30 August 2026. It is not legal, financial or regulatory advice. If you believe a swap is in progress, contact your mobile provider, then secure your email account, then your bank, and use the incident route where money may already have moved.

How it works

A SIM swap is a confidence trick played on a mobile operator, not a technical attack on your handset. Someone contacts the network posing as you, or walks into a shop, and asks for the number to be moved to a new SIM: the old phone was lost, damaged, or stolen abroad. They answer the security questions from public records, an old breach and your own published biography. Where persuasion fails, the access is sometimes bought rather than talked into existence, which is why the NCSC treats social engineering of retailers as an inherent weakness of the channel rather than a training failure.

The attacker needs no part of your phone: not the handset, not the passcode, not a fingerprint, no malware. They need your number and a story. The number is being used as a credential, and it was never designed to be one. The National Cyber Security Centre says so directly in its guidance on protecting SMS messages used in critical business processes: SMS was never intended to carry high risk content, and the ecosystem beneath it has weaknesses that may be impossible to compensate for fully.

The moment the swap completes, the network stops delivering to your SIM and starts delivering to theirs. Every call and message meant for you arrives at a stranger's device, including the six-digit codes that reset an email password. On your side there is no alert. The first symptom is your own phone losing signal: the bars gone, "No service" or "SOS only" where the network name used to sit. Most people read that as a fault and wait for it to clear. That wait is the attack's working window.

Why the exposure is wider for a family and its office

Ask what a mobile number actually unlocks and the answer runs longer than expected. It resets the email account. The email account then resets the bank, the broker, the company filing login, the cloud drive holding the trust papers, and the password manager if it was set up loosely. Recovery is a chain, and the whole of it hangs from whoever is holding the number this morning.

A principal's number is rarely private. It appears on filings at Companies House, in the signature block of every email they send, on the letterhead of a business they own, in a conference programme and on a charity trustee page. An attacker does not have to guess it. They can look it up, and in the same afternoon assemble enough surrounding detail to satisfy a carrier's security questions.

Then there is delegation. An assistant who can reset the principal's mailbox, or who receives the codes because it was convenient at the time, carries the principal's authority on a number that is easier to find and easier to impersonate. The same holds for a spouse or an adult child on a shared mobile account, where one holder can often authorise changes to another line. The exposure is a household one, and protecting the principal alone leaves the route open.

What actually prevents it

None of it requires a purchase. It is simply rarely done, because the phone number never looked like part of the security arrangements.

  • Take SMS out of the accounts that matter. Email first, then banking, brokerage, the company portals and the password manager. Remove it as a second factor and, more importantly, as a recovery route. While you are there, check which number each account would actually use to let someone back in, since old and reassigned numbers sit in those fields for years.
  • Move to an authenticator application or a hardware security key. The NCSC ranks the options in its guidance on recommended types of multi-factor authentication, with FIDO2 credentials at the top and message-based methods last, appropriate only where nothing stronger is possible.
  • Ask the mobile provider what protections it offers, then use them. Port-out authorisation, a porting PIN, or an account note requiring identification in person. Provision differs between networks and tariffs, so ask specifically rather than assuming, and record what was agreed.
  • Keep a separate, unpublished number for banking recovery. On a different account, ideally a different network, given to nobody and used for nothing else. Where an institution insists on holding a mobile number, it should not be the one on the letterhead.
  • Cover the household, not the principal. Assistants, spouse, adult children, the family office. Check who may authorise changes on each mobile account, and reduce that list to the people who need to be on it.

The first hour, if it happens

The alarm is unexplained loss of all mobile service. Not one bar and not slow data: no service at all, on an ordinary day, somewhere the phone has always worked, while other handsets on the same network are fine. Treat that as a security event first and a network fault second. The cost of being wrong is an apologetic call to your provider.

Call the carrier from another phone or a landline and ask directly whether the number has been ported or moved to a new SIM. If it has, ask for it to be reversed and for the account to be frozen against further changes. Ofcom sets out how number porting between providers works, including the route when a provider blocks or delays a transfer.

Secure email before banking, and the order matters. The email account is where the resets land, so while it is exposed everything downstream of it is too. From a device other than the affected phone, change the password, sign out of all other sessions, replace the recovery number, then read the forwarding rules and filters. An attacker who had access will often leave one behind to keep reading after being locked out. Only then move to banking, calling on a number taken from a card or a statement rather than from a message.

After that, work outward. Every account whose recovery runs through that number is exposed rather than merely at risk, starting with anything that can move money or change where money goes. Keep a plain timeline as you go, since the bank and possibly an insurer will ask for one.

Where money may already have moved, or where the swap has reached a business, coordination matters more than speed on any single task, and the incident route exists for that. Read the swap in context as well. It is usually the first move in a payment fraud rather than the whole of it, because the codes are only worth having for what they authorise. The guide on how families and family offices are defrauded sets out the patterns that tend to follow.

Where this sits

A SIM swap is not really an attack on a phone. It is an attack on a recovery path, and recovery paths are the part of a family's arrangements that nobody owns. The bank assumes the email is safe, the email provider assumes the number is yours, and the operator assumes the person at the counter is who they say they are. Each assumption is reasonable alone. Together they form a route.

A family cyber review follows every recovery path in one pass, across the principal, the household and the businesses, and puts what it finds in writing.

Sources