SIM Swap Fraud: How Scammers Take Over Your Phone Number

SIM swap fraud, sometimes called SIM hijacking or SIM splitting, can drain bank accounts, lock people out of their email and unravel their digital lives in a matter of hours. It works by giving the criminal control of something most of us rely on every day: our mobile phone number. Once they have your number, they can often reset passwords, intercept security codes and work their way into your bank, email and social media accounts.

The mechanics are simpler than people expect, and the warning signs can be missed until real harm is done.

What SIM swap fraud actually is

Your mobile number is tied to the SIM card in your phone. If you lose your phone or upgrade, your provider can transfer that number to a new SIM. SIM swap fraud is when a criminal persuades your mobile provider to do this transfer for them, usually by pretending to be you. From the moment the swap goes through, your phone loses signal and theirs starts receiving your calls and texts, including any security codes sent by SMS.

The scammer never needs to touch your phone. They only need enough information about you to pass the provider's identity checks.

How they gather the information

SIM swaps rarely happen out of the blue. They usually follow a period of quiet research, which can include:

• Data leaked in previous breaches and sold on. Your name, date of birth, address and old passwords may already be circulating.
• Information you have shared on social media, such as your full name, employer, pet's name or where you grew up.
• Phishing emails and texts that trick you into entering details on a fake login page.
• Fake calls pretending to be from your bank, HMRC or even your mobile provider, asking you to "confirm" details.

Armed with enough of this, the scammer contacts your mobile provider, claims their phone has been lost or damaged, and asks for the number to be moved to a new SIM that they control. Most of these requests are made over the phone or online, where the provider relies on identity questions rather than a face-to-face check.

Why it leads to bank and email takeover

Many banks, payment apps, email providers and online shops still send security codes by text message as a second step when you log in or reset a password. If the criminal controls your number, they receive those codes.

The usual pattern runs like this. The scammer triggers a password reset on your email account. The reset code arrives by text on their device. They get into your email, then use that email to reset passwords on your banking apps, PayPal, online shopping accounts and so on. Because the codes appear to be reaching the correct number, the bank's systems may see nothing unusual until money has already moved.

Cryptocurrency accounts, work email and social media are also common targets.

Scam Detector

Got a text, call, email or offer that feels off? Paste it in below and we will tell you how scammy it looks, the warning signs to spot, and exactly what to do next.

Try our Scam Detector free, here on this site →

Signs your SIM has been swapped

The first clue is often the most obvious one: your phone suddenly shows "No service" or "SOS only" and stays that way, even after restarting. Other signs include:

• You cannot make calls, send texts or use mobile data, but Wi-Fi still works.
• An unexpected text or email arrives from your mobile provider saying your SIM or number has been transferred.
• You are suddenly logged out of your email, bank app or social media accounts.
• Password reset emails appear that you did not request.
• Friends or family say they have had odd messages from "you".

A loss of signal on its own is not proof. It could be a network problem or a faulty SIM. But if it happens alongside any of the other signs, treat it as urgent.

Your situation may be slightly different. ask a question below ↓ and our editorial team will reply with our advice.

How to protect yourself

You cannot stop every attempt, but you can make yourself a harder target.

Put a PIN or password on your mobile account. Most UK providers let you set an account PIN or memorable security word that has to be given before any major change, including a SIM swap. This is separate from the PIN on the SIM card itself. Contact your provider and ask what account-level security they offer, then set it up.

Move away from SMS for two-factor authentication where you can. Authenticator apps such as Google Authenticator, Microsoft Authenticator or Authy generate codes on your device and do not rely on your phone number. Hardware security keys are stronger still. Use these for your email, banking and any account that supports them, and keep SMS only where there is no alternative. One thing to plan for: if you lose your phone, you can also lose access to the authenticator app, so use the backup or recovery options the app provides and store recovery codes somewhere safe.

Lock down your email first. Your main email account is the master key to most of your other accounts. Use a long, unique password and a non-SMS second factor.

Be careful what you share. Birthdays, addresses, pet names and school names often turn up as security questions. Public social media posts can give all of these away.

Treat unexpected calls and texts with suspicion. A real bank or mobile provider will not mind you hanging up and calling back on a number from their official website or the back of your card.

What to do if it happens

Act quickly. The damage tends to be done in the first few hours.

• Contact your mobile provider straight away from another phone. Tell them you believe your number has been hijacked and ask them to suspend the account and reverse the swap.
• Phone your bank using the number on the back of your card. Ask them to freeze your accounts and check for any payments you did not make.
• From a device you trust, change the passwords on your email, banking and other important accounts. Set up an authenticator app where possible.
• Report the fraud to Action Fraud at actionfraud.police.uk or on 0300 123 2040. In Scotland, where Action Fraud does not operate, contact Police Scotland on 101.
• If personal data has been misused, you can also report the matter to the Information Commissioner's Office.
• If your bank is slow to refund you and you believe you have been the victim of fraud, you can escalate a complaint to the Financial Ombudsman Service.

Citizens Advice can help if you are unsure about your rights. GOV.UK has general guidance on reporting fraud and identity theft, and Ofcom, which oversees mobile providers, publishes guidance on number security if you want to understand what your provider should be doing.

SIM swap fraud works because it exploits trust in a phone number that most of us treat as private. Putting an account PIN in place, switching off SMS codes where you can and locking down your email takes an hour or two of effort, and that hour is what stands between you and a very bad afternoon.

Related warnings

• The Hi Mum WhatsApp Scam
• Voice Cloning Phone Scams
• Fake Bank Fraud Team Calls
• HMRC Tax Rebate Text Scams

See more recent scams on the Latest Scam Warnings page.

The Next Step

Now that you have read through the advice above, you might want to put it into practice. Our Scam Detector lets you got a text, call, email or offer that feels off? Paste it in below and we will tell you how scammy it looks, the warning signs to spot, and exactly what to do next. Try it now →