Account Takeover Scams on Signal
Signal accounts are taken over through SIM-swap attacks and registration code theft, giving attackers access to the victim's contacts and the ability to impersonate them in ongoing conversations.
Part of: Account Takeover Scams
Last reviewed: 1 June 2026
Because Signal is tied to a phone number, SIM-swapping — where a scammer convinces a mobile carrier to transfer the victim's number to a SIM they control — is the primary account takeover vector. A swapped SIM receives Signal's registration SMS, giving the attacker full account control.
Once in control of a Signal account, attackers have access to ongoing conversations and contact lists, enabling highly convincing impersonation of the original account holder to solicit money or credentials from their contacts.
How this scam works on Signal
An attacker obtains enough personal information about the target to convince their mobile carrier to perform a SIM transfer. Signal's registration code is sent to the attacker's device, and they complete account setup, potentially locking out the original user.
With access, the attacker can read previous conversations to understand relationship context, then impersonate the account holder to request urgent money transfers from contacts with convincing back-story.
Alternatively, the attacker requests registration codes directly by messaging the target, claiming to be Signal Support or a contact who accidentally sent a code to the wrong number — a social engineering technique to capture the six-digit code without a SIM swap.
Common red flags
- Unexpected Signal registration SMS when you did not request account re-registration
- Sudden loss of Signal messages or account access on your device
- Contact asking you to share a Signal registration code you just received
- Message from a known Signal contact requesting urgent money or unusual information
- Mobile carrier sending a SIM-change notification you did not initiate
How to protect yourself
- Enable Signal's Registration Lock (a PIN that must be entered to re-register your account on a new device)
- Set a SIM PIN with your mobile carrier to prevent unauthorised SIM transfers
- Never share Signal registration codes with anyone under any circumstances
- If your account is taken over, contact your carrier immediately to recover your number
- Warn Signal contacts through another channel if your account is compromised
How to report it
- Contact your mobile carrier immediately to reverse a SIM swap
- Report account takeover to Signal via support.signal.org
- File a report with your national telecommunications regulator if SIM-swap fraud occurred
Frequently asked questions
Someone messaged me asking to forward a Signal code they say they sent by mistake — should I help?
No — this is one of the most common Signal takeover tactics, where the code is actually your own registration code and sharing it hands over your account. Never share a Signal verification code with anyone, no matter how plausible their explanation sounds.
How do I know if my Signal account was taken over via a SIM swap versus something else?
A SIM swap is often accompanied by your phone suddenly losing cellular service entirely, along with a carrier notification about a SIM or account change you didn't request. If your phone still has normal service but Signal shows unfamiliar linked devices, it's more likely a registration code was shared or stolen directly.
What should I do first if I suspect my Signal account has just been taken over?
Contact your mobile carrier immediately to check for and reverse any unauthorised SIM change, since that's often the fastest way to regain control. Then attempt to re-register Signal on your own device, and warn your contacts through another channel that your account may be compromised.
What is Signal's Registration Lock and should I enable it?
Registration Lock requires a PIN you set to re-register your Signal account on any new device. Enabling it significantly limits the damage from a SIM swap because the attacker cannot complete account setup without your PIN.