How To Recover After a SIM-Swap Attack
Urgent steps to take when your phone number has been hijacked, cutting off your access to SMS-based two-factor authentication and banking notifications.
Last reviewed: 1 June 2026
First 10 minutes
- Call your mobile carrier using a different phone or online chat and report an unauthorised SIM or number port
- Ask them to freeze your account and reverse any changes made in the last 24 hours
- Call your bank directly and tell them your phone number may be compromised
- Ask your bank to temporarily disable SMS-based two-factor authentication on your account
- Change your email password from a device not linked to the compromised phone number
First 24 hours
- Change passwords for banking, email, and any account that uses SMS-based verification
- Switch all critical accounts to app-based two-factor authentication (e.g. an authenticator app)
- Report the SIM-swap to your national cybercrime unit and file a police report
Contact your bank or payment provider
- Alert your bank to the potential SIM-swap immediately — some banks have specific SIM-swap fraud protocols
- Ask to review all recent transactions and flag any you do not recognise
- Discuss adding a verbal passcode or branch-visit requirement for high-value transactions
Evidence to preserve
- Ask your carrier for a full log of account changes and note the time the SIM or port occurred
- Check your bank and email accounts for any logins or transactions around the same time
- Keep records of all calls with your carrier
Secure your accounts and devices
- Replace SMS-based 2FA with an authenticator app on all critical accounts
- Add a carrier-level PIN or security phrase to prevent future SIM changes
- Review all accounts that send one-time codes to your phone number
Report it
- Report to your national fraud/cybercrime service
- Report to the platform, bank, or provider involved
- Keep any reference numbers you're given
SIM-swap attacks are often the final step in a targeted fraud — the attacker has already gathered your login credentials and just needs your phone number to receive one-time codes. The moment your phone loses signal for no clear reason, suspect a SIM-swap and act immediately.
After recovery, the most important protection is replacing SMS-based two-factor authentication with an authenticator app. SMS codes rely on the security of your phone number — app-based codes do not.
Frequently asked questions
How do I add a PIN to prevent future SIM-swaps?
Most mobile carriers allow you to add an account PIN or security phrase that must be given before any SIM change is processed. Contact your carrier directly to set this up — the process varies by provider.