SIM swap attacks: how to protect your phone number and crypto
Last updated
In a SIM swap, a scammer convinces your mobile carrier to move your phone number to a SIM card they control. From then on, your calls and text messages go to them, including the login and password-reset codes your accounts send by SMS.
Signs it’s happening
- Your phone suddenly shows no service or “SOS only” in a place where it normally works.
- You get notices about a SIM change, a new device or a port-out request you didn’t make.
- You start getting password-reset emails you didn’t ask for.
If your phone loses service unexpectedly, contact your carrier from another phone right away, then change the passwords on your email and exchange accounts.
How to protect yourself
- Stop using SMS for two-factor authentication on exchanges and email. Use an authenticator app, a passkey or a hardware security key instead. See our two-factor guide.
- Remove your phone number as a recovery option where an account lets you, especially on your main email.
- Add a carrier account PIN or port-out lock. Most major carriers offer one. Ask for the strongest account protection they have.
- Keep your phone number private. Don’t link it to public social profiles, and use a different number for crypto accounts if you can.
- Secure your email first. Your email can reset almost everything else, so it deserves your strongest protection.
Why self-custody helps
A SIM swap can’t touch crypto in a self-custody wallet, because those wallets don’t use your phone number at all. What it can reach are exchange accounts and email. That’s one more reason to keep only what you need on an exchange. See exchange vs. self-custody.