What Is SIM Swapping and How It Connects to Browser Security

SIM swapping is when a criminal gets your mobile carrier to move your phone number to a SIM card or eSIM they control. Once they have your number, they receive your calls and texts, including the codes many websites send to sign in or reset passwords.

How it happens

• Social engineering: the attacker calls or chats with your carrier pretending to be you, using personal details found online or in data breaches.
• Insiders: some attacks have involved carrier employees who were bribed.
• Porting: moving your number to another carrier using stolen account details.

In 2019, the then-CEO of Twitter, Jack Dorsey, had attackers post from his account after they hijacked his phone number, which shows how exposed even well-known accounts were.

Why it matters for your online accounts

Your phone number is often the key to your accounts:

• Text message codes used for two-step sign-in.
• Password resets sent by text.
• Account recovery for email, which then opens everything else.

An attacker with your number can reset passwords from their own browser, sign in and lock you out, often within minutes. Crypto accounts and banking are frequent targets.

Warning signs

• Your phone suddenly shows no service or "SOS only" where it normally works.
• Messages from your carrier about a SIM change or port request you didn't make.
• Emails about password resets or new sign-ins.

If this happens, contact your carrier immediately from another phone, then secure your email account.

How to protect yourself

1. Lock your number: major US carriers offer protection, such as Verizon's Number Lock, AT&T's Wireless Account Lock and T-Mobile's SIM Protection. Set an account PIN with your carrier too.
2. Move away from text codes: use an authenticator app, a security key or passkeys for important accounts. See setting up two-step verification.
3. Remove your number as a recovery option where you have stronger alternatives.
4. Keep your number private: avoid posting it publicly.
5. Watch for phishing: fake sites and texts collect the details attackers use to impersonate you. See spotting fake websites.

Rules for carriers

In 2023, the US Federal Communications Commission adopted rules requiring carriers to verify customers before moving a number to a new SIM or carrier, and to notify customers when it happens.

Small browser habits that help

Codes and passwords you copy sit on your clipboard. Clipboard Guard blocks websites from reading it. See credential stuffing.