How to protect your phone number from SIM-swap and port-out fraud, and where the FCC rules stand

Your phone number has become a key to your financial life, and criminals know it. In a SIM-swap scam, a bad actor convinces your wireless carrier to transfer your service to a phone the criminal controls. In port-out fraud, the scammer poses as you, opens an account with a different carrier and has your number moved there, according to the Federal Communications Commission. Either way, calls and text messages meant for you, including one-time sign-in codes, go to the criminal.

The FBI's Internet Crime Complaint Center received 971 SIM-swap complaints in 2025, with reported losses of $17,366,758, according to its 2025 annual report. Those figures count only what victims reported to the FBI, and a hijacked number can open the door to bank, email and cryptocurrency accounts.

Warning signs of a SIM swap

The Federal Trade Commission's SIM-swap guidance says the clearest sign is that your cell phone suddenly stops working, with no data, no text messages and no phone calls. Another is an unexpected notice from your carrier that your SIM card or phone number was activated on a new device. The FTC says scammers may call your carrier and claim your phone was lost or damaged.

Lock down your wireless account

The single most useful step is to make your carrier account harder to change.

• Set a PIN or passcode. The FTC recommends setting up a PIN or password on your cellular account. The Cybersecurity and Infrastructure Security Agency says most carriers offer an additional PIN or passcode that is required to log in to the account or complete sensitive changes such as porting a number, which it calls a critical step against SIM swapping.
• Protect the online account too. CISA's mobile communications guidance recommends adding a PIN and multifactor authentication to your carrier account and using a password manager to change the account password.
• Ask about account locks. Some carriers already let customers lock their accounts against SIM changes or number transfers, the FCC noted in its 2023 order. Ask your carrier what it offers and how to turn it on and off.
• Pick a PIN that is hard to guess. Avoid birthdays, addresses or digits from your Social Security number.

Don't rely on text-message codes for important accounts

Many banks, email providers and apps send sign-in codes by text. The FTC warns that text message verification may not stop a SIM swap, and suggests using an authentication app or a security key if you are concerned.

CISA goes further for high-value accounts. Its guidance says authenticator app codes are better than texts but are still vulnerable to phishing, and that FIDO-based sign-in, such as hardware security keys or passkeys, is the strongest option. It also notes a catch: adding an authenticator app does not automatically remove text messages as a backup, which can leave a weak fallback. Some services still default to texts for account recovery, so check each account's security settings.

Limit what scammers can learn about you, too. The FTC advises not replying to calls, emails or texts that ask for personal information and limiting the personal details you share online.

What the FCC rules require, and where they stand

On Nov. 15, 2023, the FCC adopted rules aimed at both scams. The order requires wireless carriers to:

• Use secure methods to confirm a customer's identity before a SIM change or a port-out.
• Notify customers immediately when a SIM change or port-out request is made on their account.
• Offer customers, at no cost, the option to lock their accounts to block SIM changes and number ports.
• Keep a clear process for reporting fraud, investigate and fix fraud promptly, and give customers documentation of fraud on their accounts.

The rules have not fully kicked in. Parts took effect Jan. 8, 2024, but provisions that require paperwork review by the White House Office of Management and Budget, including the notice and lock requirements, were delayed. In a July 5, 2024, order, the FCC's Wireline Competition Bureau said compliance with the rules in their entirety would not be required until that review was done and the FCC published a notice in the Federal Register announcing the compliance date.

That notice had not appeared as of Oct. 12, 2026. The current federal regulations, as shown in the Electronic Code of Federal Regulations, still say compliance "will not be required until this paragraph is removed or contains a compliance date." Until then, the protections you get depend largely on your carrier, so ask what it offers rather than assuming the federal rules apply.

What to do if it happens

1. Call your carrier right away from another phone to take back control of your number.
2. Change your passwords once your number is back, starting with email and financial accounts.
3. Check your bank, credit card and other financial accounts for unauthorized charges or changes, and report any to the company.
4. Go to IdentityTheft.gov if a scammer may have your Social Security, credit card or bank account number. The FTC site lists specific recovery steps.
5. Report it to the FTC at ReportFraud.ftc.gov and, if money was stolen online, to the FBI at ic3.gov. You can also file a complaint with the FCC about your carrier.

Carrier options, names and steps vary, and rules can change. Check your carrier's security settings and the FCC's site for current details, and talk to your bank promptly if money is involved.