What Is SIM Swapping? How to Prevent an Attack

If you're searching for what SIM swapping is, you probably just watched your phone drop to "no service" for no reason, or heard about it happening to someone you know. It's an attack where scammers never touch your physical SIM card — instead, they talk your carrier's support team into porting your number onto a blank SIM sitting in their own phone. Once that number is theirs, every SMS meant for you, including two-factor codes from your bank, arrives on their device instead. This guide covers exactly how the attack works, the warning signs that should stop you cold, the concrete steps that prevent it, and what a virtual number can and can't actually do here.

How does SIM swapping actually work?

SIM swapping exploits a weak link in a carrier's customer service process, not a technical flaw in the phone network itself. The attacker first gathers your name, birthdate, address, or recent billing details — usually from a data breach, a phishing page, or your own social media. They then call the carrier or walk into a retail store, claim their phone was lost or damaged, and ask to activate a new SIM on the account. If the identity checks are weak enough or the rep gets socially engineered, the carrier ports the number straight onto the attacker's SIM.

The moment that port completes, your real SIM goes dead — no calls, no texts, nothing. The attacker now controls your number, which means they can see every SMS-based verification code your bank, exchange, or email provider sends. From there they trigger account recovery flows, reset passwords, and work through your accounts one by one. This is a different mechanism from an OTP bot: an OTP bot leaves your number in your hands and tricks you into reading out a code, while SIM swapping physically reassigns the number itself, so codes land on the attacker's device without you ever saying a word.

How can I tell if I've been SIM swapped?

The attack usually finishes within minutes, so catching it early matters more than almost anything else here.

• Sudden "no service" with no explanation: A phone that was working fine and abruptly loses all signal, and a restart doesn't fix it, is the strongest tell.
• An unexpected SIM change notification: Some carriers text or email you when your number moves to a new SIM; if you didn't request it, call the carrier immediately.
• Password reset emails you never triggered: A run of "forgot your password" emails usually means someone is working through your accounts in sequence.
• Login alerts from unfamiliar devices: A "new device signed in" notification from your bank or email can mean a code has already been intercepted.
• Unexplained changes on social accounts: A password or linked phone number that changed without your involvement is a sign the attack has already progressed.

Every one of these is worth acting on immediately — call your carrier from another line or online and ask them to freeze the account before doing anything else.

How do I protect myself from SIM swapping?

Because the attack feeds on weak identity checks at the carrier, most of the effective defenses start there too.

1. Set a PIN or passcode on your carrier account: Most carriers let you add an extra security PIN required for any SIM change or number port, which blocks an attacker armed with just your name and birthdate.
2. Move critical accounts off SMS-based codes: Switching two-factor authentication to an authenticator app for banking, email, and crypto accounts keeps them protected even if your number does get taken.
3. Stop posting personal details publicly: Your birthdate, your mother's maiden name, or an old address are exactly what carrier support uses for identity verification questions.
4. Don't hand your number to phishing messages: Clicking a fake delivery or bank link and entering details can hand an attacker the last piece they need for a SIM swap; we cover similar patterns in SMS scam warning signs.
5. Add a non-SMS recovery method on important accounts: A backup email or recovery codes that don't rely on SMS keep you able to get back in even if your number is briefly compromised.

Does a virtual number protect me from SIM swapping?

The honest answer is no — a virtual number doesn't directly protect the real carrier line that SIM swapping actually targets. SIM swapping goes after your physical SIM and carrier account; a virtual number is a completely separate, cloud-based system that carries no risk of a carrier hijacking your line. If your bank or email is already tied to your real number, a virtual number can't retroactively shield that connection.

There's an indirect benefit, though: verifying secondary or low-stakes accounts — a forum signup, a trial subscription, a second social profile — with a virtual number instead of your real one reduces how many places your real number sits. If a swap does happen, the accounts an attacker can reach depend directly on that count; reserving your real number for what genuinely needs it (banking, official services) limits the blast radius. We go deeper on this in two-factor authentication with a virtual number, recommending an authenticator app over SMS as the permanent second factor long-term.

Troubleshooting: the code never arrived, the number was rejected, or the order timed out

This section isn't about SIM swapping — it covers issues with a virtual number order from Vernum's dashboard, where a code never showed up or the order ran into a problem. Here's the sequence to follow.

1. Wait out the window and refresh the dashboard: Some carriers add a few seconds of delay; keep checking until the order window actually closes.
2. Switch countries if the number gets rejected: Certain country codes are rejected more often by specific services; switching to one with strong availability usually solves it.
3. Confirm the automatic refund if the order times out: If the code never arrives and the window closes, the coins you spent are credited back automatically, and you can place a new order right away.
4. Try a different carrier if it keeps happening: Repeated failures on the same country-service pair usually resolve faster by switching carrier or country than by retrying the same combination.

We walk through the full ordering flow in SMS code not arriving, fixes.

Cheapest countries for Google (Vernum, September 20, 2026)

Google is one of the accounts SIM swapping most often targets, since email recovery and sign-in can still fall back to an SMS code. The table below shows the eight lowest-priced countries in Vernum's catalog for Google as of September 20, 2026. 1 coin = $0.01, confirmed via a live web search this session at roughly 48.66 TRY per USD.

Vernum's overall catalog covers more than 190 countries; 184 of them are currently available for Google, and the eight cheapest all sit at the same floor price of 25 coins (about $0.25). A Turkey number is also on the list, at 42 coins (about $0.42). In SIM-swap terms, this means you can verify a secondary Google account quickly without ever touching your real number. Prices refresh hourly; the live list is always in the dashboard.

What is SIM swapping comes down to this: an attack that targets your carrier's support process rather than your phone itself, and once it succeeds, every SMS code you'd normally rely on goes straight to the attacker. Setting a carrier PIN, keeping personal details off social media, and moving critical accounts to an authenticator app closes off most of the ways this attack succeeds. If your number is already compromised, calling the carrier comes first, changing passwords on critical accounts comes right after.

Frequently asked questions