Lock your phone number against SIM swap scams

Turn on your carrier’s account protection for every family line, then replace text-message login codes on your most important accounts with an authenticator app, passkey, or security key. T-Mobile customers need SIM Protection and Port Out Protection. Verizon customers need SIM Protection and Number Lock. AT&T customers can use Wireless Account Lock. These settings are free, take only a few minutes, and help lock your phone number against SIM swap scams.

What a SIM swap is, and what these locks cover

In a SIM swap, a scammer persuades a carrier to move your number to a SIM or eSIM the scammer controls. Your phone may abruptly lose calls, texts, and cellular data. Meanwhile, the other phone receives calls and texted security codes meant for you. The FTC’s SIM swap guidance lists unexpected loss of service and a notice that your SIM was activated on another device as warning signs.

There are two related changes worth blocking. A SIM change moves your service to another device on the same carrier. A port moves your number to another carrier. The names are maddeningly similar, so Verizon and T-Mobile split protection across two settings. Turn on both where offered.

A carrier lock is a speed bump with teeth, rather than a guarantee. It limits specified changes to the wireless account. It cannot protect an email account with a reused password, stop someone who already controls an authorized account login, or make text-message authentication immune to number theft. Give the carrier account a long, unique password, review its authorized users, and never give a caller a login code or account PIN.

T-Mobile: enable two protections

For a personal postpaid account, start with T-Mobile SIM Protection. It can block SIM changes for selected lines or the entire account. T-Mobile says the setting does not block Apple’s eSIM transfer process because that process has its own security checks. SIM Protection is available for T-Mobile postpaid accounts, and the person enabling it must be the Primary Account Holder or have Authorized User Access.

1. Sign in to your T-Mobile account.
2. Go to My account, then Profile.
3. Open Privacy and Notification.
4. Open SIM Protection and turn it on for the account or each eligible line.

Next add Port Out Protection. This separate control blocks an unauthorized move to another carrier. T-Mobile offers it to postpaid, business, prepaid, and Metro customers, but it must be added line by line. For postpaid service in T-Life:

1. Sign in to T-Life and tap Account.
2. Under My account, tap See Plans.
3. In the plan section, tap Manage add-ons.
4. Select a line, scroll to Port Out Protection, and select its checkbox.
5. Tap Continue, review the order, then tap Agree & Submit.
6. Repeat for every other line.

The web route and prepaid directions are on T-Mobile’s number transfer support page. An Authorized User can add Port Out Protection on postpaid service, but only the Primary Account Holder can remove it. That asymmetry is intentional and useful.

Verizon: turn on SIM Protection and Number Lock

Verizon also has two switches. SIM Protection blocks transactions that need a new SIM, including SIM swaps, device changes, upgrades, and bring-your-own-device changes. Number Lock blocks a transfer to another carrier and prevents creation of a Number Transfer PIN. Verizon’s official app instructions put both controls in the same area:

1. Open the My Verizon app.
2. Tap the Me tab.
3. Tap Edit profile and settings.
4. Scroll to Security, then tap SIM Protection.
5. Turn on the switch beside every family number and tap Confirm.
6. Return to Security, tap Number Lock, and turn on the switch beside every number.

Do both. Verizon explicitly says Number Lock alone does not prevent SIM or equipment changes. If you prefer a browser, sign in to My Verizon as an Account Owner or Manager, then open Account, Account settings, Security settings. Edit SIM Protection, save the selections, then edit Number Lock and save those selections.

Plan ahead before a legitimate phone change. Verizon says SIM and upgrade transactions remain blocked for 15 minutes after SIM Protection is turned off, and there may be another delay. This is security doing its job, with the usual talent for choosing an inconvenient moment.

AT&T: turn on Wireless Account Lock

AT&T Wireless Account Lock covers every device and line on a wireless account with one account-level control. When active, it blocks SIM and eSIM changes, phone-number changes, transfers to or from another carrier, device upgrades, changes to authorized users, and several billing changes. Payments, plan changes, and service suspension remain available.

For regular AT&T Wireless service:

1. Open the AT&T app on a device active on the wireless account and sign in.
2. Tap the person icon.
3. Scroll to Wireless account lock.
4. Swipe to lock the account.

For AT&T Prepaid, sign in to the app, choose the number if asked, and tap Continue. Go to Profile & Settings, Account Info & Preferences, then Wireless Account Lock and Turn on. AT&T sends a one-time code to the prepaid phone so you can validate the change.

Primary and secondary account users can manage the lock, so review who has secondary access and protect each login. AT&T sends the primary holder an email and each active number a text when the setting changes. Treat an unexpected notice as a reason to sign in through the app yourself, never through a link in a message.

Move important accounts away from SMS codes

Number locks reduce risk, but the cleaner fix is to stop making your phone number the key to everything. CISA’s mobile security guidance says SMS authentication is not phishing-resistant and recommends FIDO authentication, which includes passkeys and hardware security keys. The FTC recommends an authentication app or security key when SIM swapping is a concern.

Start with the accounts that can reset the rest: your main email, password manager, bank or brokerage, and major payment and social accounts. For each one:

1. Open its Security, Sign-in, or Two-factor authentication settings.
2. Add a passkey, security key, or authenticator app if offered.
3. Test the new method in a private browser window before changing anything else.
4. Save the site’s recovery codes in a password manager or on paper stored somewhere private.
5. Remove SMS as a login method if the service allows it. Keep a current recovery number only when the provider requires one.

An authenticator app creates rotating codes without relying on your cellular number. A passkey or hardware security key is stronger against phishing because it is tied to the real site. If a site offers only text codes, keep two-factor authentication enabled, use a unique password, and leave the carrier protections on. A text code is still more useful than a password alone in many ordinary account attacks, even though it has this particular weak spot.

A password manager makes unique passwords and recovery-code storage much less tedious. Families that want shared vaults can compare our 1Password Families guide and Bitwarden Premium review. Our weekend family security checklist covers the broader account cleanup without repeating it here.

If your phone suddenly loses service

Do not assume a neighborhood outage if your phone loses cellular service and a family member’s phone still works. Use WiFi or another phone, then work in this order:

1. Contact the carrier immediately through its official app, website, store, or the number printed on a bill. Ask it to restore your number and check for unauthorized SIM, device, port, and account-user changes.
2. Secure your primary email first, then financial accounts, the carrier account, and other sensitive logins. Change compromised or reused passwords and end unfamiliar sessions.
3. Call banks and card issuers using numbers from their apps or the backs of cards. Ask them to review suspicious logins and transactions and place alerts where appropriate.
4. Preserve carrier notices, emails, screenshots, transaction details, and times. Report unauthorized transactions to the institution promptly.
5. Follow the FTC’s recovery directions and file a report with the FBI Internet Crime Complaint Center if the incident involved fraud or theft.

The FBI gives the same basic priority: contact the carrier, regain the number, change account passwords, and notify financial institutions. Once access is restored, confirm every line still has the correct protection enabled. Scammers also use convincing texts to collect account details, so our text and QR scam briefing is a useful follow-up for the family group chat.