Can someone steal my phone number, and how would I know?

SIM swapping is rarer than phishing but far more damaging when it happens, because a phone number is the recovery route for a great many accounts. It is a social engineering attack on your mobile network rather than an attack on your phone, which is why nothing on the handset can prevent it.

Safety

Step by step

1. Understand the chain.Personal details are gathered from breaches, public records and social media. The criminal contacts your network posing as you and requests a replacement SIM or a port to another provider. Once it activates, your SIM stops working and all calls and texts go to them.
2. Recognise the alarm.Your phone shows no service or emergency calls only, and it stays that way, while other phones on the same network work. Restarting and reseating the SIM changes nothing. That combination is the signal.
3. Act from another phone immediately.Ring your network's fraud line from a landline or someone else's mobile. Say you believe your number has been fraudulently ported and ask them to stop it and restore the number.
4. Secure email before anything else.From a computer, change the email password and remove the phone number as a recovery method or as a second factor while you sort it out. Email is what they will use next.
5. Ring your bank on 159 or the number on your card.Banks rely on the number for one-time codes and for identifying you. Tell them the number is compromised so they stop trusting it.
6. Move important accounts off SMS codes.Replace SMS with an authenticator app or a passkey on email, banking, the password manager and cloud storage. This is the durable fix, and it is worth doing before anything happens.
7. Add a port-out protection with your network.Most UK networks can add a port-out PIN, an account password, or a note requiring extra verification before any SIM change. It is not on by default and you usually have to ask.
8. Reduce what is publicly available about you.The attack needs enough personal detail to convince a call handler. Date of birth, address history and the answers to standard security questions are the ingredients — see the guides here on data brokers and security questions.
9. Report it.Action Fraud, or Police Scotland on 101 in Scotland, plus your network's fraud team. Keep the timings — the exact minute the signal dropped is useful evidence.

Tips

• An eSIM does not remove the risk, because the attack targets the network's account process rather than the physical card.
• If you use a phone number as your username anywhere, treat that account as being at the same risk as an SMS second factor.
• Losing signal abroad is far more likely to be roaming than a port. Check whether other people on your network in the same place have service before panicking.

Common mistakes

• Waiting to see whether the signal comes back — Every minute is a minute where password reset codes reach someone else. Ring from another phone straight away.
• Relying on SMS as the second factor for email — It puts the most important account in the catalogue behind the credential most easily stolen. Move it to an app or a passkey.
• Assuming a strong password protects you — This attack does not need your password. It needs the reset code, which is now arriving on their device.

Questions people ask