The safest approach is layered: harden your wireless-carrier account, stop using SMS as the only second factor for important services, secure each messaging app separately, and treat unexpected codes, links, calls, and “support” requests as possible social engineering. A carrier PIN helps, but it is not a guarantee against a SIM swap or port-out.
What telecom fraud can do to your accounts
Telecom fraud is not limited to someone stealing a SIM card. Criminals combine carrier-account manipulation with phishing, stolen passwords, impersonation, and abused call features to take control of a phone number or the accounts that trust it.
SIM swaps and port-outs
In a SIM swap, a criminal persuades a wireless provider to activate a new SIM or eSIM associated with your number. A port-out moves the number to another provider. You may still have your physical phone, but the attacker can receive calls, texts, mobile data, and SMS login codes on another device. Those codes can help the attacker reset email, social-media, financial, or other accounts. The Federal Trade Commission (FTC) and FBI Internet Crime Complaint Center (IC3) describe this as a route to broader account takeover.
Call forwarding and simultaneous ring
IC3 warns that criminals can abuse legitimate carrier features such as call forwarding and simultaneous ring to route your calls elsewhere. A diverted call can expose verbal verification or help an impostor pass a support check even when your SIM has not changed.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Phishing and employee impersonation
An attacker may contact you pretending to be a carrier employee, bank, messaging-app moderator, government worker, or someone you know. The request may be for a one-time password, a “verification” link, a QR code scan, or approval of a login prompt. If the attacker already has a leaked password, the request may be the final step needed to enter your account.
Messaging-app takeover
Messaging services are separate targets. A criminal who obtains your registration code, recovery information, or a linked-device session may read new messages, impersonate you, invite your contacts into scams, or use private conversations for further extortion and fraud. Protecting the carrier account does not automatically secure Signal, WhatsApp, iMessage, or another app.
Secure the wireless-carrier account first
Use the provider’s official website, app, or a telephone number already saved in your records. Provider names for controls differ by country and carrier, so ask exactly what is available rather than assuming a feature exists.
1. Create a unique carrier PIN or passcode
Set a PIN or passcode that is not used for voicemail, email, banking, or any other service. The Cybersecurity and Infrastructure Security Agency (CISA) says most providers offer a PIN or passcode for account access or sensitive operations such as number porting. Do not treat it as a universal lock: provider authentication and internal anti-fraud processes still matter. The U.S. Federal Communications Commission’s order on customer authentication discusses complaints and the need for safeguards beyond a customer setting; rules and implementation can differ outside the United States. Read the FCC order for the U.S. regulatory background.
2. Ask for SIM-change and port-out protections
Contact the carrier and ask whether it can:
- Block or require extra verification for SIM or eSIM changes.
- Block number porting unless you approve it through a stronger process.
- Disable call forwarding and simultaneous ring, or require approval before they are activated.
- Send alerts for SIM changes, port requests, password changes, new devices, and other account events.
Turn on every relevant notification and review account history regularly. FBI IC3 specifically recommends asking the provider to disable or block SIM changes, call forwarding, and simultaneous ring where possible.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
3. Use a strong carrier-account password
Make the online carrier-account password long, unique, and stored in a password manager. Never reuse it for your primary email or a messaging service. Review recovery email addresses, backup phone numbers, authorized users, and logged-in devices; remove anything you do not recognize.
4. Change the voicemail PIN
Use a separate voicemail PIN. IC3 lists a unique voicemail PIN as a specific precaution because an attacker who reaches voicemail may hear messages or exploit weak verification procedures.
5. Reduce public clues
Limit public exposure of your phone number, home address, birth date, employer, and other details that could help an impostor answer identity questions. Remove unnecessary personal information from public profiles and avoid posting travel or account-recovery details in real time.
Move important accounts away from SMS-only authentication
SMS verification can be intercepted after a number takeover, so treat it as a fallback rather than the strongest option. Start with the accounts that can reset everything else:
- Primary email and cloud accounts.
- Financial, payment, and tax accounts.
- Apple, Microsoft, Google, and other identity-provider accounts.
- Password-manager and recovery accounts.
- Social networks and messaging services.
Open each service’s security settings, enroll a stronger method, test the sign-in and recovery process, and only then remove SMS if the service allows it. Keep a recovery method that does not depend on the same phone number you are protecting.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Authentication choices
| Method | Relationship to your phone number | What the guidance supports | Important trade-off |
|---|---|---|---|
| SMS code | Depends directly on control of the number | Convenient fallback, but FTC and CISA caution that it may not stop a SIM swap | Vulnerable when a number is transferred or messages are intercepted; keep another method enrolled |
| Authenticator app | Does not require SMS delivery for each login | FTC suggests an authenticator app when SMS is a concern | You must plan recovery if the phone is lost, replaced, or reset |
| FIDO passkey | Uses a cryptographic credential rather than a text message | CISA calls passkeys an acceptable alternative to hardware FIDO keys | Availability and recovery options vary by service and device ecosystem |
| Hardware FIDO security key | Independent of the mobile number | CISA says hardware-based FIDO keys are the most effective option where feasible | Requires service compatibility and a safe spare or recovery plan if the key is lost |
CISA’s Mobile Communications Best Practice Guidance, dated December 18, 2024, states: “Where feasible, hardware-based FIDO security keys, such as Yubico or Google Titan, are the most effective; however, FIDO passkeys are an acceptable alternative.” This describes an authentication hierarchy, not a guarantee that every service supports every key. A generic “FIDO2 security key” is an optional physical device; check the service’s compatibility list before buying one.
Protect account recovery as carefully as login
An attacker may bypass a strong sign-in method by exploiting a weak recovery path. Remove obsolete phone numbers and email addresses, generate one-time recovery codes, and store those codes offline. Review active sessions and revoke devices you no longer own. If a service lets you require a security key or passkey for recovery changes, enable that requirement.
Lock down messaging applications
Messaging apps need their own controls even after your carrier account is hardened. Menu labels change, so use the current help pages inside each app when a label differs.
General messaging-app checklist
- Install operating-system and app updates promptly.
- Use a strong device passcode and enable the device’s biometric lock if appropriate.
- Turn on two-step verification, preferably with an authenticator app, passkey, or security key where supported.
- Review linked devices and remove sessions you do not need or recognize.
- Restrict who can add you to groups and who can see your profile, status, or phone number.
- Never disclose a one-time password or approve an unexpected login prompt.
- Review backup settings and protect backups with the strongest encryption option offered.
Signal
The FBI’s cybersecurity guidance names Registration Lock and Screen Lock as Signal protections. Enable both, then open the linked-devices list and remove devices that are unnecessary or unfamiliar.
Enable Two-step verification and Security notifications. Restrict group additions and profile visibility. If you use backups, choose end-to-end encrypted backups and protect the backup passcode or key separately.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
iMessage and Apple Messages
Hide message previews on the lock screen so a person with temporary access to the phone cannot read incoming codes or private content. The FBI also identifies Advanced Data Protection for iCloud and Contact Key Verification as available protections in supported circumstances. Check Apple’s current eligibility and setup requirements before enabling them.
Free tools Windows power users keep installed
One-click scans. No signup required.
Recognize social engineering before it works
Urgency is a warning sign. Claims that your account is “compromised,” that a package or payment is waiting, or that you must verify immediately are common ways to make you act before thinking.
- Do not reply with a password, PIN, one-time code, recovery code, or full account number.
- Do not scan an unexpected QR code or open a login link sent by a stranger or supposed support agent.
- Do not approve a login prompt you did not initiate.
- Do not call a number included in a suspicious message.
- Open the known official app or type the service’s address yourself.
- Call a trusted number already saved in your records, such as the number on a statement or the back of a payment card.
The FTC’s phishing guidance, FBI IC3, and the Commodity Futures Trading Commission’s messaging-app advisory all recommend using a known-good channel instead of the link or number supplied in an unexpected message.
Report suspicious texts in the United States
Forward unwanted texts to 7726 (SPAM), report the sender in the messaging app, and report relevant fraud to the FTC. Block and delete suspicious group invitations. Review privacy controls that determine who can add or contact you.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Watch for signs that your number was taken
Treat an unexplained loss of cellular service as a possible security incident, especially if Wi-Fi calling still works or you receive an alert about a SIM change, port request, or carrier-password reset. Other warning signs include password-reset messages you did not request, an email saying your recovery information changed, or friends reporting messages you did not send.
Recommended Free Tools
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Immediate response checklist
- Contact the carrier immediately. Use a verified support channel and state that you suspect a SIM swap or port-out. Ask the provider to restore your number, cancel unauthorized forwarding, secure the account, and document the incident.
- Recover the carrier account. Change the carrier password and PIN, remove unauthorized users or devices, and enable every available alert or block.
- Secure your primary email first. Change its password from a trusted device, revoke unfamiliar sessions, check forwarding rules, and replace recovery details that were changed.
- Protect financial and high-value accounts. Change exposed passwords, review transactions, and contact the institution’s fraud department through an official number.
- Inspect messaging apps and social accounts. Remove unknown linked devices, reset two-step verification, and warn contacts that messages sent during the incident may be fraudulent.
- Preserve evidence. Save carrier alerts, emails, phone numbers, timestamps, transaction records, and screenshots before deleting messages.
- Use IdentityTheft.gov if sensitive identity or financial information was exposed. The FTC’s recovery process provides tailored next steps.
Do not wait for a monthly bill to confirm what happened. The longer an attacker controls the number, the more password resets and financial actions may be possible.
What the U.S. complaint data does—and does not—show
The FCC’s 2023 order reports that staff review of informal complaints found approximately 300 SIM-swap or port-out complaints in 2020, 400 in 2021, and 500 in 2022. These are complaint counts, not estimates of the total number of incidents; the order also discusses limitations in how complaints were handled. They show why provider authentication and customer controls remain an issue, but they should not be read as a population-wide risk rate.
U.S. rules are not universal. Carrier features, identity checks, port-out procedures, and regulator requirements vary by country and provider. Confirm the controls available on your own plan instead of assuming that a U.S. setting or legal requirement exists where you live.
A practical maintenance schedule
Today
- Set a unique carrier PIN, carrier password, and voicemail PIN.
- Turn on carrier alerts and ask about SIM, port-out, forwarding, and simultaneous-ring blocks.
- Secure your primary email with a passkey, FIDO key, or authenticator app where supported.
- Enable two-step verification and review linked devices in each messaging app.
Every month
- Review carrier account history, active sessions, forwarding settings, and recovery information.
- Check financial and email-security alerts for changes you did not make.
- Remove old messaging-app devices and unused recovery methods.
After changing phones, numbers, or providers
- Verify that the new SIM or eSIM is the one authorized on the account.
- Re-enroll authenticator apps and passkeys before wiping the old device.
- Update recovery codes and confirm that old devices and numbers are removed.
Common mistakes that leave a gap
- Relying only on a carrier PIN: A PIN helps authenticate account actions but cannot replace phishing-resistant login protection or provider anti-fraud controls.
- Keeping SMS as the only recovery route: Recovery can undo the protection you added to login.
- Ignoring linked devices: An attacker may retain access through an existing session even after you change a password.
- Calling back through a suspicious message: You may reach the criminal’s number or disclose information to an impostor.
- Waiting for certainty: Unexpected loss of service is enough reason to contact the carrier immediately.
- Using the same PIN everywhere: A leaked voicemail or carrier PIN can help an attacker compromise multiple services.
Frequently asked questions
Can a SIM swap happen if I still have my phone?
Yes. The criminal persuades the carrier to activate your number on another SIM or eSIM, so possession of your original phone does not prevent the transfer.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Is an authenticator app completely safe from telecom fraud?
No. It removes SMS delivery from that login but does not protect against stolen passwords, phishing, malware, or an attacker who compromises the account’s recovery process. Use it as one layer alongside a strong password and secure recovery.
Should I remove my phone number from every account?
Not necessarily. Some services require a number for alerts or recovery. Remove it where practical, and where it must remain, add a passkey, FIDO key, or authenticator app and ensure the recovery settings do not depend solely on SMS.
What if a caller claims to be my carrier?
End the call and contact the carrier through the official app, website, or a trusted number already on file. Never provide a one-time code or account PIN to an unsolicited caller.
Do messaging-app end-to-end encrypted chats prevent account takeover?
Encryption protects message content in transit, but it does not stop an attacker from registering your account, linking a device, or impersonating you after takeover. Registration locks, two-step verification, device reviews, and privacy controls remain necessary.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Say something about this film