Your Phone Number Was HijackedAct Fast to Limit the Damage

A SIM swap attack, sometimes called SIM hijacking or port-out fraud, is identity theft aimed at the one credential almost every online account trusts: your mobile phone number. The attacker does not need to touch your phone. Instead, they convince your wireless carrier, or exploit a weakness in the carrier's process, to move your number onto a SIM card they control. From that moment, every call and every text message meant for you arrives on the criminal's device instead, including the one-time passcodes that banks, exchanges, and email providers send by SMS.

The attack usually unfolds in three phases. First comes reconnaissance. Criminals assemble a profile of the target from data broker records, previous breach dumps, and social media. They are looking for the details a carrier support agent might use to verify identity: full name, address history, date of birth, account numbers, and answers to common security questions. High-value targets, such as executives, cryptocurrency holders, and owners of desirable social media handles, are often researched for weeks before the swap is attempted.

Second comes the takeover itself. The most common route is social engineering: the attacker calls the carrier posing as you, claims a lost or damaged phone, and asks to activate service on a new SIM. Some groups instead recruit or bribe retail store employees, use stolen carrier account credentials to process the change online, or exploit the number porting process by moving your number to an entirely different carrier. However it happens, your handset abruptly loses service, which is often the only warning a victim gets.

Third comes the harvest. With your number in hand, the attacker triggers password resets on your email, banking, brokerage, and cryptocurrency accounts, intercepts the SMS verification codes, and locks you out of your own digital life. Because so many institutions treat possession of a phone number as proof of identity, a single successful swap can cascade into full account takeover in under an hour. The FBI Internet Crime Complaint Center 2024 Annual Report logged 982 SIM-swap complaints totaling approximately $26 million in direct losses in 2024¹, and those figures capture only what victims reported to one federal channel.

Why SMS Two-Factor Authentication Fails Against This Attack

Text-message verification codes were designed to prove that a login attempt came from someone holding your phone. A SIM swap breaks that assumption completely: the attacker does not bypass your second factor, they become it. This is why security frameworks and federal guidance have steadily moved away from SMS as an authentication channel for sensitive accounts. App-based authenticators generate codes on the device itself, and hardware security keys bind the login to a physical token, so neither can be intercepted by taking over a phone number. Migrating your critical accounts off SMS verification is the single highest-impact step you can take after a swap, and Petronella Technology Group, Inc. walks every recovery client through that migration account by account.

How to Tell You Have Been SIM Swapped

The signs appear quickly. Your phone drops to no service or shows an emergency-calls-only state in a location where coverage is normally solid. Restarting the handset does not restore it. Password reset emails you never requested start arriving, or you find you can no longer sign in to your primary email account. Friends may report strange calls or texts from your number. Some victims first learn of the attack from a low-balance alert or a transfer confirmation from their bank. If two or more of these happen together, treat it as an active incident and work the five steps above immediately, starting with your carrier.

Petronella Technology Group, Inc. treats a SIM swap the way we treat any active intrusion: contain first, investigate second, harden third. When you call (919) 348-4912, the first conversation is a rapid triage. We establish whether the number is still in the attacker's hands, which accounts have already been touched, and where the highest-value exposure sits, usually primary email, banking, brokerage, and any cryptocurrency holdings. You get a prioritized action list on that first call, because the order in which accounts are secured matters enormously in the first hours.

Containment: Taking Your Number and Accounts Back

Carrier fraud departments have their own escalation paths that are faster than general customer support, and the fastest resolution of all is usually a visit to a physical store with government identification. We guide you through that process, help you insist on a fraud investigation rather than a routine SIM change, and make sure the account leaves the incident with a unique PIN, a port freeze, and a SIM lock so the attacker cannot simply repeat the swap next week. In parallel, we work the account list: primary email is always first, because whoever controls your inbox can reset nearly everything else. Each account is recovered from a known-clean device, given a new unique password, and moved off SMS verification onto an app-based authenticator or a hardware security key.

Investigation: Finding Out How It Happened

A SIM swap is rarely the first event in the chain. The attacker needed enough personal data to impersonate you, and sometimes that data came from spyware or a credential-stealing infection on one of your own devices. Our forensic team, led by a North Carolina licensed digital forensic examiner, examines the devices involved for keyloggers, remote access tools, and malicious profiles, and reviews account activity logs to reconstruct the timeline of what the attacker reached and when. That reconstruction matters for more than curiosity: it determines which accounts and documents must be treated as exposed, and it produces the evidence package you will need for law enforcement reports, bank fraud claims, and any dispute over liability for stolen funds.

Hardening: Making Sure It Does Not Happen Again

The engagement closes with a hardening pass across your digital footprint. We remove your phone number as a recovery factor wherever it lingers, set up dark web monitoring for your credentials, review the exposure of your personal data with brokers, and document the carrier-side protections now in place. For clients who lost cryptocurrency in the attack, we coordinate directly with our crypto theft tracing service so blockchain analysis starts while the trail is fresh, and for business victims we extend the review to corporate mail tenants and finance workflows, since a swapped executive number is a common opening move in business email compromise operations.

Every major U.S. carrier now offers account-level protections that make a SIM swap dramatically harder, but none of them are enabled by default. Prevention is a checklist, and it takes less than an evening:

• Set a carrier account PIN or passcode. Choose one that appears nowhere else in your life. This single control blocks the most common social engineering script, because the support agent will require it before processing a SIM change.
• Enable the port freeze and SIM protection features. Carriers offer number lock or port-out protection settings that prevent your number from being moved to a new SIM or a new carrier until you explicitly unlock it.
• Get SMS out of the authentication path. Move every account that matters to an app-based authenticator or, better, a hardware security key. Where an account insists on keeping a phone number, consider using a number that is not publicly associated with you.
• Remove your number as a recovery option. The recovery settings of your email and financial accounts are where SIM swaps do their damage. Replace phone-based recovery with backup codes stored offline.
• Starve the reconnaissance phase. Limit what you share publicly about your carrier, your investments, and your holdings. Criminals select SIM swap targets based on what they can learn in advance.

For organizations, the same logic scales up. Executives, finance staff, and anyone with wire authority or administrative access should carry carrier-level port protection, phishing-resistant authentication, and a documented incident procedure that assumes their number can be taken at any time. Petronella Technology Group builds those protections into our managed cybersecurity programs, and our security awareness training teaches teams to recognize the early signs of number hijacking before the losses start.

Hour one belongs to the carrier and your email. Call your carrier's fraud line from any working phone, report the unauthorized SIM change, and ask them to suspend the line or return it to your SIM. Insist that the incident be logged as fraud, not as a routine service issue, and ask for the case number. While you are on hold, use a separate, known-clean device to sign in to your primary email account. If you still have access, change the password and revoke all active sessions. If you are locked out, start the provider's account recovery process immediately, because every downstream reset the attacker attempts flows through that inbox.

Hours two through six are the account race. Work outward from email in order of damage potential: banking, brokerage, cryptocurrency exchanges, payment apps, then cloud storage and social accounts. For each one, change the password, remove your phone number from the recovery and verification settings, switch verification to an authenticator app, and review recent activity for changes you did not make. Watch specifically for new payees, linked devices, forwarding addresses, and altered contact details, which are the footholds attackers leave behind for a second round.

The rest of day one is for evidence and notifications. Photograph or screenshot everything as you find it: the no-service screen, unauthorized transactions, password reset emails, and timestamps. Notify your bank's fraud department about any suspicious transfers, place a fraud alert or credit freeze with the credit bureaus, and file your FBI IC3 and FTC reports while details are fresh. If cryptocurrency moved, record the transaction hashes and destination addresses exactly; those identifiers are the starting point for tracing.

Day two is verification and cleanup. Confirm the carrier protections are actually in place by attempting nothing less than a full review of the account settings: PIN set, port freeze on, SIM lock enabled. Sweep the long tail of accounts that still reference your number, including shopping, travel, and subscription services. If there is any chance your devices contributed to the attack, stop using them for sensitive logins until they have been examined. This is the point where victims most often bring in Petronella Technology Group, Inc., either to run the forensic examination or to audit that nothing in the first-day scramble was missed, and a single missed forwarding rule or recovery number is exactly the kind of thing a systematic audit exists to catch.