Will a port-out PIN stop every SIM swap attempt?

It stops the most common method, where an attacker relies on guessed or leaked personal details to convince a carrier representative to authorize a transfer. It won't stop an insider threat at the carrier itself or a sophisticated attack that bypasses the PIN entirely, but those are far rarer than opportunistic social engineering, which the PIN directly blocks.

Can I still switch carriers myself if I set up a port-out lock?

Yes. A port-out PIN or freeze only requires you to provide the PIN or personally lift the freeze before a transfer goes through. It adds a verification step for you too, but it doesn't prevent you from legitimately switching providers when you want to.

What should I do if my number gets ported without my consent?

Contact your carrier immediately to report unauthorized porting and request the number be returned to your control; carriers have fraud teams for this exact scenario. At the same time, change passwords on any account that used SMS-based two-factor authentication, starting with email and banking, since those were the accounts most likely targeted through the stolen number.

How to lock your phone number so nobody else can port it out

Learn how a port-out PIN and carrier lock stop strangers from hijacking your phone number and the accounts tied to it.

Your phone number is the master key to your bank, your email recovery, and every two-factor code you own, yet most people never lock it against transfer. Pew Research found that 81% of Americans say the potential risks of companies collecting their personal data outweigh the benefits, and a related finding shows 67% of Americans understand little to nothing about what companies do with their personal data, including the phone number carriers hold on file. That gap between exposure and awareness is exactly what number porting scams exploit. Most people think of their phone number as a convenience, a string of digits that friends and delivery drivers use to reach them, not as the single point of failure that sits behind their entire digital life. Carriers know this too, which is precisely why the protections against unauthorized transfer exist but stay switched off unless you go looking for them.

How a number gets stolen without you noticing

Port-out fraud, often called SIM swapping when it involves a physical SIM, follows a predictable chain. First, an attacker gathers enough personal details about you: your name, birth date, billing address, sometimes the last four digits of an account number, usually harvested from a data breach or a phishing message you barely remember clicking. These details are often cheap and easy to find precisely because so much personal information ends up scattered across broker sites and leaked databases without the person involved ever realizing it happened. Second, they call your carrier or use its online portal, posing as you, and request that your number be transferred to a new SIM or a different provider entirely. A convincing answer to one or two security questions is often all it takes, especially if the representative on the other end is following a script rather than scrutinizing the request. Third, if the carrier has no extra verification step, the transfer completes in minutes. Your phone loses signal, and the attacker’s device starts receiving your calls and text messages. From there, they reset passwords on your email, bank, and crypto accounts using the SMS codes now landing on their phone, while you’re still wondering why your phone shows no bars. The entire process, from first phishing message to drained account, can take less than an hour once the attacker has enough information to sound convincing, which is what makes it so different from slower forms of fraud that give victims time to notice something is wrong.

A number changes hands overnight

This is an illustrative scenario built to show how the mechanics play out, not a documented case.

The following is a fictional illustration built to show how the mechanics play out, not a documented case.

A freelance designer stores most of her client invoices and payment links behind two-factor authentication tied to her phone number. One evening her phone drops to no service. She assumes it’s a network outage and goes to bed. By morning, her email password no longer works, and a message confirms a wire transfer she never authorized. The attacker had called her carrier posing as her, answered a security question using details from an old data leak, and ported her number to a SIM they controlled. Every SMS reset code that followed went straight to them. The carrier eventually restored her number, but the transferred funds were gone, and rebuilding her account security took weeks. What made the attack work wasn’t a sophisticated hack of her devices; it was a single phone call that relied entirely on information she had never thought to protect, sitting quietly in a breached database from years earlier. By the time she pieced together what had happened, the attacker had already moved on, and the bank’s fraud department told her that wire transfers authorized through a verified account are notoriously difficult to reverse.

How to lock a number against unauthorized porting

Carriers offer specific tools to stop unauthorized transfers, but almost none of them are turned on by default. Setting them up takes a few minutes and closes the exact gap that port-out fraud depends on. The steps below apply to most major carriers, though menu names vary, and it’s worth doing all four rather than treating any single one as sufficient on its own.

Set a dedicated port-out PIN or passcode

Most carriers let you create a separate PIN, distinct from your account login password, that must be provided before any port-out or SIM swap request is processed. Call customer support or check your account security settings to add one. Choose a PIN that isn’t your birth date, your address digits, or anything guessable from a data breach, and don’t reuse a PIN you’ve used elsewhere. Write it down somewhere secure rather than relying on memory alone, since you’ll rarely need it and forgetting it during an actual emergency defeats the purpose.

Add a port freeze or port-out block

Some carriers offer an explicit port freeze that blocks any transfer request until you personally lift it, in person or through a verified call. This is stronger than a PIN alone because it stops the transfer even if someone manages to answer your security questions correctly. Ask your carrier by name whether this feature exists and whether it’s free. If it isn’t offered outright, ask specifically about additional account security options, since some carriers only mention the strongest protections when a customer asks directly rather than listing them in the standard account settings menu.

Move two-factor authentication off SMS where possible

Even with a locked number, reduce how much damage a port would cause by moving your most sensitive accounts, email, banking, and password managers, to an authenticator app or a hardware security key instead of text message codes. This way, a stolen number no longer doubles as a master key to everything else. Start with the accounts that would cause the most damage if compromised, then work outward to less critical services, since switching every account at once can feel overwhelming and stall the whole effort.

Check your carrier account for exposed personal details

Review what information sits behind your carrier login: billing address, security questions, backup phone numbers. Remove anything outdated, and make sure the answers to security questions aren’t things a stranger could find on social media or in a leaked database. Consider also checking whether your carrier allows you to require an in-person visit with photo ID for any account changes, which adds friction that phone-based social engineering simply can’t get past.

Why a dedicated privacy tool matters here

Locking your carrier account is the direct fix, but it only works if the personal details attackers rely on to pass verification aren’t sitting exposed online in the first place. Data broker sites routinely list full names, addresses, birth dates, and phone numbers scraped from public records and leaked databases, and that’s the raw material scammers use to answer a carrier’s security questions convincingly. A service that continuously finds and requests removal of your information from these broker sites shrinks the pool of details an attacker can use to impersonate you when they call your carrier. It won’t replace a port-out PIN, but it removes the ammunition that makes social engineering against your carrier’s support line easier in the first place, which is precisely the step most people skip because it happens outside the carrier’s own settings. Given that 67% of people say they understand little to nothing about what companies do with their data, it’s worth treating broker exposure as an ongoing task rather than a one-time cleanup, since new listings tend to reappear as data gets resold and republished across different sites over time.

Phone