How to recover your line after a SIM swap fraud attempt

There is a particular kind of dread that arrives when your phone suddenly loses signal for no reason, followed by a flood of "your password has been reset" emails you never requested. If you've felt that jolt, you may already be living through a SIM swap attack, one of the fastest-moving, highest-stakes forms of fraud in personal cybersecurity today.

Unlike a stolen wallet or a phished password, a SIM swap hijacks the one thing almost every recovery flow on the internet quietly depends on: your phone number. Banks text you a code. Email providers text you a code. Crypto exchanges, brokerages, even government portals, they all lean on SMS as a fallback "proof of you." Criminals know this, which is why SIM swapping has become the preferred first move in account-takeover fraud that can drain bank accounts, empty crypto wallets, and lock victims out of their own digital lives within minutes.

The good news: SIM swap fraud is recoverable, and the difference between a costly ordeal and a minor scare almost always comes down to what you do in the first 60 minutes. This guide walks through exactly that — who to call, in what order, and what to say, followed by the medium- and long-term steps to fully secure your identity afterward.

What Exactly Is a SIM Swap Attack?

A SIM swap (also called a "port-out scam" or "SIM hijacking") happens when a fraudster convinces your mobile carrier to transfer your phone number to a SIM card they control — often using stolen personal details, a bribed insider, or convincing social engineering on a customer service line. Once the swap succeeds, your phone loses service entirely, and every call and text meant for you now goes straight to the attacker.

From there, the attacker uses your hijacked number to intercept one-time passcodes (OTPs) and reset the passwords on your email, banking, and cryptocurrency accounts — often within minutes, before you've even realized what happened.

The Warning Signs

Recognizing an attack early can save you thousands of dollars and days of cleanup. Watch for:

• Sudden loss of cell signal:  With no explanation — no calls, no texts, no data, even though you haven't changed anything
• A "SIM change confirmed" or "new device activated" text or email from your carrier that you didn't request
• Unexpected password-reset emails from your bank, email provider, or social media accounts
• Being logged out of accounts you were previously signed into
• Friends or family reporting strange messages sent "from you" on messaging apps tied to your number

If two or more of these happen in quick succession, assume you are mid-attack and move immediately into emergency mode.

 The First Hour: Minute-by-Minute Emergency Response

Speed matters more than precision here. The attacker's entire plan depends on having a window of a few unmonitored minutes to raid accounts before you notice. Your job is to shrink that window to zero.

Minutes 0–5: Confirm and Contain

1. Try calling your own number from another phone. If it rings through to a device that isn't yours, or goes straight to voicemail set up by someone else, that confirms a swap.

2. Get onto Wi-Fi immediately using a laptop, tablet, or a family member's device. You've lost your cellular line, not necessarily your internet access, use it.

3. Do not waste time trying to fix the SIM yourself through your phone's settings. The compromise is on the carrier's network, not your handset.

Minutes 5–15: Lock Down Your Most Critical Account First - Email

Your email is the master key to almost everything else, because it's the recovery address for your bank, your cloud storage, and most other services. If the attacker hasn't already taken it:

• Log in from another device immediately and change your password.
• Add or switch two-factor authentication (2FA) to an authenticator app (Google Authenticator, Authy, or a hardware key) instead of SMS, since SMS is exactly what's compromised.
• Check "recent activity" or "sign-in history" for unfamiliar locations or devices, and sign out of all active sessions.
• If you're already locked out, go straight to your provider's account-recovery flow (Google, Microsoft, Apple, Yahoo all have dedicated "account compromised" recovery pages) and flag it as a suspected takeover.

Minutes 15–30: Call Your Telecom Carrier

This is the single most time-sensitive call you will make. Every major carrier has an emergency fraud line, save these now, before you ever need them:

• MTN (180), 
• Airtel (111), 
• Glo (121), 
• 9mobile (200) 

Each operate customer fraud escalation lines; ask specifically for "SIM swap" or "unauthorized port" escalation, not general support

What to say, exactly:

"I believe my SIM has been fraudulently swapped or ported without my authorization. I need this escalated to your fraud or security team immediately, and I need my number restored to my possession and locked against further changes."

What to demand from the representative:

• Immediate suspension of the fraudulent SIM
• Restoration of service to your legitimate device
• A port freeze or PIN lock placed on your account (sometimes called a "port-out PIN" or "account PIN") to prevent it from happening again
• A case or ticket number — write this down, along with the representative's name and the time of the call
• Ask them to check whether any calls were forwarded or additional lines/eSIMs were added to your account during the compromise window

If the first representative can't help, ask explicitly to be transferred to the fraud department, not general retention or billing — front-line reps are often not equipped to handle active swap incidents.

Minutes 30–45: Call Your Bank(s)

Do this even if you haven't seen unauthorized transactions yet, the attacker may already be inside and simply hasn't moved money, or may be waiting for a lull.

• Call the fraud or lost-card line on the back of your card or on the bank's official app (never a number from a text message you received during this incident).
• Tell them: "My phone number has been compromised in a SIM swap attack. I need my accounts flagged for enhanced monitoring and any SMS-based authentication temporarily disabled or switched to app-based verification."

Ask them to:

• Freeze or restrict outgoing transfers and new payee additions
• Reissue cards if debit/credit numbers may be exposed
• Review recent login and transaction activity with you on the call
• Flag the account with a verbal password or enhanced ID verification for any future changes

Repeat this for every financial institution tied to your compromised number, checking, savings, credit cards, brokerage, and especially **cryptocurrency exchanges**, which are disproportionately targeted in SIM swap fraud and often have weaker chargeback protections than traditional banks.

Minutes 45–60: Triage Everything Else

With email and money secured, move through the rest of your digital footprint:

• Social media accounts (especially any with SMS 2FA) — switch to app-based or hardware-key 2FA
• Password manager master account, if it uses SMS recovery
• Cloud storage (iCloud, Google Drive, Dropbox)
• Any account where you can recall using SMS 2FA — a password manager's history or your memory is your guide here

After the First Hour: Formal Reporting

Once the bleeding has stopped, formalize the paper trail, this matters both for fraud disputes and for any potential legal or insurance claims.

1. File a police report. Many banks and carriers require this to process fraud claims or waive liability for losses. Ask for a copy of the report number.

2. File a complaint with your national consumer/fraud authority:

   - Nigeria: the Nigerian Communications Commission (NCC) and the EFCC's cybercrime unit

3. Notify credit bureaus and consider a credit freeze (Equifax, Experian, TransUnion in the US) to prevent new accounts being opened in your name.

4. Document everything — screenshots of unauthorized emails, the carrier ticket number, bank case numbers, and a timeline of events. Insurers and banks investigating fraud claims move faster with a clean paper trail.

The Days After: Full Recovery Checklist

• Get a new SIM with a port-out PIN or account passphrase set on file with your carrier — this is the single best defense against a repeat attack.
• Audit every account for SMS-based 2FA and migrate to authenticator apps or hardware security keys (e.g., YubiKey) wherever possible.
• Change security questions on financial accounts, since attackers who successfully social-engineered your carrier likely gathered personal details that could be reused elsewhere.
• Watch your credit report for at least 90 days, and consider extending a fraud alert.
• Rotate any passwords stored in a browser or password manager that weren't already unique and strong.

Why This Keeps Happening — and What Regulators Are Doing

SIM swap fraud has surged over the past several years as attackers have industrialized the social-engineering scripts used against carrier call centers, and as SMS-based 2FA has remained the default "quick fix" across much of the internet despite years of security researchers warning against it. Regulators have started responding: the FCC in the US finalized rules requiring carriers to authenticate customers before processing SIM changes or number ports, and several carriers now offer free port-freeze features that were previously buried in support menus. Enabling these proactively, before you're ever targeted, is the single highest-leverage step an ordinary person can take.

The Bottom Line

A SIM swap attack is a race, and for the first hour, you are the only one running it. Email first, then telecom, then bank, then everything else, in that order, because each one is the master key to the next. Once the emergency window has passed, the slower work of reporting, freezing credit, and rebuilding your authentication setup with app-based 2FA turns a genuinely frightening experience into a resolved one.

The attackers are counting on confusion and delay. The single best thing you can do today, before any of this ever happens to you, is call your carrier right now and ask them to place a port-out PIN on your account. It takes five minutes and it is, by a wide margin, the cheapest insurance policy in your entire digital life.