Your phone figure is the skeleton key to your digital life, and carriers have spent years handing out copies to anyone alongside a decent script. Resetting a financial institution password, recovering an email account, approving a crypto withdrawal: All of it can run through a content communication sent to a figure that a call-center rep can reassign in minutes.
The fine news is that all three important U.S. carriers now let you fastener your figure alongside a toggle. Here's how the attacks activity and anywhere to discover all switch.
How SIM swaps and eSIM hijacking work
A SIM toggle starts alongside research. Attackers collect your name, address, and document particulars from data breaches or phishing, afterward communication your transporter pretending to be you. If they convince person to move your figure onto a SIM they control, your calls, texts, and two-factor codes go to them instead. A near related is port-out fraud, anywhere the attacker opens an document alongside a distinct transporter and arranges for your figure to be transferred there.
The measure is difficult to pin down, but the FBI's Internet Crime Complaint Center logged 982 SIM toggle complaints and concerning $26 myriad in losses in 2024, downward from 2,026 complaints and $72.7 myriad in 2022. That decrease looks encouraging, but the figures lone contain crimes that victims bothered to study to one national portal.
eSIMs removed the synthetic card, not the feeble link. Researchers at the Russian resolute F.A.C.C.T. established that attackers now interrupt into a victim's transporter account alongside taken or leaked credentials, create a QR code, and scan it on their own device. Your lawful SIM is deactivated at the identical moment. There's no shop sojourn and no phone call to a rep.
Intel 471 additionally flagged a provider that let the activation code go to email alternatively of SMS, which gave attackers a second inbox to compromise. That provider has since closed the loophole, but the instruction stands: Every shortcut for locked-out customers is additionally a shortcut for criminals.
What SIM locks and port-out PINs really do
Carriers now recommendation three overlapping defenses. A SIM fastener blocks SIM or eSIM changes and equipment upgrades; a port-out fastener stops your figure from moving to another carrier; and a PIN adds a password inspect whenever you communication client assistance or petition a transfer.
I'd treat the PIN as the weakest of the three. PINs aren’t bulletproof since business reps can motionless override them. A fastener that grays out the choice entirely is much harder to conversation your way around.
In its 2023 order, the FCC instructed wireless providers to recommendation customers a liberated document fastener and to notify them of SIM alter and port-out requests. Compliance deadlines were pushed rear until national paperwork assessment finishes, though, so don't assume all transporter has implemented these features fully.
How to fastener your figure on AT&T
AT&T bundles everything into a sole toggle called Wireless Account Lock. According to AT&T's assistance page, it blocks equipment upgrades, SIM and eSIM swaps, IMEI changes, figure changes, transfers to another carrier, and edits to authorized users and billing info. You can motionless pay your bill, alter plans, and unlock a device.
To rotate it on (postpaid):
Open the AT&T app on a equipment that's energetic on your wireless account, and sign in.
Tap the individual icon.
Scroll to Wireless document lock.
Swipe to lock.
Prepaid customers prosecute a distinct path: Sign in, choose your number, tap Profile & Settings, afterward Account Info & Preferences, and choose Turn on under Wireless Account Lock. AT&T texts a one-time code to confirm.
Only users alongside chief or secondary admission can flip the switch, and AT&T emails the document holder and texts all energetic figure whenever the fastener changes. I akin that. A silent alter is the entire item of these attacks, so noisy notifications are fractional the defense.
How to fastener your figure on Verizon
Verizon splits the job in two. SIM Protection blocks unauthorized SIM and equipment changes, during Number Lock blocks your figure from being transferred to another carrier. Verizon's own records notes that Number Lock solitary doesn't forestall SIM cardstock changes, so you desire the two switched on.
To allow them:
Open the My Verizon app.
Tap the Me tab, afterward Edit overview and settings.
Find SIM Protection and toggle it on for all row you desire covered.
Find Number Lock and do the same.
After you disable SIM Protection, SIM changes and upgrade orders remain blocked for another 15 minutes. And if you always harbor out, Number Lock must be off before you can create a Number Transfer PIN. Two toggles is slightly additional homework than AT&T's sole switch, but it lets you fastener the figure during leaving equipment upgrades open, which is helpful if you toggle phones often.
How to fastener your figure on T-Mobile
T-Mobile additionally uses two features. SIM Protection blocks SIM and eSIM changes, and Port Out Protection blocks transfers to another carriers. Both are free.
To allow SIM Protection on a postpaid document in the T-Life app:
Tap the Manage tab, afterward the equipment icon.
Select Security, afterward SIM Protection.
Toggle safety for the entire document or for idiosyncratic lines.
Tap Save Changes, afterward Continue.
Port Out Protection plant alternatively since it's an add-on you use to all row separately. In T-Life, go to Manage, afterward See Plans, afterward Manage add-ons, and inspect the box next to Port Out Protection. Repeat for all row on the account.
On T-Mobile's side, authorized users can add either feature, but lone the Primary Account Holder can eliminate them. The per-line setup is tedious on a big family plan, although it's value the ten minutes. T-Mobile additionally recommends environment an document PIN of 6 to 15 digits, which you can lone alter from the chief holder's phone during on T-Mobile's network alongside wifi off.
What these locks don't cover
A fastener protects against changes made through your carrier—it doesn't defend against person who already has your transporter login, who power be capable to toggle it off.
AT&T at smallest requires its app on a equipment energetic on your account, which raises the bar. Still, researchers propose distinctive passwords and two-factor authentication on the transporter document too.
Remember to unlock before you upgrade your phone or move an eSIM, since all transporter volition obstacle you otherwise. Flip it rear on afterward.
The bigger fix is to halt letting your phone figure defender item valuable. Switch your bank, email, and crypto accounts to an authenticator app or a passkey anywhere you can. Think of the transporter fastener as a seatbelt: You'll rarely need it, and you'll be glad it was buckled the one period you do.
