A Thief Can Take Over Her Phone Number and Reset Every Bank Password. One PIN From Her Carrier Makes It Much Harder

This article covers SIM swap fraud, where a thief takes control of someone’s phone number and uses it to access their bank accounts. The first sign is often a phone showing “No Service” for no clear reason; while it has no service, the thief’s device starts receiving her calls and texts.

That includes the one-time codes banks send to confirm a login or a password reset, and wireless accounts include a tool that makes this harder: an account PIN or number lock set up with the carrier. It takes a call or a few taps in the carrier’s app.

How a Thief Moves a Phone Number Without Touching the Phone

In a SIM swap, the thief calls the phone company, pretends to be the customer, and asks to move the number to a new SIM card. That’s the small chip that links a phone to an account, and a related scheme, called port-out fraud, has the thief ask a different carrier to transfer the number over.

Either way, the number ends up on a device the thief controls. The Federal Communications Commission has flagged this risk and says it lets bad actors intercept “text messages and phone calls used to authenticate a customer’s financial, social media and other accounts” and then “change login credentials, obtain sensitive information, drain bank accounts”.

Consumer complaints describe the same pattern. The Consumer Financial Protection Bureau received complaints in 2025. In those complaints, consumers described scams that “often led to fraudulent transactions or account takeovers, causing significant financial losses” and criticized “weak security, lack of verification, and company inaction”.

Federal Rules Now Make Carriers Verify Identity First

The FCC adopted rules targeting both schemes in a Report and Order released November 16, 2023. Wireless providers must use secure methods to confirm a customer’s identity before changing a SIM. They must notify customers right away of any SIM change request, before the change happens.

They must also offer every customer, at no cost, the option to lock or freeze the account against SIM changes. Similar identity checks, notices, and lock options apply to port-out requests. Providers must keep records of SIM change requests for at least 3 years.

Who Can Set a Carrier PIN, and What It Covers

The FCC’s lock requirement covers all wireless customers. Major carriers offer account PINs, SIM protection, and number locks. One describes its number lock as protecting a mobile number “from an unauthorized transfer”. The PIN protects only the phone account. Bank logins, email, and credit files each need their own safeguards. A PIN also does nothing if a thief already has a password from a data breach and tricks the account holder into reading out a text code.

Steps That Close the Text-Message Gap

1. Carriers let customers set an account PIN or passcode by phone or in the app, and some offer a SIM lock or number lock. A PIN that doesn’t match a birthday or a bank PIN is harder to guess.
2. Some banks and brokerages let you log in with an authenticator app or a physical security key instead of text-message codes. An authenticator app creates codes on the phone itself, so moving the number doesn’t move the codes.
3. Some brokerage and bank accounts let you add a trusted contact. That’s a person the firm can call if it suspects fraud or can’t reach the account holder.
4. The nationwide credit bureaus offer credit freezes, and you can check your credit reports regularly. In 2025 complaints, identity theft victims reported finding unfamiliar auto accounts on their credit report.

Warning Signs That a Number Has Been Taken

Common signs include a sudden loss of service, notices about account changes she didn’t make, and getting locked out of email. The FCC rules created a new signal. A text or email from the carrier about a SIM change or port-out request she didn’t ask for is one.

If it happens, the usual order is to call the carrier from a different phone, then contact banks and brokerages, then report the theft. The FTC’s IdentityTheft.gov site offers step-by-step advice that can help limit the damage, report identity theft, and fix credit. Victims who report there get a free personal recovery plan that outlines next steps. Companies also tend to ask for paperwork. In 2025 complaints, lenders advised consumers to submit police reports and identity theft affidavits.

Trade-Offs Built Into a Number Lock

A locked number also blocks legitimate moves. Anyone changing carriers has to turn off the lock first. One carrier issues a separate Number Transfer PIN, a temporary code given to the new carrier when the number moves. A forgotten PIN can slow down a real switch or a lost-phone replacement. The FCC rules also include exceptions for domestic violence situations under the Safe Connections Act, so some requests follow different procedures.

The PIN also depends on carrier staff asking for it every time. That’s why the FCC requires the notices before a change. Those alerts give the customer a chance to stop a request she didn’t make. Combining the PIN with an authenticator app means a stolen number alone is no longer enough to reset a bank password.

Setting the account PIN and turning on the number lock takes one call to the carrier.

Contact [email protected] for any questions or corrections.