SIM Swap Scams: The Warning Signs That Show Up Before You Lose Your Number

Most people find out their phone number was stolen when their phone goes silent.

No signal. No calls. No texts. They assume it’s a network issue. They restart the phone. They wait.

By the time they call their carrier, someone else has already been using their number for hours, intercepting verification codes, resetting passwords, working through their accounts one by one. Email. Bank. Crypto. Whatever was connected to that number.

The takeover happened long before the phone went quiet. And the signs were there.

What the days before a SIM swap actually look like

Here’s what victims consistently describe after the fact: in the days leading up to losing their number, small things started happening that didn’t quite add up.

A verification code arrived for an account they hadn’t tried to log into. A password reset notification from a service they hadn’t touched in months. A text from their carrier about an “account update” they never requested.

Every one of those felt like a glitch. A system message. Nothing worth investigating.

That’s not a coincidence, that’s the attack in progress.

Fraudsters don’t just call a carrier and ask to transfer a number. They spend days, sometimes weeks, working up to it. They test account recovery flows. They try to find which services have weak identity verification. They look for any gap between what a carrier knows about you and what they’re willing to accept as proof that someone is you.

Every notification you ignore gives them more time to close that gap.

By the time they make the actual call to your carrier, they’ve usually already assembled enough of your information to pass a customer service verification. Your name, your billing address, the last four of your Social data that’s been sitting in breach dumps for years. The carrier rep has no reason to doubt them. The transfer goes through in minutes.

And you find out when your phone stops working.

Why getting your number back isn’t the hard part

Most people think the goal is to recover access. Get the number back, change the passwords, done.

The problem is what happens in the window between the takeover and the recovery.

Once an attacker controls your number, they don’t just sit on it. They immediately start working through every account that uses SMS verification, because that window won’t last forever and they know it. Email first, usually. Then financial accounts. Then any platform where your email can be used to reset everything else.

By the time you’ve confirmed the SIM swap with your carrier and gotten your number restored, the attacker may have already been inside your email for two hours. Change your passwords. Removed your recovery options. Forwarded your emails to an account you can’t access.

Recovery becomes a much harder conversation than most people expect. Which is why the only version of this that ends well is catching it before the transfer completes.

The window where you can actually do something

There’s a real gap between when an attacker starts moving and when they finish. It’s not instant. They’re making calls, verifying information, waiting for callbacks. There’s friction in the process, which means there’s time, if someone’s paying attention.

Most people aren’t.

Not because they’re careless. Because there’s nothing alerting them that the friction is happening on their behalf. The verification codes that show up uninvited, the carrier activity alerts, the password resets from services they haven’t touched,  these all look exactly like spam. Routine system noise.

The difference between a person who catches a SIM swap attempt and one who doesn’t is almost never skill or awareness. It’s whether they had something helping them connect the dots in real time.

 

What dfndr security’s Phone Theft Alert does

dfndr security’s Phone Theft Alert feature is built around exactly this window.

It monitors for suspicious activity around your device and phone number, the kind of low-level movement that typically precedes an account takeover, and surfaces it before it becomes something you’re trying to recover from. Not a breach notification weeks after the fact. An alert while there’s still time to contact your carrier, lock down accounts, and stop the transfer before it completes.

Because your phone number isn’t just a way to reach you anymore. It’s the verification layer sitting underneath your email, your bank, your investment accounts, your healthcare portal. One number, dozens of doors.

An early warning on a SIM swap attempt isn’t a minor convenience. It’s the difference between an uncomfortable hour on the phone with your carrier and weeks of identity recovery.

Download dfndr security free on Google Play

The warning signs show up before the attack succeeds. The question is whether you’re in a position to see them.

Sources: FBI Internet Crime Complaint Center (IC3) 2023 Annual Report; Federal Trade Commission Consumer Sentinel Network; PSafe security research.