How to Protect Against SIM-Swap Attacks

How to harden your phone account against SIM swaps: carrier PINs, port-out lock, and replacing SMS 2FA with authenticator apps.

What you'll need (prerequisites)

• Self-custodial wallet
• A second device for verification
• Block explorer (Etherscan, Solscan, etc.) familiarity

Step-by-step

1. Step 1: Understand what a SIM-swap attack is and why crypto users are targeted

   In a SIM swap, an attacker convinces your mobile carrier to move your phone number onto a SIM or eSIM they control, usually through social engineering or a bribed insider. Once they own your number, every SMS code and phone-based account reset flows to them instead of you. Crypto holders are prime targets because a single hijacked number can unlock exchange logins, email, and password resets within minutes.

2. Step 2: Remove SMS 2FA — use an authenticator app or hardware security key

   The single most effective fix is to stop using SMS for two-factor authentication. Move exchanges, email, and password managers to an authenticator app (TOTP such as Google Authenticator, Authy, or Aegis) or, better, a FIDO2/WebAuthn hardware security key. These generate or hold credentials on the device itself, so a stolen phone number becomes worthless to the attacker.

3. Step 3: Set a carrier PIN, port-out lock, and SIM-protection

   Add every account-level lock your carrier offers: a strong account PIN plus a separate number-transfer or port-out lock. In the US these are Verizon's Number Lock / SIM Protection, AT&T's Wireless Account Lock, and T-Mobile's Account Takeover Protection with a port-out PIN. These stop anyone from porting your number or changing the account without supplying the PIN.

4. Step 4: Minimize public exposure of your phone number

   Do not reuse your primary number as a recovery or 2FA contact, and keep it off public profiles, data-broker sites, and crypto forums. Consider a separate VoIP or dedicated number for the few accounts that still require a phone. The less your number is publicly linked to your crypto identity, the harder you are to find and target.

5. Step 5: Keep crypto in a hardware wallet so keys never live on the phone

   A SIM swap only reaches accounts that your phone number can unlock — it cannot touch keys held offline. Store any meaningful balance in a hardware wallet with the seed backed up offline, so even a full phone-account takeover reaches no private keys. Keep only small, day-to-day spending amounts in any phone-based hot wallet.

6. Step 6: Detect and respond fast if service suddenly drops

   A sudden, unexplained loss of cellular service ("No SIM" or "SOS only") is the classic first sign of a swap in progress. Immediately contact your carrier from another line to freeze the account, then, from a clean device, change passwords and lock down email, exchanges, and any SMS-secured accounts. Speed matters: attackers typically drain accounts within minutes of seizing the number.

Common errors and fixes

• Approval can't be revoked due to insufficient gas. Revoke transactions cost the same gas as a normal token transfer. Top up the wallet with a small amount of native gas token before revoking.
• Funds already drained. On-chain theft is generally irreversible. Document everything, file police / IC3 / Chainalysis Reactor reports, and contact the protocol team if a known exploit. CEX-side funds may be recoverable if the attacker on-ramped to a regulated exchange.
• Suspected key leak but no losses yet. Move all funds immediately to a freshly created wallet. Burn the old seed. Audit every device the seed touched (browser extensions, cloud backups, email).
• Cannot identify the malicious contract. Use Etherscan's "advanced filter" to filter by token approvals and unusual contract calls. Run the suspicious tx through Tenderly to decode the call.
• Phishing email looks real. Always verify by typing the URL manually. Real exchanges and protocols never email asking for seed phrase, password, or 2FA codes — full stop.

FAQ