When the Bars Disappear and the Passwords Change: A 60-Minute Response Plan for a Hijacked Phone Number
Photo: Brion VIBBER, CC BY-SA 4.0, via Wikimedia Commons
At 2:14 on a Tuesday morning, the phone on the nightstand loses its signal. No banner worth reading, no error message — just an empty set of bars. By sunrise, the primary email password has changed, the banking app has locked itself, and a social account is broadcasting a cryptocurrency giveaway to everyone you know. This is the signature sequence of a SIM swap, and the sixty minutes that follow the first missing bar are the most consequential hour of the entire incident.
A SIM swap is not a compromise of your handset. It is a compromise of the identity check standing between your number and a stranger. An attacker convinces a retail employee or a call-center representative that they are you, and your number is ported onto a SIM card in their possession. From that moment, every six-digit SMS code, every automated call-back verification, and every 'we texted you to confirm' security layer terminates in the criminal's hand rather than yours.
Why the Attack Remains So Effective
Three conditions keep SIM swapping profitable in the United States. Phone numbers are still the default recovery channel for a large share of American email, banking, and social accounts, so control of a number is control of a master key. Porting is deliberately fast — number portability rules were written to let consumers change carriers without friction, and fraud teams must work inside that same speed. And the details needed to pass a carrier's identity check, from a billing ZIP code to a date of birth, circulate widely after years of large-scale data breaches.
Minute 0 to 10: Stabilize the Number
Do not spend this window tapping through settings looking for a fix. Move to a second phone, a landline, or a voice-over-IP line on Wi-Fi and call your carrier's fraud line directly.
Ask for a port-out freeze by name. The major carriers each offer one under a different label: a number lock or transfer PIN at Verizon, Number Lock at AT&T, Account Takeover Protection at T-Mobile. Request it in the same call, before anything else is discussed, and ask that the note be attached to the account rather than merely quoted to you. Record the representative's name, the ticket number, and the timestamp. If the first agent cannot place a lock, ask for the fraud department rather than repeating the story to general support.
Minute 10 to 25: Reclaim Your Accounts
Work in order of blast radius: primary email first, then financial institutions, then social accounts. Reset passwords from a device that is still authenticated — a tablet or laptop already signed in — rather than from a browser on a machine you do not control. Where the platform allows it, switch two-factor authentication from SMS to an authenticator app or a passkey during the same session; otherwise you will simply be re-locking the door with the same broken key. Print or store the backup codes somewhere offline.
The email account deserves particular attention. Most password resets route through it, so an attacker who still holds a recovery alias can undo your work within hours. Remove unfamiliar recovery addresses and phone numbers, revoke active sessions, and check forwarding rules for anything you did not create.
Minute 25 to 45: Contain the Financial Exposure
Call each bank and card issuer and ask for the fraud desk, not the general line. Request a verbal password on the account, flag recent activity for review, and ask whether any payee or transfer details were added during the window. Place a free credit freeze with all three credit bureaus if there is any indication that identity data was used, and set a fraud alert if a freeze feels premature.
Minute 45 to 60: Preserve the Record
File a report with your local police department, submit a complaint to the FTC at IdentityTheft.gov, and file an FCC complaint describing the unauthorized port. Ask the carrier in writing for the porting records: the time of the request, the channel used, and the information the requester provided. Screenshot every notification you received, including the ones that arrived after the number had already moved. These records are what convert a frustrating story into an investigation.
What Not to Do
Do not argue with a front-line agent for forty minutes; escalate instead. Do not post the details of the incident publicly while recovery is still in progress, since a visible timeline helps an attacker anticipate your next move. And do not reuse the password you just reset anywhere else — a swapped number frequently accompanies a broader credential-stuffing campaign.
Before It Happens
Set a carrier account PIN that exists nowhere else, enable the port-out lock now rather than during a crisis, and ask the carrier to annotate the account so that any port request requires in-person identification. Move critical accounts off SMS authentication entirely and keep printed backup codes in a locked drawer. Trim your number from public profiles and marketplace listings. None of these steps is exotic; together they raise the cost of the attack above what most opportunists are willing to pay.
The hour after the bars vanish is not a time for research. It is a time for a plan you already wrote down.
