Can Someone SIM Swap You with Just Your Name and Address?

15 October 2026

No. A SIM swap cannot be carried out with only your name and address. While those two pieces of information are part of what an attacker might gather, they are not sufficient on their own to convince a carrier to transfer your phone number to a new SIM card. A successful SIM swap requires either a convincing set of identity verification details or the exploitation of a carrier support agent through social engineering. Name and address alone are the starting point, not the weapon.

What else an attacker needs

Carriers use a multi-point verification process when a customer requests a SIM replacement. The exact requirements vary by provider, but they generally include some combination of the following:

• Account number or phone number - The attacker already has the number they want to steal, but they also need to prove they are the account holder.
• Date of birth - Often used as a primary identity check.
• Social Security Number (or last four digits) - In the U.S., this is a common verification hurdle.
• Account PIN or passcode - Many carriers let you set a dedicated account PIN that must be given before any SIM change.
• Billing address or ZIP code - This is where your name and address come in, but it is rarely the only check.
• Answers to security questions - Mother's maiden name, previous address, or other personal trivia.
• Recent account activity details - Last payment amount, date of last top-up, or recent call records.

If an attacker only has your name and home address, they will be stopped at the first real verification gate. They need more. That is why SIM swap attacks are almost always preceded by a data gathering phase.

How attackers get the rest

The attacker who has your name and address is not done. They will try to fill in the missing pieces through several common methods:

1. Data breaches and dark web databases

Your date of birth, SSN, and account numbers may already be for sale if you have been part of a major breach. Name and address let the attacker look up your records in leaked databases. Services that aggregate breach data are routinely used by attackers to cross-reference a name and address against known leaks.

2. Phishing for carrier credentials

With your name and address, an attacker can craft a convincing phishing email or text that appears to come from your mobile carrier. The message might ask you to "verify your account" by entering your PIN, SSN, or date of birth. If you comply, they get the missing pieces.

3. Social engineering the carrier

A skilled attacker may call your carrier's support line pretending to be you. They already know your name and address. If they can guess or research your date of birth and answer a weak security question, they may convince a poorly trained agent to authorize a SIM swap. This is not a guaranteed method, but it works often enough to be a real threat.

4. Insider threats or corrupt retail employees

In rare cases, an attacker may bribe or collude with a carrier employee who can bypass verification checks. Name and address alone are still not enough in this scenario - the employee still needs to identify your account in the system - but the attacker may only need to provide enough information for the employee to locate and reassign the number.

Why name and address are still dangerous

While name and address cannot complete a SIM swap by themselves, they are the key that unlocks the rest of your personal data. An attacker who knows where you live and what your name is can:

• Search public records for your date of birth
• Find your phone number through online directories or data broker sites
• Use your address to answer "previous address" security questions on other accounts
• Impersonate you to utility companies, banks, or government agencies to gather more information

In other words, name and address are the foothold. The attack does not stop there, but it cannot start without them.

What You Can Do to Make Yourself a Hard Target

Since name and address are difficult to keep private (they are in public records, on mail, and often online), the sensible approach is to reinforce the defenses that sit between that information and a successful SIM swap.

• Set a carrier account PIN or passcode. This is the single most effective barrier. Even if an attacker knows your name, address, date of birth, and SSN, they cannot authorize a SIM swap without the PIN. Do not use a PIN that is your birthday, anniversary, or any number that can be guessed from your personal data.
• Enable carrier-level number locks. Verizon's Number Lock, AT&T's Port Protection, and T-Mobile's Account Takeover Protection are free features that prevent SIM changes without explicit approval. They are covered in detail elsewhere on this site.
• Use a dedicated email address for financial accounts. If your phone number is compromised, an attacker who also has access to your main email can reset passwords and drain accounts. A separate email for crypto exchanges and banking limits the damage.
• Remove your phone number from crypto exchange accounts where possible. Many exchanges now allow you to use an authenticator app or hardware security key instead of SMS. This severs the link between your phone number and your funds.
• Monitor for warning signs. If you suddenly lose cellular service, see "No Service" or "SOS Only" on your phone, or receive unexpected texts about a SIM change request, act immediately. Contact your carrier from another phone and lock down your accounts.

The Bottom Line

Name and address are not enough to SIM swap you. But they are enough to start an attack that can succeed if your carrier's verification is weak or your other personal details are already exposed. The defense is not to hide your name and address - that is nearly impossible - but to add strong, independent barriers like a carrier PIN and number lock that no amount of personal information can bypass.

Back to sim swaps