Dedicated email for financial accounts to limit SIM swap damage

05 September 2026

A SIM swap gives an attacker control of your phone number. They can then reset passwords on any account that uses SMS recovery. One common outcome: the attacker finds your primary email address, resets that password too, and now owns the gateway to dozens of accounts.

You can make that outcome much harder. The idea is simple: use an email address for financial accounts that nobody can guess and that never appears anywhere public.

Why a separate email matters

Your primary email address is easy to find. It sits in LinkedIn inboxes, old forum registrations, data breaches, and your mom's contact list. An attacker who swaps your SIM can search for accounts tied to that address. They find your bank, your crypto exchange, your PayPal. They start resetting passwords.

If financial accounts use a completely different email, the attacker does not know where to look. They have your phone number. They have your primary email. But the account that holds your savings is registered to [email protected] or similar - an address they have never seen.

This is blast-radius reduction. The SIM swap compromises your phone and your primary email. It does not automatically reveal your financial accounts.

Practical setup

You need an email address that is used for nothing else. No newsletters. No social media signups. No shopping receipts. Only financial accounts.

Services like Apple's Hide My Email, Fastmail masked addresses, or SimpleLogin generate unique aliases. You create one alias per financial account. Even if one alias leaks, the attacker does not know your other aliases.

Use a different provider than your primary email. If your main email is Gmail, do not use a second Gmail address. The attacker may still target the same provider's recovery flow. A Proton Mail, Fastmail, or Tutanota address on a separate service adds friction.

Rules for the dedicated email

Never send from it. Do not use it to contact customer support. Do not reply to messages. If the address appears in a support ticket, it becomes visible.

Turn off forwarding. Do not forward financial emails to your primary inbox. The whole point is separation. Check the dedicated email manually - once per week is enough.

No recovery email at all. If the dedicated email service requires a recovery option, use a hardware-backed method or nothing. Avoid linking it back to your phone or primary email.

Use a strong, unique password. This email is a high-value target. A password manager generated 20-character random string is standard.

Enable 2FA with a hardware key or authenticator app. Do not use SMS for this email. The SIM swap is what you are defending against.

What this does not solve

A dedicated email does not stop SIM swap attacks themselves. The attacker still takes your phone number. They still compromise your primary email. You must still lock down your carrier account, use a number lock, and remove SMS as a recovery method for important accounts.

But it limits how far the attacker can pivot. They cannot easily find your financial accounts. They cannot request a password reset because they do not know where to send it.

This is to protect accounts you hold today. Do not bother moving old accounts. Create the new dedicated email, then open new accounts at your bank and exchange with that email. Close the old accounts over time.

A small operational cost for a large reduction in risk

You check an extra inbox once a week. You memorize one new address. In exchange, an attacker with your phone and your primary email gets nothing but silence when they try to reset your exchange password.

This strategy does not require a hardware wallet or advanced technical skill. It costs nothing except a few minutes to set up. It works alongside every other SIM swap defense you already use.

Keep the address private. Use it only for money. That one rule is the entire strategy.

Back to sim swaps