SIM Hijacking Definition and How It Differs from Port-Out Fraud

30 October 2026

SIM hijacking and port-out fraud are two methods attackers use to take control of your phone number, but they work differently. SIM hijacking involves an attacker tricking or coercing your mobile carrier into transferring your number to a new SIM card in their possession. Port-out fraud, by contrast, uses stolen personal information to move your number to a different carrier entirely. Both give the attacker access to SMS-based two-factor authentication (2FA) codes and account recovery links, but the mechanics, detection signs, and prevention tactics differ.

What is SIM hijacking?

SIM hijacking - also called SIM swapping or SIM swapping attack - occurs when a criminal convinces your carrier’s customer support or retail staff to activate a new SIM card on your existing account. The attacker typically provides some personal details they have gathered about you, such as your name, address, date of birth, or the last four digits of your Social Security number. Once the carrier activates the new SIM, your phone loses service, and the attacker’s device receives all calls and texts intended for your number, including 2FA codes.

The attacker does not need physical access to your phone. They exploit carrier processes designed to help legitimate customers replace lost or damaged SIMs. The attack succeeds when a support agent bypasses security checks, often through social engineering - pretending to be you, claiming to have lost their phone, or using a fake ID at a store.

What is port-out fraud?

Port-out fraud - also known as number porting or unauthorized port-out - is a different method. Here, the attacker uses stolen identity information to open a new account with a different carrier and request that your phone number be transferred to that account. Under U.S. regulations, carriers must port numbers within one business day upon request from the new provider, which gives attackers a narrow window to act.

The attacker needs enough personal data to pass the new carrier’s identity verification. This often includes your name, address, Social Security number, and sometimes answers to security questions from data breaches. Once the port completes, your original carrier cancels your service, and the attacker controls your number on the new network.

Key differences between SIM hijacking and port-out fraud

Target of the Attack

• SIM hijacking: Targets your existing carrier’s internal processes. The attacker works within the same carrier, convincing its staff to issue a new SIM on your account.
• Port-out fraud: Targets a different carrier. The attacker opens a new account elsewhere and transfers your number away from your current carrier.

Information Required

• SIM hijacking: Often needs less personal data. A name, address, and date of birth may suffice, especially if the carrier’s verification is weak. Some attacks succeed with just a name and phone number if staff are careless.
• Port-out fraud: Requires more detailed identity information - typically full name, Social Security number, and sometimes account PINs or security questions - because the new carrier must verify you are the legitimate owner.

Detection Signs

• SIM hijacking: You may see “No Service” or “SOS Only” on your phone, or receive unexpected texts about a SIM change request. Your carrier might send a confirmation code or alert before activation.
• Port-out fraud: You may get a text from your current carrier confirming a port request (often with a cancellation code), then lose service shortly after. The new carrier may also send a welcome message.

Recovery Process

• SIM hijacking: Contact your carrier immediately. They can reverse the SIM activation and restore your service if you act quickly. You may need to prove your identity with a government ID.
• Port-out fraud: More complicated. You must contact both your original carrier and the new carrier to reverse the port. This can take days, and your original carrier may require a police report or identity theft affidavit to restore the number.

Prevention Overlap

Both attacks can be blocked with carrier-level protections like a Number Lock (Verizon) or Port Protection (AT&T), which require a PIN or additional verification before any change. Using an authentication app instead of SMS for 2FA on high-value accounts also neutralizes both threats.

Why the Distinction Matters for Security

Knowing the difference helps you recognize the attack type when symptoms appear. If your phone suddenly shows “No Service,” check whether you received a port-out confirmation text from your carrier. That points to port-out fraud. If no such text arrived, suspect SIM hijacking.

The distinction also guides prevention. SIM hijacking relies on carrier employee error, so calling your carrier to set a strong account PIN or passcode reduces risk. Port-out fraud relies on stolen identity data, so freezing your credit and monitoring data breach reports adds a layer of defense.

Practical steps to protect yourself

• Set a carrier account PIN or password that is not derived from public information. Use a unique code stored in a password manager.
• Enable carrier-level port protection if available. Verizon’s Number Lock and AT&T’s Port Protection block unauthorized transfers without your PIN.
• Use an authentication app (like Google Authenticator or Authy) for every service that offers it. SMS 2FA is the vulnerability both attacks exploit.
• Monitor your carrier alerts. If you receive a text about a SIM change or port request you did not initiate, act immediately to cancel it.
• Freeze your credit with the three major bureaus (Equifax, Experian, TransUnion). This makes it harder for attackers to open new accounts in your name, which is a prerequisite for port-out fraud.

Neither attack is inevitable, but both are persistent. Understanding the mechanics - and acting on the prevention steps - reduces your exposure to the most common account takeover vector in cryptocurrency and financial services.

Back to sim swaps