SIM Swapping: The Phone-Number Attack That Beats Your Password
SIM swapping defeats any account that uses SMS for recovery or two-factor. Here is how the attack works, what the 2024 FCC rules require carriers to do, and the concrete steps that stop it from reaching your gaming accounts.
Your phone number is a password you did not choose, and you cannot change it on a whim. A SIM swap is what happens when someone else convinces your carrier to hand it to them anyway.
The FTC describes the mechanics directly: the scammer calls your carrier, claims your phone was lost or damaged, and asks them to activate a new SIM connected to your number on a phone the scammer owns. If the carrier believes the story, every call and text — including every two-factor code and password-reset link — now goes to the attacker's phone. Your own phone just goes quiet.
Why this matters for gaming accounts
A SIM swap does not give the attacker your phone's files or your passwords. What it gives them is every account that uses SMS as a recovery method or second factor. For a lot of players, that is the reset path into Steam, PlayStation, Xbox, email, and anything linked to them. A strong password does not stop it, because the attack never touches the password.
The rules changed in 2024
The good news is that this is no longer a free-for-all. The FCC adopted rules in late 2023 — published in the Federal Register — that took effect January 8, 2024, with carrier compliance due July 8, 2024. Under them, carriers must:
- authenticate you before any SIM change or port-out using methods that do not rely on readily available biographical data — your date of birth, address, last four digits, or recent payment history;
- send you an immediate notification before completing a swap or port;
- offer a free port-out lock and SIM change lock on every line, including prepaid.
The FTC's consumer advice predates the rules but makes the same practical point: the lock and the PIN are your first line of defence, and SMS is the weakest second factor.
What to actually do
The rules only help if you turn the protections on — most carriers do not enable the locks by default.
- Turn on your carrier's port-out lock and SIM lock today. This is free on every major US carrier. In most cases you can enable it in the carrier's app or website, or by calling and asking for it by name — and ask for a case number so there is a record.
- Set a carrier account PIN that is not guessable. Not your birthday, not the last four of anything public. Treat it like a password.
- Move your important accounts off SMS 2FA. Use an authenticator app or a security key instead. On gaming platforms specifically: Steam Guard Mobile Authenticator, Discord's authenticator-app or passkey option, and PlayStation's authenticator-app or passkey. The FTC says it outright: text-message verification may not stop a SIM swap, so use an authentication app or security key where you can.
- Do not broadcast your inventory or your number. The less biographical data and the less visible value you present, the harder the social-engineering call becomes.
If your phone just went dead
If you lose service somewhere you normally have a signal — no calls, no texts, no data — treat it as a SIM swap until proven otherwise, not a dead cell tower. The FTC's steps are: contact your carrier immediately from a different phone or in person and get the number back, then check your financial accounts for unauthorised activity, and change your passwords once you have regained control. Speed matters — most of the damage happens in the first hours, while you are still trying to figure out why your phone stopped working.
Sources
Threat Intelligence Snapshot
Last updated: October 17, 2026
Active threat
security
This in-depth threat intelligence report covers the latest security research, attack vectors, and mitigation strategies. Read the full analysis below for detailed recommendations and real-world implications.