Practical defense · 1 PM tech tip
If your cell phone suddenly loses signal and only allows 911 calls, treat it as an emergency for your bank, email, and social accounts. That “phone went dark” moment is the single most reliable early sign of a SIM-swap or port-out attack, and the fastest way to limit damage is to lock the number before it happens.
Reporting cutoff: September 3, 2026, 1:00 p.m. Eastern / 17:00 UTC. This guide is a practical prevention and first-response checklist for Florida homes and small businesses. It is not legal, financial, or carrier-policy advice.
Bottom line: Your cell phone number is the master key to most of your online accounts. Anyone who can move that number to a SIM card they control can receive your one-time SMS codes and walk into your bank, email, and crypto. The FCC, FTC, and all three major U.S. carriers publish free, documented tools that make a successful attack much harder. Turn them on before you need them.[1][2]
What a SIM-swap or port-out actually does
A SIM swap is when someone convinces your carrier to move your service from the SIM card in your phone to a SIM card in their phone. A port-out is similar, but the attacker opens an account with a different carrier and has your phone number transferred there.[1] In both cases the attacker’s device now receives your texts and calls — including the one-time codes banks, email providers, and crypto exchanges send to “verify it’s you.”
Once they have those codes, they can reset your password, drain your accounts, change your email recovery, and lock you out. The FCC says the first sign is usually “loss of service on a device — the phone going dark or only allowing 911 calls.”[3] Verizon warns that in some cases you may not know your number has been moved until your phone stops working.[4]
Stop condition: If your phone suddenly shows no bars, says “SOS only,” or can only reach 911 — act on this article immediately, in this order: call your carrier from a different phone, call your bank, change passwords on a trusted device, then file a police report and an FCC complaint.[3][2] Do not assume a temporary outage is a tower problem; SIM-swap victims often lose service at the exact moment the attacker activates the new SIM.
Step 1 — Lock your number at your carrier
Every major U.S. carrier now offers a free number-port lock. Turn it on today, even if you plan to switch carriers someday. It costs nothing, takes a few minutes, and is the single strongest documented control.
Verizon — enable Number Lock
Verizon calls its port protection Number Lock. It blocks any port-out request until you turn it off. Verizon’s own page says Number Lock is free and that mobile numbers with Number Lock enabled “can’t generate a Number Transfer PIN.”[4]
In the My Verizon app: Account → Edit Profile and Settings → Security menu → Number Lock → toggle each line on → Save.
In My Verizon on the web: Account → Account Settings → Security Settings → scroll to Number Lock → Edit → toggle on → Save.
When you later want to switch carriers, return to the same screen, toggle Number Lock off, and Verizon will let the port proceed. Prepaid customers have a 15-minute wait after disabling Number Lock before a Number Transfer PIN can be generated.[4]
AT&T — enable Wireless Account Lock
AT&T’s free Wireless Account Lock disables SIM swaps, device purchases on your account, and number transfers until you unlock it. AT&T says any time a user turns the lock on or off, the primary account holder gets an email and each active wireless number gets a text.[5][6]
In the myAT&T app on a phone on the account: tap the person icon → scroll to Wireless account lock → swipe to lock.
If you have a family member who needs to make a change, they’ll have to ask you to unlock it temporarily. That friction is the protection.[6]
T-Mobile — set a transfer PIN and use account security
T-Mobile personal accounts use a Temporary Port Out PIN (TPOP) that you must give the new carrier to authorize a port.[7] T-Mobile also offers an account PIN (6–15 digits) and other authentication factors used before a SIM swap or port-out is approved.[1]
In the T-Life app or T-Mobile.com: Profile → Line Settings → request a transfer PIN whenever you actually want to move your number. Don’t share the PIN with anyone who calls claiming to be T-Mobile. T-Mobile says it “will never call or text you and ask you to turn off” account protections, and neither will AT&T or Verizon.[6]
Smaller carriers and MVNOs
If you’re on a Mobile Virtual Network Operator (Mint, Consumer Cellular, Cricket, Tracfone, etc.), the lock lives on the host network (T-Mobile, AT&T, Verizon). Log into the host network account if you can, and call the MVNO support line to ask whether it supports number-lock or port-out PIN on your behalf. The FCC adopted rules in November 2023 requiring carriers to use secure port-out authentication, but each carrier decides which control it offers.[1]
Step 2 — Remove your cell number from account recovery
Locking the number at the carrier is half the job. The other half is making sure that if an attacker does take over your number, they can’t use it to walk into the rest of your life.
Google: turn your phone number into a recovery option, not the only one
Open myaccount.google.com → Security & sign-in → Recovery phone. Replace your cell number with a number you actually control in a different way (a home landline, a family member’s phone, a hardware security key, or a passkey). Google explicitly warns against using a Google Voice number as a recovery phone, because Google Voice recovery codes can lock you out of your own account.[8]
If you change your recovery phone, Google may keep the old number on file for up to 7 days for verification — that window is a feature, not a bug. It lets you lock an attacker out even if they trigger a reset during the change.[8]
Apple: add a non-iPhone trusted number
Apple’s own trusted-number guide says: “If your iPhone is your only trusted device and it’s the only device that has access to your trusted phone number, you won’t be able to receive verification codes required to access your account if it’s missing or damaged.”[9]
On your iPhone: Settings → your name → Sign-In & Security → Two-Factor Authentication → add a trusted phone number that is not your iPhone’s line (a spouse’s phone, a landline, or a work number).
In a browser: account.apple.com → Sign-In and Security → Account Security → Trusted Phone Number → add or remove.
Move critical MFA off SMS entirely
The FTC explicitly warns that “text message verification may not stop a SIM card swap,” and recommends an authenticator app or hardware security key for accounts with sensitive personal or financial information.[2] Switch your bank, email, brokerage, and crypto exchange to an authenticator app (Authy, Google Authenticator, Microsoft Authenticator) or a hardware key (YubiKey, Titan). Keep SMS only as a backup.
Step 3 — Reduce the personal data an attacker can use
SIM-swap attacks start with someone convincing your carrier’s agent that they are you. The agent checks a few public-record-style questions: full name, address, last four of your Social, mother’s maiden name, recent device or phone model. Anything that answers those questions is fuel for the attack.
- Stop oversharing on social media. The FTC recommends limiting your full name, address, and phone number on public sites, because an identity thief can use them to “answer the security questions required to verify your identity.”[2]
- Don’t reply to calls, emails, or texts that ask for personal information — even if the caller ID says your carrier. The FTC calls these phishing attempts, and they’re how attackers harvest the answers they need.[2]
- Enable email and text notifications for important accounts so you see suspicious logins and account changes immediately, as the FCC recommends.[3]
- Treat data breaches as a port-out risk, not just a password risk. The FCC notes that breaches expose the information that makes SIM-swap and port-out fraud easier.[1]
If it happens — the first-hour checklist
Call your carrier from a different phone. Ask them to disable any active port, suspend SIM changes, and reattach your number to your SIM or eSIM.
Call your bank and any crypto or brokerage account. Tell them your phone number was just hijacked and ask them to lock withdrawals, require in-branch identity verification, and replace any SMS-based MFA.
Change passwords from a trusted device — a laptop on a different network, not the phone that just lost service.
File a police report and an FTC identity-theft report at IdentityTheft.gov. The FCC’s tip card lists filing a police report as one of the three first moves, alongside calling your carrier and your bank.[3][10]
Tell the people you trust. Attackers often text your contacts while they hold your number. A heads-up now prevents your mother from wiring money to “you” in a hotel.
Florida-specific next steps
If the SIM swap leads to fraudulent accounts or misuse of your Florida driver-license number, MyFloridaLegal’s Identity Theft Victim Kit walks residents through bank notifications, credit-bureau alerts, and law-enforcement reports.[11] Florida residents can also ask the FLHSMV Fraud Section to place a flag on their Florida driver license if they’re a victim of identity theft; that flag helps prevent someone else from using your license number.[11]
For cybercrime incidents, FDLE directs victims to the FBI Internet Crime Complaint Center (IC3) at complaint.ic3.gov.[12] If your compromised identity has been used in a Florida arrest record, FDLE’s Compromised Identity Services can run a fingerprint-based review.[13] Florida also operates a toll-free fraud hotline — 1-866-9-NO-SCAM (1-866-966-7226) — through the Office of the Attorney General.[11]
The IT Guys serves Port Saint Lucie, Jensen Beach, Fort Pierce, and Vero Beach. If you live or work on the Treasure Coast and want hands-on help walking through these carrier and account settings, give us a call — we can walk through the steps with you on your own device, on your own accounts.
What remains unknown
- The FCC adopted its SIM-swap and port-out rules in 2023, but each carrier picks which specific authentication factor it accepts — and attackers adapt.[1]
- No public source tracks how many port-out attacks succeed each year, so the published numbers (often cited in industry briefings) are not a verified incident count.
- Google’s 7-day hold on a new recovery phone is a safety feature, but it also means a forgotten phone number change can lock you out — keep your recovery phone in a place you can update.
- Some smaller carriers and MVNOs route port-out authentication through their host network, but not all surface the host’s lock switch to the end user. If your carrier doesn’t list the option, call and ask.
Will enabling Number Lock or Wireless Account Lock stop me from switching carriers?
No — it only stops an unauthorized port. When you’re ready to switch, you turn the lock off, generate a Number Transfer PIN if your carrier uses one, and complete the port normally. Verizon notes prepaid customers have a 15-minute wait after disabling Number Lock before a Number Transfer PIN can be generated.[4]
What if my phone number is my only recovery option for everything?
Add a second trusted number now. Apple explicitly warns against relying only on your iPhone’s number as your trusted phone number.[9] Google says to add a number that “belongs only to you” and that you “use regularly and keep with you.”[8] A hardware security key or passkey is stronger than any phone number.
Is SMS-based two-factor authentication still safe with Number Lock on?
It’s safer, not safe. The FCC and FTC both recommend moving critical accounts off SMS to an authenticator app or hardware key whenever possible.[2][3] Treat SMS as a fallback, not a primary control.
What if I can’t find my account PIN or recovery email?
Start account recovery from a device you trust and on a network you trust. Google keeps your old recovery info active for up to 7 days after a phone number change specifically so you can recover if the change wasn’t you.[8] Apple’s recovery flow can take several days and can’t be sped up by contacting Apple.[9]
Sources
- FCC — “FCC Adopts Rules to Protect Consumers’ Cell Phone Accounts,” November 15, 2023.
- Federal Trade Commission — “SIM Swap Scams: How to Protect Yourself,” October 23, 2019.
- FCC Consumer Connections — SIM Swap Tip Card.
- Verizon — “Avoid Port Fraud: Unauthorized Port Outs”.
- AT&T — “Learn About AT&T Wireless Account Lock”.
- AT&T Newsroom — “AT&T Introduces Wireless Account Lock,” July 1, 2025.
- T-Mobile — “Transfer your phone number” (Temporary Port Out PIN).
- Google Account Help — “Set up recovery options”.
- Apple Support — “About trusted phone numbers and trusted devices for Apple Account”.
- IdentityTheft.gov — FTC identity-theft reporting.
- My Florida Legal — Identity Theft Victim Kit.
- FDLE — Report a Cybercrime.
- FDLE — Compromised Identity Services.
Editorial standard: every step links to the carrier, agency, or platform that documents the control. Recommendations are practical guidance, not guarantees. Always confirm the current path with your carrier or provider, since menus and policy names change.