A SIM swap moves your phone number to a criminal's phone, and with it every text code your bank, payroll provider, and Microsoft 365 send you. The fix is mostly free: a carrier lock on every company line and a move off text-message sign-in. These are the questions owners ask us most.
What is a SIM swap attack?
It's when someone convinces your carrier to move your number to a SIM or eSIM they control. Usually they call support pretending to be you, or bribe or trick a store employee.
Your phone drops to "No Service." Their phone starts getting your calls and texts, including password reset codes. A related scam, port-out fraud, moves your number to a different carrier entirely.
How common are SIM swaps?
The FBI's 2025 Internet Crime Report logged 971 SIM swap complaints and $17,366,758 in losses. That's down from 2021, when the FBI reported 1,611 complaints and more than $68 million lost.
Fewer complaints doesn't mean safe. Those numbers only count people who reported to the FBI and filed it as a SIM swap. Many victims report the bank fraud that followed instead.
Why would a criminal target a small business number?
Because your number unlocks money. The owner's or bookkeeper's cell is often the recovery number for the bank, the payroll system, and the Microsoft 365 admin account.
Take the number and you can reset passwords on all three. A ten-person firm with a weak carrier PIN is an easier target than a bank with a fraud team.
What are the warning signs?
Your phone suddenly shows "No Service" or "SOS only" where it normally has signal. You get a text or email from your carrier about a SIM change or port request you didn't make.
Password reset emails arrive that you didn't ask for. Treat any one of these as an emergency and call the carrier from another phone right away.
How do I lock my company's phone numbers?
Turn on the carrier's free lock for every line. AT&T's Business Account Lock blocks SIM or eSIM changes, upgrades, and number transfers. Verizon offers Number Lock and SIM Protection.
T-Mobile offers free SIM Protection and Port Out Protection, added line by line. Set a strong account PIN too, and don't reuse it anywhere.
Don't the carriers have to stop this now?
They have rules to follow, but you shouldn't rely on them. The FCC adopted rules in 2023 requiring carriers to use secure authentication before a SIM change or port-out, notify customers immediately when one is requested, and offer a free account lock.
Those rules raise the bar. A convincing caller can still clear it.
Does a SIM swap get around multi-factor authentication?
Yes, if your second factor is a text message or phone call. Codes go to whoever holds the number.
That's why Microsoft is retiring SMS and voice MFA in Entra ID. Authenticator app prompts with number matching or passkeys aren't tied to your number, so a SIM swap alone won't get past them.
What should I do if it happens?
Call the carrier from another phone and get the number back. Then change passwords on email, banking, and payroll, starting with whatever uses that number for recovery. Call your bank's fraud line.
Check Microsoft 365 for new sign-ins, mailbox rules, and changed MFA methods. File a report at ic3.gov. Then call your IT provider.
Should employees use personal phones for company sign-ins?
They can, as long as the factor is an authenticator app or passkey, not a text. The phone number itself shouldn't be what protects your accounts.
If you pay for staff lines, put them on a business account where you control the lock. Your help desk should verify identity before resetting anything, too.
Is my business phone system at risk too?
Yes, through a different door. Cloud phone numbers, like Teams Phone or RingCentral, can be ported out by someone who gets into the admin portal or fools the provider's support line. Protect those admin accounts with phishing-resistant MFA and ask your provider whether it offers a port-out PIN or lock.
Close the gap this week
Locking every line takes about an hour. Moving staff off text-message codes takes a little longer.
NetSys handles both as part of our managed security services. Book a complimentary risk assessment and we'll tell you which of your accounts a SIM swap could open today.
Discuss cyber security for your business.
Tell us about your current systems, the result you need and your timeline. We will discuss the work, responsibilities and pricing before you decide on an engagement.