Recommended Free Tools
Act in this order: call your mobile carrier from a trusted phone and recover the number, secure your primary email, contact financial institutions, preserve evidence, and report the identity theft. A fraudulent SIM change or port-out can let an attacker receive password-reset texts and calls, so every minute before those access paths are closed increases the risk to email, banking, social, cloud, password-manager and cryptocurrency accounts.
This guidance is written mainly for people in the United States because it refers to FTC, FCC, CFPB, FBI and IC3 processes. Carrier procedures, reporting agencies and credit-bureau rules differ in other countries.
As an Amazon Associate I earn from qualifying purchases.
What to do in the first hour
1. Take back the phone number
Use a trusted phone, a landline or an in-person carrier store rather than the possibly compromised handset. Tell the representative that an unauthorized SIM change or port-out occurred. Ask for all of the following:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Reverse the unauthorized SIM change or port-out and restore your number to a SIM or eSIM you control.
- Record the exact time the change occurred, when service was restored, and the case or incident number.
- Reset the carrier-account PIN or password and remove any unfamiliar authorized users, contact details or recovery methods.
- Ask whether the account can receive a SIM-change lock, port-out lock, number-transfer lock or real-time notification for future requests.
- Request written confirmation of the corrective action if the carrier provides it.
The Federal Trade Commission’s instruction is direct: “Contact your cellular service provider immediately to take back control of your phone number.” Do not wait for a callback or an email; an attacker may be receiving both.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
2. Secure your primary email before other accounts
Your main email account is usually the reset hub for every other service. From a trusted connection, change its password to a unique one that has never been used elsewhere. Then work through the account’s security page:
- Sign out every session or device you do not recognize; when possible, choose the option to sign out everywhere.
- Delete unfamiliar recovery email addresses, phone numbers, passkeys, authenticator devices and backup codes, then add your own recovery methods.
- Revoke unknown third-party applications, OAuth grants, API keys and app-specific passwords.
- Check forwarding rules, filters, delegated inbox access and automatic replies. Remove anything that silently copies or hides security messages.
- Replace SMS-only multifactor authentication (MFA) with an authenticator app or a FIDO2/WebAuthn hardware security key after confirming that you can recover the account.
Save newly generated backup codes offline. Do not store them in the compromised email account or in an unprotected note on the affected phone.
3. Call financial institutions using trusted contact details
Call banks, credit unions, card issuers, brokerages, payment services and cryptocurrency platforms using the number printed on a statement, the back of a card or the institution’s official app. Do not use a number sent by text or supplied by a caller. Tell the fraud department that your phone number was taken over and ask it to:
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →- Place an account takeover or fraud alert on every affected profile.
- Review recent logins, password resets, new payees, transfers, card additions and changes to contact information.
- Freeze or replace exposed cards and disable digital-wallet tokens that you did not create.
- Temporarily restrict outgoing wires, ACH transfers, instant payments and cryptocurrency withdrawals while the investigation is open.
- Recall or reverse unauthorized transfers and provide a written case number.
If a wire transfer is fraudulent, the Internet Crime Complaint Center says to report it immediately to both your bank and ic3.gov. Fast reporting gives the bank the best chance of contacting a receiving institution before funds move again.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
4. Preserve evidence before deleting anything
Take screenshots and export records while they are available. Keep the original files and a second copy in a safe location. Useful evidence includes carrier emails and text alerts, the time your phone lost service, account-security notifications, device and session lists, password-reset messages, suspicious phone numbers, transaction records, wallet addresses, screenshots and every carrier or bank case number. Do not delete an attacker’s messages before saving them; their headers, timestamps and links may help investigators.
Why a SIM swap is an account-takeover emergency
A SIM swap moves your mobile number to a SIM or eSIM controlled by someone else. A port-out transfers the number to another carrier. In either case, calls and text messages intended for you can reach the attacker. The FCC explains that a completed fraudulent swap or port-out can expose authentication messages and enable takeovers of financial, social-media and email accounts.
The number itself does not give an intruder your bank balance. The danger is the reset chain: an attacker requests a password reset, receives the SMS code, enters the account, changes the password or recovery details, and then uses that account to reach others. They may also impersonate you when calling a bank or family member. The FCC recorded approximately 300 SIM-swap complaints in 2020, 400 in 2021 and 500 in 2022; those figures are U.S. complaints reported by the FCC in 2023, not a count of every incident.
Lock down accounts in a deliberate order
Email and password manager
After the primary email, secure your password manager. Change its master password from a trusted device, terminate unknown sessions, rotate any exposed emergency-access or recovery codes, and inspect the vault’s sharing and activity logs. If the password manager uses SMS for recovery, replace that method and verify that a security key or authenticator app works before removing the old option.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Cloud storage and devices
Review cloud sign-ins, connected computers and mobile devices. Remove unknown devices, revoke unfamiliar application access, and inspect sharing links for documents, photographs and backups. Change the passwords for the operating-system account and the device manufacturer account if either used the compromised email or phone number for recovery. Install pending security updates only after the account is secured; updates cannot undo an attacker’s session.
Social, messaging and work accounts
Change passwords on social networks, messaging services, workplace systems and developer tools. Check direct messages, posts, mailbox rules, connected apps, administrator roles, API tokens and recovery contacts. Warn contacts that messages sent during the takeover may be fraudulent. For a work account, notify the security or IT team immediately so administrators can revoke sessions and tokens centrally.
Cryptocurrency and other irreversible-payment accounts
Prioritize exchanges, wallets and payment services that allow rapid or irreversible withdrawals. Change credentials, revoke API keys, remove unfamiliar withdrawal addresses, disable automated trading and move remaining assets only through a verified recovery process. Record wallet addresses and transaction IDs for investigators. Never send a “verification payment” to someone claiming to recover your account.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsCan a SIM swap drain a bank account?
Yes, it can enable unauthorized transfers, but it does not automatically withdraw money. The attacker must still pass the bank’s controls or exploit an existing logged-in session, a weak password, a reset process or a trusted-device approval. Once the number is restored, ask the bank to examine the entire period from the first loss of service, not merely the transactions you noticed.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Review checking, savings, credit-card, brokerage, loan and payment accounts for new beneficiaries, linked accounts, changed limits, new cards, address changes, password resets and transfers. Ask whether the institution can place a temporary hold on outgoing payments and whether electronic-transfer protections or dispute deadlines apply. Keep a timeline of every call and submit written disputes through the institution’s prescribed channel.
Report the crime and start identity-theft recovery
Federal reports
Use IdentityTheft.gov to create an FTC recovery plan and document the identity-theft report. File a report with ic3.gov, especially when money moved, a cryptocurrency wallet was involved or the attacker used online infrastructure. Contact local law enforcement or an FBI field office when the loss, threats, impersonation or investigative needs warrant it. Give each agency the same concise timeline and copies of your evidence.
Credit reports, fraud alerts and freezes
Obtain your free credit reports and look for accounts, inquiries, addresses and collection activity you do not recognize. If Social Security or other identity data may have been exposed, follow the IdentityTheft.gov plan and monitor new-account activity.
| Protection | How it works | Effect on legitimate applications |
|---|---|---|
| Credit freeze | Restricts prospective creditors from accessing your file until you lift the freeze with the bureau’s process. | Most restrictive; you must temporarily lift it before applying for new credit, often with a PIN or online account. |
| Fraud alert | Asks creditors to take additional steps to verify your identity before opening new credit. | Less friction than a freeze, but it does not block access to the file or guarantee that a fraudulent account cannot be opened. |
A freeze is generally the stronger choice when you do not expect to apply for credit soon. A fraud alert may be more convenient when you need frequent legitimate applications. Follow each bureau’s current instructions and keep confirmation numbers.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
What to do if the carrier will not restore the number
Ask for escalation to the carrier’s fraud or number-porting team and keep the incident number. Request the date, time and destination carrier associated with the change, if the carrier can disclose them. Continue securing accounts through email, an authenticator app or a security key rather than waiting for SMS service. Tell banks and other institutions that the number remains compromised so they can suppress text-based resets. If your number cannot be recovered, ask the carrier about obtaining a replacement number and update every account’s recovery information only after the new number is protected.
Prevent another takeover after recovery
Harden the carrier account
Set a unique carrier PIN or password that is not reused online. Ask which SIM-change, port-out and account-takeover locks are available, how they are enabled, and which notifications are sent. FCC rules require wireless providers to use secure customer authentication before redirecting a number and to notify customers when a SIM change or port-out request is made. Turn on every notification that the carrier offers and treat an unexpected alert as an emergency.
Replace SMS MFA on high-value accounts
SMS is convenient but not SIM-swap resistant: the code follows the number. An authenticator app generates codes on a device you control, while a FIDO2/WebAuthn hardware security key signs in only when the physical key is present. The FBI’s guidance is unequivocal: “A physical security key is even better” than an authenticator app for two-factor authentication.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →| Method | SIM-swap resistance | Phishing resistance | Recovery and backup | Device support and cost |
|---|---|---|---|---|
| SMS code | Low; the code can be diverted with the number. | Low; users can be tricked into reading the code. | Easy when the number works, difficult during a swap; carrier recovery is the fallback. | Works on nearly every phone; normally no separate hardware cost. |
| Authenticator app | High if the secret remains on your device and is not backed up to the compromised number. | Medium; a real-time phishing site can still relay a code. | Moderate; keep printed or offline backup codes and enroll a second trusted device. | Requires a compatible phone or computer; usually free. |
| FIDO2/WebAuthn hardware key | Very high; possession of the key is required instead of a phone number. | Very high because the key binds authentication to the genuine site. | Plan ahead: register two keys or another recovery method and store the spare securely. | Requires service support and a USB, NFC or Bluetooth-compatible device; purchase cost varies by key. |
Use at least two recovery paths for important accounts: for example, a primary security key plus a separately stored backup key, or an authenticator app plus offline codes. Test sign-in and recovery while you are still logged in. A method that has never been tested may fail when the original phone is unavailable.
Quick Recap
Monitoring during the next several weeks
- Check bank, card, brokerage, payment and cryptocurrency activity daily at first, then at a regular cadence set by the institution.
- Review email-security notices, password-manager activity, cloud-device lists and social-account sessions for new changes.
- Watch credit reports and mail for unfamiliar accounts, inquiries, addresses, collection notices or replacement cards.
- Keep carrier and financial case numbers together with your timeline until every dispute is closed.
- Tell close contacts and employers how to verify an urgent request from you through a channel other than the compromised number.
Mistakes that make recovery harder
- Waiting to see whether service returns instead of calling the carrier immediately.
- Using a reset link or phone number sent by an unknown caller or text message.
- Changing only one password while leaving recovery email addresses, forwarding rules, sessions and API keys untouched.
- Deleting alerts, chat messages or transaction records before exporting evidence.
- Relying on SMS as the only MFA and storing every backup code in the same email account.
- Assuming a quiet bank account proves the incident is over; attackers may wait, create payees or target another service later.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
