SIM Swap Attacks: How a Separate Verification Number Limits the Damage

How a SIM Swap Attack Works

The attacker does not touch your phone. They contact your carrier, by phone, in a retail store, or through a bribed or coerced employee, and claim to be you with a lost or damaged SIM. They supply the personal details the carrier asks for: name, address, date of birth, the last four digits of a payment card, sometimes the account PIN. All of these are available from breach data and people-search sites for most adults in the United States and United Kingdom.

If the carrier accepts the story, it activates a new SIM with your number. Your handset loses signal, which is usually the first sign anything is wrong, and the attacker's handset starts receiving your calls and texts. From there they request password resets and one-time codes on every account that uses the number, prioritising anything with money or resale value: exchange accounts, bank logins, email, and social handles.

The window is short. Most victims notice the lost signal within an hour and get the number back within a day, but a prepared attacker drains an exchange account in minutes. The number is restored; the funds are not.

Cases That Show the Scale

In August 2019 the Twitter account of Jack Dorsey, then Twitter's chief executive, posted racist messages for around twenty minutes. The attackers had SIM-swapped his AT&T number and used Twitter's text-to-tweet feature, which accepted posts from the linked phone number with no further check. The account of the company's own CEO was hijacked without a password being guessed.

Cryptocurrency holders have been the main financial targets. Michael Terpin sued AT&T after a 2018 SIM swap that cost him roughly 24 million dollars in tokens. In 2019 a US investor lost around 10 million dollars in a swap the courts later attributed to a group that targeted exchange customers by working through breach lists. The SEC's own X account was compromised via SIM swap in January 2024 to post a fake ETF approval, and the individual convicted in 2025 had obtained the number by presenting a forged ID at a carrier store.

What all of these have in common is that the attackers found the number first. Nobody guesses a mobile number; they look it up against the target's name in a broker record or a dump, confirm it is the number on the exchange account, and then attack the carrier. Making the number findable is the precondition, and that is where a separate verification number changes the picture.

Defences at the Carrier and on the Account

The first line is at the carrier, because that is where the swap happens. Every major US and UK carrier now offers a port-out or account PIN that must be given before a number is moved. Set it, do not reuse a PIN from anywhere else, and do not store it in the account notes. T-Mobile's Account Takeover Protection, AT&T's Wireless Account Lock, and Verizon's Number Lock all block port-outs and SIM changes until you disable the lock in the app; EE, O2, Vodafone, and Three in the UK offer equivalent settings by request.

The second line is to stop relying on SMS for the accounts that matter. Authenticator apps (Google Authenticator, Authy, Aegis, Microsoft Authenticator) and hardware keys (YubiKey, Google Titan) generate codes on the device you hold, and a swapped SIM receives nothing. Switch exchange, bank, email, and social accounts to app-based or key-based 2FA and then remove the phone number from the recovery options, because a number left as a fallback is still a route in. The approaches are compared at /blog/two-factor-authentication-without-phone.

The third line, and the subject of the rest of this guide, is making sure that the number on those accounts is not the number an attacker can find by looking you up.

Where a Separate Verification Number Fits

An attacker builds a target profile from public and breached data. That profile contains your carrier number because you have used it everywhere: it is on your Facebook account from before the 2021 leak, in the marketing databases of every shop you gave it to, and in the broker records that aggregate them. When they check whether that number is the one on your Binance or Coinbase account, it usually is.

If the exchange account was instead verified with a private number you rent from TempNumber.me and use nowhere else, the profile does not contain it. The attacker can still swap your carrier number, but the exchange does not send codes to that number, so the swap yields nothing there. The number they would need to swap is not in a carrier account under your name and does not appear in any record tied to you. The value is not that the rented number is unbreakable; it is that nobody knows to attack it.

This works best for accounts where the phone is a secondary factor and the platform lets you keep it private: exchanges, social accounts, and secondary email. The exchange-specific setup is covered at /blog/temp-number-for-binance and /blog/temp-number-for-coinbase-crypto-exchanges, including the country-matching each exchange applies.

What a Temp Number Does Not Do

A rented number is not immune to interception. It is a mobile number on a real carrier, and SMS on any carrier can in principle be intercepted through SS7 weaknesses or an insider at that carrier. The protection is obscurity and separation, not cryptography. Where a platform supports an authenticator app or hardware key, that is the stronger control and the number should be a fallback at most.

A shared number is worse than your own SIM for 2FA, not better. Public shared inbox numbers show every incoming message to every visitor, so a code sent to one is readable by anyone watching the page. Using a shared number as a second factor on an exchange is handing out the code publicly. Only a private number that is assigned to you alone, and that you keep active for as long as the account uses it, is appropriate.

The number also has to be retained. If the rental lapses and the number cycles to another user, the account's second factor now belongs to a stranger and you are locked out. The rules on expiry are at /blog/number-recycling-explained. For 2FA use, treat the rental like a subscription: extend it before it ends, or move the account to an authenticator and remove the number first.

Setting It Up Correctly

The order matters, because a half-finished change can leave an account with no working second factor.

• Set a port-out PIN and enable the number lock on your carrier account before anything else. This protects your existing number while you migrate.
• For each high-value account, enable an authenticator app or hardware key as the primary second factor. Save the backup codes offline.
• Take a private rental on TempNumber.me from a country the platform accepts (United States or United Kingdom for most exchanges) and add it as the phone number on the account, replacing your carrier number.
• Remove your carrier number from the account's recovery options entirely. A number left as a fallback is still an attack path.
• Record which rental belongs to which account and set a reminder to extend it before expiry. If you stop using the account, remove the number from it before the rental ends.
• Do not use the same rental across several high-value accounts. If one platform leaks its user table, the number should not map to everything else you hold.

Signs You Are Being Swapped and What to Do

Loss of mobile signal while others on the same network have service is the main sign, especially if it follows an unexpected text from the carrier about a SIM change. Password-reset emails you did not request, or login alerts from a new device, arriving in the same hour confirm it.

Call the carrier immediately from another phone and ask them to reverse the SIM change and lock the account. Then, from a device that is already logged in, change the passwords on email and financial accounts and revoke other sessions. Contact the exchange or bank directly; most have a procedure to hold withdrawals on report. If the accounts that matter were on a separate private number and an authenticator, this step is far less urgent, because the swapped number does not reach them.