Lock your carrier account against SIM-swap scams
The most expensive spam call isn't selling solar panels — it's the one gathering intel to steal your phone number itself. Ten minutes of account hygiene closes the door.
The scam in plain English
A SIM-swap (or port-out) scam is identity theft aimed at your phone number: the attacker convinces your carrier — or a bribed insider — to move your number onto their SIM. The moment they succeed, your phone goes dead and theirs receives your calls and, critically, your SMS two-factor codes. Bank, email, crypto — anything protected by a text message is now protected by their phone. The reconnaissance often starts with an innocent-sounding "verification" call or text pretending to be your carrier: they're harvesting the account PIN, the last four of your SSN, the answers.
Lock it down (free, ten minutes)
- Set a real account PIN/passcode with your carrier — required for any account change, and never reuse a number a data broker might know (no birth years, no address digits).
- AT&T: enable the wireless account lock / "extra security" option so port-outs and SIM changes require extra verification.
- Verizon: turn on Number Lock — free, blocks port-outs until you explicitly unlock.
- T-Mobile: enable account takeover / SIM protection in the app or with support.
- Move critical 2FA off SMS. Authenticator apps or passkeys for email, banking, and anything crypto. SMS 2FA is exactly what a SIM-swap steals.
Recognize the opener
Any inbound call or text claiming to be your carrier and asking you to "verify" a PIN, a one-time code, or account details is the attack in progress. Real carriers don't cold-call for your PIN. Hang up and call the number on your bill. And the classic tell: a one-time code arriving that you didn't request means someone is at your door — change the account PIN immediately.
If your phone suddenly shows "No Service"
Working phone drops to no service where you normally have coverage, and reboots don't fix it: assume swap-in-progress. From another phone, call your carrier's fraud line, then lock your primary email and bank accounts, in that order. Speed matters more than certainty.
The intel-gathering calls are exactly the traffic screening exists to absorb — an unknown "carrier verification" call never reaches you when the AI answers first, and there's a special poetry in a social engineer getting socially engineered by Hank Jr.