Here’s something most people don’t know: two-factor authentication over text message — the kind where a website texts you a code to prove it’s you — has a real, documented weak spot. It’s called a SIM swap scam, and it’s been draining bank accounts, email inboxes, and crypto wallets for years.
Here’s how it works. Your phone number is tied to a tiny chip inside your phone called a SIM card. That chip is what tells the cell network “this phone belongs to this number.” Criminals have figured out how to convince your phone carrier to transfer your number to a SIM card they control — usually by calling the carrier and impersonating you using personal info they’ve gathered from social media or data breaches. Once that swap happens, your calls, texts, and other data get diverted to the criminal’s device. You’re still holding your phone — but it’s basically a paperweight now.
Then it moves fast. The attacker hits “Forgot Password” on your email, your bank app, your crypto exchange. Those sites text a one-time code to verify it’s you. That text goes to the criminal’s phone now. They enter the code, reset your password, and they’re in. The FBI has confirmed that criminals can defeat any SMS-based two-factor authentication on any account once they control your number.
Your first clue that something’s wrong? Your phone loses service. No bars. No texts. No calls. Some people assume it’s a network glitch and don’t panic right away — which is exactly the window the attacker needs.
Or you might start getting weird email confirmations for purchases you didn’t make. Or you call your bank to report something suspicious and find out your personal information has already been changed, so you can’t even verify your own identity to a customer service rep.
This isn’t a rare edge case. The FBI and FTC have both put out public warnings about this. It’s real, it’s happening, and text-based 2FA is specifically the thing attackers are exploiting.
So what actually works better?
Authentication apps. Things like Google Authenticator, Authy, or similar apps generate your login codes directly on your device — they don’t go through your phone number at all. A SIM swap does nothing to them, because the code never travels over the cell network. The FTC specifically recommends using an authentication app instead of text-based verification if you’re worried about SIM swapping.
Security keys are even stronger — they’re small physical devices you plug in or tap to your phone to prove it’s you — but authentication apps are a huge upgrade over texts for most people and cost nothing to set up.
A few other things worth doing: Don’t post your phone number publicly on social media. Don’t talk openly online about owning cryptocurrency or having significant savings. Attackers often target people they’ve identified as worth going after. Call your carrier and ask if they have a “SIM lock” or “port freeze” option — some carriers let you add an extra PIN or in-person verification requirement before your number can be moved. And if your phone suddenly loses all service for no obvious reason, don’t wait. Call your carrier immediately from another phone and ask if your number was recently ported or your SIM was changed.