You have probably had your mobile number longer than your current address. It sits on old forms, in doctors’ files, in a hundred contact lists. For most of its life, it was just a way to be reached.
Somewhere along the way, without anyone deciding it, that number became something else: the master recovery key to your family’s digital life. It is the thing your email texts to reset a password. The thing your bank texts to confirm a login. The thing half your accounts fall back on the moment someone clicks “forgot password.” A skeleton key, hanging by the door.
What is a SIM swap?
A SIM swap is a hijacking of your phone number: an attacker convinces your carrier to move it to a SIM card you have never seen. Every text meant for you, including every recovery code, now arrives on their phone instead.
The accounts behind that number are guarded by passwords, security questions, and fraud departments. The number itself is guarded by a retail clerk or a call-center agent, up against someone who talks past those people for a living, usually arriving with the personal details a data-broker file supplies. No malware, no break-in, just a convincing phone call. It is how a member of the group known as Scattered Spider recently admitted to stealing at least $8 million in cryptocurrency using phishing and SIM swapping (Krebs on Security).
Notice what is missing: your phone. A stolen device is its own problem. This attack travels with the number and works from anywhere.
Why the usual advice falls short
“Use a strong password” does not help here; the attacker never touches your password. Even “turn on two-factor authentication,” genuinely good advice, carries a catch nobody mentions: the most common second factor is a text-message code, and that code rides on the very number that just got stolen. The fix is not a better password. Real SIM swap protection is two moves most families never hear about: lock the phone line so it cannot be taken, and stop treating that line as proof of who you are.
Two terms for new readers. The FIRM System (FIRM stands for Family Information Resource Management) is the organizational system at the heart of The Recoverable Family, and its job is making sure the right person can reach the right thing at the right time. The SAFE Framework organizes that work into four Areas of Focus: System, At-Home, Financial, and Estate. What follows is System work, home of the Passwords and Passkeys Module, with direct Financial stakes.
The guidance
1. Lock the line
Every major carrier now offers protection against having your number moved without your permission, often called Number Lock or port-out protection, plus an account PIN that is separate from your voicemail PIN. Federal rules now require carriers to offer these safeguards and to notify you of SIM or port changes. Turn them on, and set a PIN that is not your birthday, your street address, or the last four digits of anything. This is the single highest-value step, and it takes about fifteen minutes in the carrier’s app or on a call.
Do it for every line on the family plan, not just yours: any line that can receive a recovery code is a door into the household; if your teenager’s number backs up a shared account, it is part of the family’s perimeter too.
2. Move your important accounts off text-message codes
Text codes are better than nothing, and the weakest rung on the ladder. Climb it for the accounts that matter most: email first, because the email account can reset nearly everything else you own, then the bank.
- Text-message (SMS) codes: the baseline, tied to the very number you are trying to protect.
- Authenticator app codes: better. They are not tied to your phone number, so a SIM swap cannot grab them.
- Passkeys and hardware security keys: best. There is nothing to intercept and nothing to hand over.
This is a one-time change, not a new habit: ten minutes in security settings covers what matters most, and every account you move shrinks what a stolen number is worth.
3. Demote the number as a recovery method
Stronger codes still leave a back door if the number stays listed as a recovery option. Go back into your important accounts and remove the phone number as a recovery or backup method wherever a better option exists. Every place the number can reset an account is a place a stolen number can too.
4. Write it down
Record the carrier PIN and the settings you changed in the Secure Guide, and note in the Family Guide that the line is locked and how a trusted person would prove identity to the carrier. A lock nobody in the household can account for becomes its own small emergency; recoverability means the protection survives the person who set it up.
Quick reference
- Turn on your carrier’s Number Lock or port-out protection and set a strong account PIN, on every household line. Highest-value step.
- Move email and bank accounts off text-message codes to an authenticator app or passkeys.
- Remove your phone number as a recovery method wherever a stronger option exists.
- Record the carrier PIN in the Secure Guide; note the locked line in the Family Guide.
The takeaway
Breaches you cannot prevent. This you can, in an afternoon, for free. Lock the line, retire the text-message codes that depend on it, and let the number go back to what it always was: a way to be reached, not proof of who you are. Do that, and a successful SIM swap steals a phone line instead of a family’s accounts — the skeleton key comes off the hook by the door. Where would your family land today: Emerging, Developing, or Recoverable? The Self-Assessment answers in about two minutes.