Yes, a phone number is often enough to hack a bank account

Your phone number is a master key to your bank account, even if the hacker never learns your password. Banks use your phone number to verify your identity when you call customer service, reset your password, or authorize transfers. A hacker who controls your phone number can intercept the text messages banks send as verification codes, lock you out of your own account, and move money out—all without ever touching your actual password.

This attack is called SIM swapping or SIM jacking. The hacker contacts your mobile carrier, convinces them they are you, and asks them to transfer your phone number to a new SIM card the hacker controls. Once your number rings on their phone instead of yours, every text message meant for you arrives at their device. Banks send verification codes by text. The hacker intercepts them and gains entry.

You do not need to have given your phone number to anyone suspicious. Your number is public information—it appears on receipts, in online directories, on your social media, or in data breaches from companies you have never heard of. A hacker can buy a list of phone numbers tied to bank customers and start attempting takeovers.

Key Takeaways

  • A hacker who controls your phone number can reset your bank password and intercept verification codes without knowing your current password.
  • SIM swapping—convincing your carrier to move your number to a hacker's phone—is the most common method, and carriers sometimes make the switch without proper verification.
  • Your phone number alone is enough; the hacker does not need your password, email, or security questions if the bank relies on text-based verification.
  • Adding a PIN or password to your carrier account, separate from your bank password, blocks most SIM swap attempts before they start.
  • If your phone suddenly loses service, contact your carrier immediately—this is often the first sign a SIM swap is in progress.

How the attack works step by step

The hacker starts by gathering basic information about you: your name, phone number, and possibly your bank name. They may find this in a public data breach, buy it from a broker, or simply guess based on patterns. They do not need much.

Next, they call your mobile carrier—Verizon, AT&T, T-Mobile, or another provider—and claim to be you. They say they lost their phone, got a new one, or switched carriers. They ask the carrier to move your phone number to a SIM card in their possession. If the carrier's verification process is weak—asking only for your name, address, and last four digits of your Social Security number, all of which may be public—the transfer goes through.

Your phone immediately stops working. You lose all service. Meanwhile, the hacker's phone now receives calls and texts meant for you. They go to your bank's website, click "Forgot Password," and request a reset. The bank sends a verification code by text. The hacker receives it on your number and resets your password to one they control. They log in, authorize a transfer to an account they own, and the money is gone within minutes.

By the time you realize your phone has no service and call your carrier from another device, the hacker has already moved the money to a different bank or converted it to cryptocurrency. Recovery is slow and uncertain.

Why banks make this attack possible

Banks treat your phone number as a security measure, but it is actually a vulnerability. Text message verification—called SMS-based two-factor authentication—is convenient for the bank and the customer, but it is not secure. The bank assumes that if someone receives a text on your number, they must be you. That assumption breaks the moment someone controls your phone number.

Stronger verification methods exist: authentication apps like Google Authenticator or Authy generate codes on your phone that do not travel through text messages. Hardware security keys create a connection that cannot be intercepted. But these require the customer to set them up, and many people do not. Banks default to SMS because it is easy.

Some banks do ask security questions or require you to answer details about your account history. But if the hacker has access to your email or has bought your personal information from a data broker, they may know these answers too. And many banks skip these steps if you are calling from a "trusted" number—which, after a SIM swap, is the hacker's phone.

Protecting your phone number at your carrier

Your first defense is at your mobile carrier, not at your bank. Add a carrier PIN or account password to your account—a separate code that the carrier requires before making any changes. This is different from your phone's unlock code. When a hacker calls claiming to be you, the carrier will ask for this PIN. Without it, the transfer fails.

Contact your carrier and ask how to set this up. The process varies by provider. Verizon calls it a "Verizon PIN." AT&T calls it a "passcode." T-Mobile calls it a "customer PIN." All three allow you to set one online or by calling customer service. Once it is in place, a hacker cannot move your number without it.

Some carriers also offer a port freeze or transfer lock, which prevents your number from being moved to another carrier entirely. This is stronger than a PIN because it blocks the entire category of attack. Ask your carrier whether this option is available and how long it lasts. Some freeze your account for 30 days; others keep it frozen until you call to remove it.

Do not use a PIN that is easy to guess. Do not use your birth year, the last four digits of your Social Security number, or a sequence like 1234. Use a random six-digit code and write it down somewhere secure—not in your phone, not in a note app, not in your email.

Securing your bank account itself

Once your carrier account is protected, harden your bank account. Stop relying on SMS verification alone. Most banks now offer authentication apps as an alternative to text messages. Set this up in your bank's security settings. When you log in or authorize a transfer, the bank will ask for a code from the app instead of sending a text. The hacker cannot intercept an app-based code because it never travels through the carrier's network.

If your bank offers a hardware security key—a small USB device or Bluetooth key—use it. This is the strongest form of verification available to consumers. The key creates a secure connection between you and the bank that cannot be spoofed or intercepted, even if a hacker controls your phone number and your email.

Add a strong, unique password to your bank account. Do not reuse a password from another website. If that website is breached, a hacker can use the same password to try your bank. Use a password manager to generate and store a long, random password—at least 16 characters, mixing letters, numbers, and symbols.

Review your bank's login history and active sessions regularly. Most banks show you a list of devices and locations where your account has been accessed recently. If you see a login from a place you do not recognize, change your password immediately and contact the bank.

What to do if your phone loses service suddenly

If your phone suddenly stops working—no calls, no texts, no data—and you have not switched carriers or changed your plan, assume a SIM swap is in progress. Do not wait. Act immediately.

Use a different phone, a computer, or a friend's device to contact your carrier. Call the customer service number on your carrier's website or bill, not a number from a search result. Tell them your phone has lost service and ask them to confirm that your account has not been changed. Ask them to verify that your phone number is still on your original SIM card and has not been transferred.

If the carrier confirms a transfer has been requested or completed, ask them to reverse it immediately and restore your number to your original SIM card. Ask them to add a carrier PIN to your account right now, before you hang up. Do not end the call until this is done.

Next, log into your bank account from a computer or a different phone. Change your password immediately. Check your recent transactions and account activity. If money has been moved, contact your bank's fraud department right away. Report the unauthorized transfer and ask them to reverse it. Banks can often recover funds if you report the fraud within a few hours.

Change the passwords on your email accounts as well. If a hacker accessed your email during the SIM swap, they may have used it to reset passwords on other accounts—credit cards, investment accounts, cryptocurrency exchanges. Work through each one.

Recovering money after a SIM swap attack

If money was stolen before you caught the attack, recovery depends on how quickly you report it and where the money went. Report the fraud to your bank within 24 hours. Banks have different timelines for fraud liability, but most limit your loss to $50 if you report within two business days. If you wait longer, you may be liable for the full amount.

Your bank will file a dispute and attempt to reverse the transfer. If the money went to another bank account, the receiving bank may be able to freeze it. If it was converted to cryptocurrency or sent to a foreign account, recovery is much harder and may be impossible.

File a report with the Federal Trade Commission at reportfraud.ftc.gov. This creates an official record and may help if you need to dispute charges later. Also file a report with your local police department, even though they rarely investigate individual cases. You need the report number for your records.

Consider placing a fraud alert or credit freeze on your credit file. A fraud alert tells credit bureaus to contact you before opening new accounts in your name. A credit freeze prevents anyone, including you, from opening new accounts without unfreezing first. Both are free and can prevent a hacker from using your identity to take out loans or credit cards.

Frequently Asked Questions

Can a hacker get into my bank account if I have a strong password?

Yes. If a hacker controls your phone number, they can reset your password without knowing the old one. They request a password reset, intercept the verification code sent by text, and create a new password. Your strong password becomes useless because they are not using it.

Do I need to worry about this if I use an authentication app instead of text messages?

Much less. An authentication app generates codes on your phone that do not travel through text messages or the carrier's network. A SIM swap does not give a hacker access to these codes. However, if the hacker also gains access to your email or your phone itself, they may be able to bypass the app. Use both a carrier PIN and an authentication app for the strongest protection.

What if my carrier says they cannot add a PIN to my account?

They can. Every major carrier offers this. If a representative says they cannot, ask to speak to a supervisor or call back and try again. If you still encounter resistance, consider switching carriers. A carrier that will not protect your account from SIM swaps is not protecting your money.

If my number is stolen, can I get a new one from my carrier?

Yes, but it takes time. Contact your carrier and ask to change your phone number. They will assign you a new one and move your service to it. Update your bank, email, and other important accounts with the new number. This stops the immediate attack but does not recover stolen money. Report the fraud to your bank and the FTC as well.

Is my money protected by the bank if it was stolen through a SIM swap?

It depends on how quickly you report it and your bank's fraud policy. Most banks limit your liability to $50 if you report within two business days. Some offer stronger protection. Check your account agreement or call your bank to ask what they cover. Report fraud immediately—waiting longer reduces your protection.