SCAMS & SECURITY
SIM Swap Scams in Australia: How to Protect Yourself
Your phone number has quietly become the key to your bank, email and social accounts. That makes it a target. In a SIM swap scam, a criminal takes over your number, and with it every one-time code sent by SMS.
What is a SIM swap scam?
A scammer gathers a few details about you, often from data breaches, social media or phishing messages. They then contact a mobile provider pretending to be you, and either ask for a replacement SIM or eSIM on your account, or move (“port”) your number to a new provider they control.
Once it works, your phone suddenly loses service, and every call and SMS goes to the scammer. They use the codes texted to “you” to reset passwords, get into your email and log in to your bank.
Warning signs
- Your phone shows “No service” or “SOS only” in a place where it normally works, and restarting doesn't fix it.
- You get a message about a SIM change or number port that you didn't ask for.
- You're suddenly logged out of your email, bank app or social accounts, or get password-reset emails you didn't request.
- Friends say they've had odd messages from your number.
What to do if it happens
- Call your mobile provider immediately from another phone, and ask them to stop the port or SIM change and restore your number.
- Call your bank and ask them to freeze your accounts and watch for unusual transactions.
- Change your email password first, then your other important accounts, from a device you trust.
- Report it to Scamwatch and to ReportCyber through cyber.gov.au. IDCARE, Australia's free identity and cyber support service, can help you work through what to do next.
How to protect yourself
- Stop using SMS codes where you can. Switch important accounts to an authenticator app or a passkey instead. A stolen number is useless if nothing important sends codes to it.
- Add a PIN or password to your mobile account. Most Australian providers let you set one, so anyone calling in as you has to know it.
- Share less. Your date of birth, address and phone number are exactly what scammers use to pass identity checks.
- Keep sensitive accounts off your everyday number. A Privacy eSIM is data-only, so there's no phone number on it to port or swap, and it isn't registered in your name.
- Message securely. An end-to-end encrypted messenger like Threema works without a phone number at all, so your conversations don't move with your SIM.
- Harden the phone itself. An Encrypted Phone running GrapheneOS keeps your apps and data locked down, even if someone gets hold of your number.
The bottom line
Australian providers now have to do extra identity checks before a number is ported, which has made these scams harder, but not impossible. The safest approach is to make your phone number matter less: move your logins off SMS, lock down your mobile account, and keep your private life on tools that don't depend on a number.