How to Protect Your Phone Number From ESIM Hacking on Verizon, T-Mobile, and AT&T

Your phone number is the key to your digital life, and for years, telecom operators have been handing out copies of it to anyone with a decent conversation plan. Resetting your bank password, recovering your email account, approving a cryptocurrency withdrawal: all of this can be done with a text message sent to a number that a call center operator can reassign in minutes.

The good news is that all three major US carriers now allow you to block your number using a kill switch. Here’s how these attacks work and where to find each kill switch.

How SIM swapping and eSIM hijacking work.

SIM swapping begins with research. Fraudsters collect your name, address, and account information from data breaches or phishing attacks, then contact your carrier, impersonating you. If they convince someone to port your number to a SIM card they control, your calls, text messages, and two-factor authentication codes will be transferred to their account. A closely related technique is number porting fraud, where the fraudster opens an account with another carrier and arranges for your number to be ported there.

The exact scale is difficult to pinpoint, but the FBI’s Internet Crime Complaint Center recorded 982 SIM swapping incidents and approximately $26 million in losses in 2024 , down from 2,026 complaints and $72.7 million in losses in 2022. While this decline appears encouraging, these figures only include crimes that victims bothered to report through a single federal portal.

eSIM cards have eliminated the plastic card, not the weak link. Researchers from the Russian company FACCT discovered that attackers now hack a victim’s mobile operator account using stolen or leaked data, generate a QR code, and scan it on their device. Your legitimate SIM card is instantly deactivated. No need to visit a store or call a company representative.

Intel 471 also pointed to a provider that allowed activation codes to be sent via email instead of SMS , allowing attackers to hack a second email address. This provider has since closed the loophole, but the lesson remains: any way for customers to bypass the block is also a way for criminals to bypass the block.

What do SIM locks and number portability PINs actually do?

Currently, carriers offer three interrelated security measures. SIM card locking prevents SIM or eSIM card changes and device updates; number portability locking prevents your number from being transferred to another carrier; and a PIN code adds a password check when contacting customer support or requesting a number portability.

I would consider a PIN code the weakest of the three options. PIN codes aren’t completely secure, as company representatives can still bypass them. A lock that completely disables this option is much harder to bypass.

In its 2023 ruling, the Federal Communications Commission (FCC) required wireless carriers to offer customers free account locking and notify them of SIM card changes and number porting requests. However, the compliance deadlines have been postponed pending the completion of a federal review, so it should not be assumed that all carriers have fully implemented these features.

How to Block Your Number on AT&T

AT&T consolidates all these features into a single toggle called “Wireless Account Lock.” According to the AT&T support page , it blocks device updates, SIM and eSIM card replacements, IMEI changes, number changes, switching carriers, and editing authorized users and payment information. However, you can still pay bills, change plans, and unlock your device.

To enable it (for postpaid subscribers):

1. Open the AT&T app on the device connected to your wireless account and sign in.

2. Click on the person icon.

3. Scroll down to “Wireless Account Lock”.

4. Swipe to lock.

For prepaid subscribers, the process is different: log in, select your number, tap “Profile & Settings,” then “Account Info & Preferences,” and select “Enable” under “Wireless Account Lock.” AT&T will send you a one-time verification code via SMS.

Only users with primary or secondary access can toggle this switch, and AT&T sends an email to the account owner and SMS messages to all active numbers every time the lock is changed. I like this. The stealth change is the crux of these attacks, so loud notifications are half the protection.

How to Block Your Number on Verizon

Verizon splits this into two parts. SIM Protection blocks unauthorized SIM card and device swaps, while Number Lock prevents your number from being transferred to another carrier. Verizon documentation notes that Number Lock alone doesn’t prevent SIM card swaps, so it’s recommended to enable both.

To give them the opportunity:

1. Open the My Verizon app.

2. Click the Me tab, then Edit profile and settings.

3. Find the SIM Card Protection feature and enable it for each line you want to protect.

4. Find the Number Lock button and do the same.

Once SIM card protection is disabled, SIM card changes and upgrades remain blocked for an additional 15 minutes. And if you ever switch to a different carrier, number blocking must be disabled before you can generate a PIN to port the number. Two switches are a bit more complicated than AT&T’s single switch, but it allows you to block your number while still being able to upgrade your device, which is convenient if you frequently change phones.

How to Block Your Number on T-Mobile

T-Mobile also uses two features. SIM protection blocks SIM and eSIM card swaps, while number portability protection blocks switching to other carriers. Both features are free.

To enable SIM card protection on a postpaid plan in the T-Life app:

1. Click the Manage tab, then the gear icon.

2. Select Security, then SIM Protection.

3. Toggle protection for your entire account or for individual lines.

4. Click Save Changes, then Continue.

Number portability protection works differently because it’s an add-on service that must be applied to each line separately. In T-Life, go to “Manage,” then “View Tariff Plans,” then “Manage Additional Services,” and check the box next to “Number Portability Protection.” Repeat these steps for each line in your account.

T-Mobile allows authorized users to add any of these features, but only the primary account holder can remove them. Setting up each line is tedious for large family plans, but the ten minutes are worth it. T-Mobile also recommends setting a 6-15-digit account PIN, which can only be changed from the primary account holder’s phone while on the T-Mobile network with Wi-Fi turned off.

What these locks don’t cover

Locking protects against changes made by your carrier—it doesn’t protect against someone who already has access to your carrier credentials and can disable the lock.

At the very least, AT&T requires their app to be installed on a device active on your account, which raises the bar. However, researchers recommend using unique passwords and two-factor authentication on your carrier account as well.

Don’t forget to unlock your phone before updating or replacing your eSIM card, otherwise any carrier will lock you out. Afterward, re-enable unlocking.

A more effective solution is to stop using your phone number as a security measure for anything valuable. Switch your bank accounts, email, and cryptocurrency accounts to an authenticator app or password where possible. Think of carrier locks like a seat belt: you’ll rarely need them, and you’ll be glad you buckled them when you do.

More…