How to Lock Your Phone Number Against eSIM Hijacking on Verizon, T-Mobile, and AT&T

Your phone number is the master key to most of your online identity, and attackers have refined a fast, low‑cost method—SIM swap and eSIM hijacking—to seize it. When a number is reassigned, every SMS‑based password reset, two‑factor code, and account recovery prompt lands in a criminal’s hands, opening the door to financial theft, identity theft, and even crypto loss. The good news is that Verizon, T‑Mobile, and AT&T now expose a simple toggle that can lock your number, turning a known vulnerability into a manageable risk.

How SIM Swap and eSIM Hijacking Operate

Traditional SIM swaps begin with data collection: attackers harvest your name, address, and carrier account details from breaches or phishing, then impersonate you to a call‑center rep who moves your number onto a SIM they control. Once the swap completes, all calls, texts, and two‑factor codes flow to the attacker’s device, effectively granting them full access to any service that trusts SMS verification.

eSIM hijacking removes the need for a physical card or a human operator. Researchers at the Russian firm F.A.C.C.T. observed that criminals break into a victim’s carrier portal with stolen credentials, generate a QR activation code, and scan it on their own device, instantly deactivating the legitimate SIM. Intel 471 later identified a provider that sent the activation code to email rather than SMS, giving attackers a second inbox to compromise; the provider has since patched the flaw, but the incident highlights how every convenience shortcut can become an attack vector.

The FBI’s Internet Crime Complaint Center logged 982 SIM‑swap complaints and $26 million in losses in 2024, down from 2,026 complaints and $72.7 million in 2022. While the decline appears encouraging, these figures only capture incidents reported to a single federal portal, meaning the true scale remains opaque.

Why Carrier‑Provided Number Locks Matter

All three major U.S. carriers now offer a “lock your number” toggle in their account portals, effectively requiring a PIN or password before any port‑out or SIM change can occur. This extra authentication layer thwarts the classic social‑engineering script that relies on a rep’s willingness to comply with a simple verification question.

The lock does not prevent a determined attacker who already possesses your carrier credentials, but it raises the bar: the attacker must now also obtain the secondary PIN, which most users store separately from their primary password. In practice, this reduces the success rate of opportunistic attacks that rely on publicly available personal data rather than a full credential breach.

From a privacy‑risk perspective, the lock transforms the number from a “skeleton key” into a “key with a guard.” It does not eliminate the threat of eSIM hijacking entirely, but it forces criminals to invest additional time and resources, shifting the cost‑benefit calculus away from low‑effort swaps.

Carrier‑Specific Implementation Details

Verizon places the lock option under “Account Settings → Security → Number Lock,” where you can enable a four‑digit PIN that must be entered for any port‑out request. T‑Mobile embeds the toggle in the “My Profile” section of its app, labeling it “Port‑Out PIN” and prompting users to set a unique code distinct from the account password.

AT&T’s approach is similar but adds a secondary verification step: after enabling the lock, any attempt to move the number triggers an email or SMS confirmation to the existing device, requiring the user to approve the change. This dual‑factor requirement mitigates the risk of credential theft alone.

All three carriers require the lock to be set up manually; the default state is unlocked. Consequently, the protective benefit hinges on user awareness and the willingness to navigate each carrier’s portal or app to activate the feature.

What This Actually Means For You

1. Enabling the carrier’s number‑lock toggle adds a mandatory PIN step to any port‑out or SIM change, dramatically reducing the success rate of social‑engineered swaps.
2. Even if attackers obtain your carrier credentials, they still need the separate lock PIN, which most users store elsewhere, creating a layered defense.
3. Because the lock is not enabled by default, you must proactively locate and activate it in each carrier’s account interface to reap its benefits.
4. While the lock mitigates traditional SIM swaps, eSIM hijacking that exploits credential theft can still succeed; therefore, securing your carrier login with a strong, unique password and MFA remains essential.
5. Monitoring your account for unexpected port‑out requests or activation alerts can provide early warning, allowing you to reverse unauthorized changes before damage occurs.

Immediate Action Steps

Log into each carrier’s online portal or official app today and locate the number‑lock or port‑out PIN setting. Follow the on‑screen prompts to create a four‑digit PIN that is not derived from personal information and store it in a password manager separate from your carrier login.

Next, strengthen your carrier account credentials: use a long, random password and enable any offered multi‑factor authentication (MFA). Finally, set up account alerts for any port‑out or SIM‑change activity so you receive an immediate notification if someone attempts to move your number.

Frequently Asked Questions

How do I enable the number lock on Verizon?

Navigate to “Account Settings → Security → Number Lock” in your Verizon online account, then create a four‑digit PIN that will be required for any future port‑out request.

Does the AT&T lock prevent eSIM hijacking?

AT&T’s lock adds an email or SMS confirmation step after a port‑out request, which helps stop unauthorized changes, but it does not stop attackers who already have your carrier credentials and can generate a QR code for eSIM activation.

What is the difference between a SIM swap and port‑out fraud?

A SIM swap involves moving your existing number to a new SIM under the attacker’s control, while port‑out fraud transfers the number to a different carrier’s account; both achieve the same outcome—control of your SMS‑based authentication.

What Do You Think?

Given that carriers now provide a simple lock but leave it disabled by default, will you take the extra few minutes to secure your number before the next attack surfaces?