SIM Swapping and Phone Number Hijacking in 2026: How Your Line Gets Stolen (and How to Lock It Down)

Introduction: when the signal disappears, it's sometimes already too late

One Tuesday afternoon, in the middle of the city, your phone displays "No Service." No outage has been announced, and colleagues around you have a normal signal. You restart the device, pull out the SIM card, blow on it out of superstition. Nothing. Two hours later, arriving home, you log in to your bank: three transfers you never made.

This scenario has a name: SIM swapping, or phone number hijacking. The fraudster didn't hack your phone. They didn't crack your password. They simply convinced someone — a customer service agent, a verification algorithm, sometimes a complicit employee — that your number belonged to them. From that point on, every validation SMS your banks, your messaging apps and your online accounts send to that number lands in their hands.

In France, the phenomenon was long seen as marginal. It isn't anymore. The widespread adoption of the eSIM, which allows a line to be activated remotely in a matter of minutes without shipping a plastic card, has mechanically shortened the delay between the fraudulent request and the effective takeover. What used to take two business days now takes ten minutes.

This guide explains how the attack actually works, the concrete protections to enable both with your carrier and on your accounts, and the exact procedure to follow if your line has already been hijacked.

How a SIM swap really works

The attack almost always unfolds in three stages. Understanding this sequence is the best way to spot where you can interrupt it.

Phase 1 — Gathering information

The fraudster needs a base of data to impersonate you with a carrier: first and last name, date of birth, address, phone number, sometimes the last four digits of a bank card or a customer number.

These details come from three main sources:

• Massive data breaches. The major breaches that have hit French carriers and retailers in recent years have put files containing identities, addresses and phone numbers into circulation. The CNIL has issued formal warnings on the subject on several occasions, and the government service Cybermalveillance.gouv.fr treats it as a recurring entry point in its alerts.
• Targeted phishing. A fake delivery SMS, a fake "your carrier account is about to be suspended" message, a fake bank advisor on the phone. The goal isn't always to steal a password: sometimes it's just to get you to confirm a date of birth or an address.
• Social media. A birthday photo, a publicly announced move, the dog's name used as a security question. What you freely publish feeds social engineering scenarios directly.

Phase 2 — The fraudulent request

There are two routes, and they aren't countered in the same way.

Route A: SIM replacement with your own carrier. The fraudster calls customer service or goes through the online account area posing as you, and declares that they've lost their phone. They request a new SIM be sent or, much faster, the activation of an eSIM on a device they control. Your SIM card is deactivated within a second: that's the moment your phone loses signal.

Route B: fraudulent number portability. The fraudster obtains your RIO code (the 12-character number identifying your line, obtained by dialling 3179), then signs up for a plan with a competing carrier while asking to keep your number. Porting takes one to three business days, sometimes less. Your original line is then automatically terminated.

Key takeaway: in both cases, a sudden and unexplained loss of mobile signal is not a technical glitch. It's the number one symptom of line hijacking.

Phase 3 — Exploitation

Once the number is captured, the fraudster triggers "forgot password" procedures on your accounts. Email first — because it controls everything else — then bank, payment platforms, crypto accounts, social media, and sometimes the carrier account area, to lock you out of regaining control.

The validation SMS, long presented as the gold standard of two-factor authentication, becomes at that moment the main way in. That's the whole paradox of SMS-based authentication: it relies on a channel that your carrier can administratively reassign.

Why 2026 is a pivotal year

Three developments have changed the equation.

The eSIM has become the norm. Virtually every smartphone sold in France since 2023 supports it, and most carriers allow a profile to be activated online, with no human involvement and no postal shipment. Excellent news for the legitimate user who switches carriers in three minutes. Excellent news, too, for the fraudster.

The market has consolidated and is in motion. Capital movements in French telecoms, customer base migrations from one carrier to another, and the arrival of new MVNOs — including ones backed by large retail chains — are multiplying the legitimate emails announcing contract changes. Against that background noise, a fraudulent message blends in far more easily.

Procedures have been streamlined for commercial reasons. ARCEP has long pushed to smooth out number portability in order to boost competition, and that's a good thing for consumers' wallets. But the friction removed from an honest customer's journey is also removed from an impostor's.

The five locks to put in place right now

None of these measures takes more than ten minutes. Taken together, they make the attack far less profitable.

Lock 1 — The carrier-side confidential code

All French carriers offer, under various names, a customer service password or secret code distinct from your online account password. It's requested during sensitive operations: SIM change, cancellation, address modification.

In practice:

• Call your customer service or go through your subscriber area and explicitly request the activation of a security code for any SIM or eSIM replacement request.
• Choose a code that is neither your date of birth, nor your postcode, nor the end of your phone number.
• Write it down somewhere other than a "passwords.txt" file. A small password notebook tucked away in a drawer remains, paradoxically, a robust solution against remote hacking.

Lock 2 — The SIM card PIN, genuinely enabled

Many users have disabled their SIM's PIN code to avoid entering it at every restart. That's a mistake: if the phone is physically stolen, the SIM can be extracted and inserted into another device to receive your validation SMS messages.

Re-enable it in the settings (Settings → Cellular → SIM PIN on iOS, Security → SIM card lock on Android) and change the default code, often 0000 or 1234.