Account takeover

How to spot a SIM swap: when your number is taken over and how to get it back

Suddenly no signal while everyone around you can still make calls, and shortly after, password-reset emails you never requested: that is the pattern of a SIM swap, where your phone number effectively moves from you to the fraudster. The Dutch Fraud Helpdesk documents how it starts: text messages and calls claiming to come from carriers (KPN and Odido) about an expiring SIM that needs to be "validated", or that must urgently be converted to an eSIM "because of new legislation" (Fraudehelpdesk, fake KPN and Odido messages). Anyone who goes along can lose control of their own number; the number is then used to send bulk fraudulent messages to others (Fraudehelpdesk).

The rule that breaks this pattern: your carrier never calls or texts about the validity of your SIM, and once your number is gone you need a second factor that is not an SMS. The decision is not in the message; it is at your carrier and in your account security.

Direct answer: five checks and steps

1. No signal for no reason? Treat it as an emergency, not an outage. "No service" or "emergency calls only" in a place where you always had signal, while others around you still have signal, points to a possible takeover: you suddenly cannot call, text or use mobile data, while the fraudster can (Veilig Internetten, what is SIM swapping). Do not wait to see whether the signal "comes back on its own": check with your carrier immediately whether this is a SIM switch or a temporary outage (Veilig Internetten).
2. Do not click, and never hand over personal data through such a link. The Fraud Helpdesk describes texts asking you to "verify" your email address, phone number and sometimes your citizen service number, and fake emails asking you to change a password or request an eSIM through a link. Do not click links in those messages and do not fill in any data (Fraudehelpdesk). A carrier never asks for this kind of data or asks you to "validate" your SIM on its behalf (Veilig Internetten).
3. Call your carrier immediately on a number you already have. If you have lost control of your SIM, contact your carrier as soon as possible; they can block the SIM card (Fraudehelpdesk; Veilig Internetten). If your carrier confirms it was a SIM swap, file a police report (Veilig Internetten).
4. Assume anything that leans on SMS codes can be taken over. Whoever holds your number can enter accounts protected by SMS two-step verification: you no longer receive the code, the criminal does. That covers social media, government ID and online banking, and where your number is linked to an account, potentially your money too (Veilig Internetten). Change your passwords, warn your contacts (messages "from you" may be on their way), and report it once confirmed (Veilig Internetten).
5. Replace SMS as a second factor. Use authenticator apps and link as few accounts and services as possible to your phone number (Veilig Internetten). That is the durable fix: a code generated in an app does not move with your number.

Why a call or text cannot be your carrier

The Fraud Helpdesk is explicit about the pattern: carriers do not send text messages about an expiring SIM, and never call to ask you to validate or approve a SIM card or an eSIM switch (Fraudehelpdesk). The fake employee works with recognisable tricks: a text with a link, an email saying "change your password", a request to forward that email to another address, and even the instruction to remove your carrier's app (Veilig Internetten). Every one of those steps serves the same goal: putting your number in someone else's hands.

How the takeover itself works

In the actual SIM swap, the fraudster calls your carrier and impersonates you, with a story that the SIM card is broken and needs replacing (Veilig Internetten). The carrier then asks check questions, for example your date of birth; with data from, say, a breached database, the fraudster can often answer those correctly (Veilig Internetten). That explains why the protection is not only on the phone side: the less personal data about you circulates online and the fewer services hang off your number, the less there is to win (Veilig Internetten).

The difference from spoofing of your number

There is a second pattern in which your number shows up without you losing it: spoofing. Others then see calls apparently coming from you, while fraudsters actually call from a different number (Fraudehelpdesk, someone else is using my phone number). You cannot stop it, and you do not need to recover any accounts for it; you can report it and add a note to your number on who-called-me sites (Fraudehelpdesk). The distinction is practical: with a SIM swap you have lost your signal and must act immediately at your carrier and across your accounts; with spoofing your own phone is fine and it is mainly a reporting and reputation issue.

What a detector does and does not see

The fraudulent message itself is usually text: you can run it through the text detector and a screenshot through the image detector. That is triage: it helps you decide which message to verify first. It says nothing about the sender. Smishing templates and short messages contain too little writing style for a reliable signal, so a low score never proves the message came from your carrier. With SIM swapping there is an extra layer: the decisive evidence is not a score but whether your phone has signal and whether your carrier can show you the change. And the number on your screen is no proof either, because numbers can be faked (Fraudehelpdesk).

What a message or phone call cannot tell you

• whether the caller or sender really is your carrier, even when the number or sender ID matches;
• whether anything is actually wrong with your SIM card or subscription;
• whether a link leads to the real carrier environment — only the domain shows that;
• whether it is fraud; only a carrier or law-enforcement body can establish that.

If your number has already been taken over

• Call your carrier on a number you already have and have the SIM blocked; if the carrier confirms the swap, file a police report (Veilig Internetten).
• Check your bank and credit card accounts for unfamiliar transactions and call your bank if something is wrong; speed determines the chance of a block (Veilig Internetten).
• Change the passwords for your email, bank, government ID and social media, log out all sessions and re-register WhatsApp once your number is back (Veilig Internetten).
• Warn your contacts: messages "from you" may be on their way, just like with a hijacked WhatsApp account (Veilig Internetten).
• Report it to the Fraud Helpdesk and file a police report where there is loss (Fraudehelpdesk; Veilig Internetten).

More checks are in the guides on a hijacked WhatsApp account, spotting a fake bank call and spotting an AI voice-clone scam. To check a single message or file, use the free checker.

Frequently asked questions

My carrier says my SIM is expiring or needs to be validated. Is that real?

No. The Fraud Helpdesk and Veilig Internetten are clear: carriers do not send texts about an expiring SIM and never call about validation or a switch to an eSIM. Hang up or delete the message, and call your carrier on a number you already have if in doubt.

Why is an SMS code so dangerous as a second factor in a SIM swap?

Because the code arrives at the device that belongs to the number, and after a SIM swap that device is no longer yours. Whoever holds your number can enter accounts protected by SMS two-step verification, from social media to government ID and online banking. Use authenticator apps instead of SMS where possible and link as few accounts as possible to your phone number.

Does a high detector score prove the message is fake?

No. The score describes patterns in a text or an image and says nothing about the sender. A low score does not prove the message is genuine either. Use the outcome as a reason to verify at your carrier or in your own account environment, never as proof.