SIM swap detection: catch a port-out before your accounts are drained

A SIM swap doesn't steal your phone. It steals your phone number — and with it, every SMS code, every "we texted you a link to reset," every account that trusts your number as proof of who you are. It is the single most productive vector for crypto theft and account takeover, because it turns the convenience of SMS two-factor authentication into the attacker's master key. Helix raises your awareness of the signs that a swap is underway and walks you through the two defenses that genuinely work: a carrier port-out PIN, and moving your two-factor codes off SMS. Here's how the attack works, what awareness Helix can and can't provide, and the steps that actually close the door.

1. What a SIM swap actually is

Your phone number isn't really tied to your phone or your SIM card. It's a record at your mobile carrier that says "route calls and texts for this number to this account." A SIM swap — also called a port-out, SIM hijacking or simjacking — is an attack on that record. The attacker convinces your carrier to move your number onto a SIM card they control. From that instant, your calls and texts go to their device, and your own phone shows "No Service" or "SOS only," cut off from the network.

How do they convince the carrier? Usually social engineering. They call customer support pretending to be you, armed with personal details harvested from data breaches, social media or phishing — your name, address, date of birth, the last digits of a card, answers to "security questions." Sometimes they bribe or trick a store employee. Sometimes they exploit a weak online account-management flow. The carrier, believing it's helping a customer who lost their phone, ports the number. No malware touches your device. No password is cracked. The attack happens entirely at the carrier, against the human and procedural defenses of a call center — which is exactly why it's so hard for any app on your phone to stop directly.

Once they have your number, the second act begins. They go to your email, your exchange, your bank, your cloud account, and click "forgot password" or trigger a login that sends a verification code by SMS — and that code now arrives on their device. They reset the password, satisfy the SMS two-factor prompt with the code they just received, and they're in. Your number was the key to everything that used it as a backstop, and they just had it copied.

2. Why it's the top theft vector

SIM swapping has become the dominant route into high-value accounts, and especially into crypto, for a few converging reasons.

First, SMS two-factor is everywhere and was never meant to be a security anchor. Texting a code was adopted because it was easy and universal, not because the phone network is secure. The number it relies on can be moved by a phone call to support — so the "second factor" that's supposed to prove possession of your device proves only possession of the number, which an attacker can steal without ever touching your hardware.

Second, the payoff is enormous and irreversible. Crypto is the perfect target: once an attacker gets into an exchange account or resets the credentials guarding a wallet, they can move funds in minutes to addresses that can't be clawed back. Unlike a fraudulent card charge, a stolen crypto transfer is usually gone for good. That irreversibility is why swappers chase crypto holders specifically — and why being known to hold serious value makes you a target.

Third, the attack scales and the inputs are cheap. The personal data needed to impersonate you at a call center is for sale in bulk from breaches. The technique is documented and traded. And it cascades: your number often controls your email, and your email controls everything else, so one successful swap can unlock a whole life. High-profile thefts of seven and eight figures have traced back to exactly this — a single port-out that started a chain reaction through every account that trusted a text message.

3. The signs of a swap in progress

A SIM swap leaves a few unmistakable fingerprints, and the window between the swap and the damage is sometimes minutes — so recognizing the signs fast is everything.

• Sudden loss of cellular service. The clearest tell: your phone abruptly shows "No Service," "SOS only," or no bars, in a place where you normally have signal, and it doesn't come back. That's the moment your number left your SIM. If it happens out of nowhere — not in a tunnel, not on a plane — treat it as a possible swap, not a glitch.
• Calls and texts stop arriving. People say they've been trying to reach you; messages you expect never come. Your number is now ringing on someone else's device.
• Unexpected account alerts. Emails or app notifications about password resets, new logins, two-factor changes or "your number was updated" that you didn't initiate — often arriving in a rush as the attacker works through your accounts.
• Carrier notifications. A text or email from your carrier about a SIM change, port request or account update you didn't make. Some carriers send these; if you get one and didn't act, move immediately.

The response to any of these, especially the abrupt loss of service combined with account alerts, is to act fast: contact your carrier by another means to freeze and reverse the port, and lock down your most critical accounts — starting with email and any crypto exchange — from a device that still has connectivity.

4. How Helix raises the alarm

Here is where we're going to be unusually direct about a limit, because honesty is the whole point of how Helix works, and the SIM-swap problem is one where overpromising would be dangerous.

The swap itself happens at your carrier, not on your device — so no app, Helix included, can "see" the port-out being processed inside the carrier's systems. What an app on your phone can do is notice the device-observable consequences and the surrounding signals, and turn the moment into awareness and an action plan. Helix's role is to raise the alarm and arm you with the defenses, not to pretend it can reach into a phone company's back office.

Concretely, that means Helix focuses on what's actually achievable on the device: surfacing the kind of abrupt connectivity change and account-alert pattern that accompanies a swap, and — most importantly — making sure you've set up the defenses before an attack, because for SIM swapping the prevention is far stronger than any after-the-fact detection. Helix walks you through setting a carrier port-out PIN and moving your two-factor authentication off SMS, and keeps that guidance in front of you, because those two steps do more to stop a swap than any alert ever could. Awareness of the signs tells you when to react; the prevention steps mean there's far less to react to.

Consistent with the rest of Helix, the posture is inform and empower, not false reassurance. We'd rather make sure your port-out PIN is set and your codes are off SMS than sell you a "SIM-swap detector" that implies a guarantee no on-device app can honestly make.

5. The defenses that actually work

This is the most valuable section, so we put the real answers front and center. Two steps do the overwhelming majority of the work, and everyone reading this should do both today.

1. Set a carrier port-out PIN (or number-transfer lock). Every major carrier offers a way to add a PIN, passcode or transfer lock that must be provided before your number can be moved to another SIM or carrier. This is the single most effective defense, because it attacks the swap at its source: even an attacker armed with your personal details can't talk a call center into porting your number if they can't supply the PIN. Call your carrier or use their app, set a strong, unique PIN you don't use elsewhere, and confirm the number-transfer lock is enabled. This one step turns the easy social-engineering attack into a much harder one.

2. Move your two-factor authentication off SMS. The reason a swap is catastrophic is that so many accounts fall back to a texted code. Take the prize away: switch your critical accounts — email first, then crypto exchanges, then banking and anything that controls money or identity — to an authenticator app (time-based codes generated on your device) or, better still, a hardware security key. These don't depend on your phone number at all, so a stolen number gets the attacker nothing. Where a service lets you remove the phone number as a recovery method entirely, do it. App-based and hardware-key two-factor are dramatically stronger than SMS, and they neutralize the entire SIM-swap payoff.

A few reinforcing habits compound with those two:

• Don't use your real phone number as a public recovery method. The less an attacker can tie your number to your high-value accounts, the less a swap is worth.
• Be stingy with personal data. The information that lets an attacker impersonate you to a call center comes from breaches, phishing and oversharing. Less out there means a harder impersonation.
• Know your carrier's emergency process. Have a way to reach them that doesn't depend on the number being swapped, so you can move fast if it happens.

6. Who this is for

SIM-swap defense matters most for people whose accounts are worth the impersonation effort.

• Crypto holders and whales. The number-one target. A swap into an exchange account or a credential-reset chain can end in an irreversible drain. The port-out PIN and off-SMS 2FA are not optional for anyone holding meaningful crypto.
• UHNW principals and family offices. A number that controls email, which controls everything, is a single point of catastrophic failure. Locking the number and hardening the second factor protects the whole estate's digital perimeter.
• Executives and dealmakers. Account takeover via SIM swap can expose communications, authorize fraudulent actions, and impersonate you to staff and partners. The defenses are cheap insurance against an expensive impersonation.
• Anyone publicly known to hold value. Visibility attracts swappers. If your wealth, role or holdings are searchable, assume you're a candidate and lock the number now.
• Anyone targeted. A determined adversary in a personal dispute can gather the details and make the call. The port-out PIN is the wall that stops the easy version cold.

7. How Helix does it

SIM-swap awareness is one capability inside Helix's device-security pillar — the shield that defends the physical and digital perimeter around you, sitting alongside the spyware detection, the screen-capture alert, the BadUSB keystroke shield and the daily file scan. The design philosophy is the same throughout: do the work on your own device, keep nothing in a cloud, and tell you the truth about what the tool can and cannot do.

For SIM-swap defense, that means:

• Awareness, not pretense. Helix surfaces the device-observable signs that accompany a swap — abrupt connectivity loss, account-alert patterns — and tells you to treat them seriously, while being honest that the swap itself happens at the carrier, beyond any app's reach.
• Prevention front and center. Because prevention beats detection here, Helix's main job is to walk you through and keep reminding you of the two steps that work: a carrier port-out PIN and off-SMS two-factor.
• Inform and empower. Helix gives you the action plan for the moment a swap is suspected — reach the carrier by another means, lock down email and crypto first — rather than a false promise of automatic interception.
• Part of a posture, not a gadget. The SIM-swap layer fits a broader account-takeover defense: a hardened device, the encrypted network, and the habits that keep your number out of attackers' reach.

8. Honest limits — read this part

No serious security tool should oversell itself, and SIM-swap awareness has a hard, fundamental boundary you must understand for it to be useful rather than falsely reassuring.