A US mobile carrier account controls a phone number, and the number is the recovery path for email, banking and social accounts. The email address on the account is protected with one dedicated alias that stays active permanently, an app-based second factor instead of SMS codes, and the carrier number lock switched on at signup.
The carrier account and the phone number#
A SIM swap moves the number onto a SIM card controlled by an attacker, and a port-out moves it to a different carrier under the attacker's control. The Federal Communications Commission defines a SIM swap as a bad actor convincing a carrier to transfer a victim's service to a phone in the attacker's possession. Once the number moves, calls and texts go to the attacker, including SMS verification codes for email, banking and social accounts.
The FBI Internet Crime Complaint Center recorded 982 SIM swap complaints and $25,983,946 in reported losses in the United States in 2024. An earlier FBI announcement, public service announcement I-020822-PSA, recorded 1,611 SIM swapping complaints in 2021 with adjusted losses of more than $68 million. Both sets of figures count only complaints made to the FBI, so the real total is higher.
SIM swap and port-out rules#
The Federal Communications Commission adopted rules on SIM swap and port-out fraud on 15 November 2023, in Report and Order FCC 23-95. The rules require wireless providers to adopt secure methods of authenticating a customer before redirecting a phone number, to notify customers immediately whenever a SIM change or port-out request is made, and to offer customers the option to lock their accounts against SIM changes and number ports. The rules apply to wireless providers including resellers, for prepaid and postpaid customers. Carriers may not rely on readily available biographical information or account information as the secure method of authentication, so a date of birth or a billing address is not treated as a secret. The account PIN, the number lock and the second factor carry the weight instead of the personal details given at signup.
Secondary reports disagree on the compliance timing of individual provisions, so this article states the adoption date and the requirements without claiming a compliance date for every provision. The FCC's December 2023 enforcement advisory described the changes as not yet in effect, while later summaries give 8 January 2024 as the effective date, with some information-collection provisions held back pending Office of Management and Budget review.
The email address on the account#
The email address given at carrier signup is a dedicated alias used for the carrier and for nothing else. One dedicated alias per carrier keeps the account isolated, so a breach at a shop, a forum or a streaming service cannot expose the address that recovers the carrier account. The pattern is the same one described in a separate email for every website, applied to the account where it matters most. The same permanence rule applies to account recovery: an alias used for recovery must still work when recovery is needed, years after signup.
A carrier account needs its email address for recovery for as long as the number exists. An alias that is deleted or allowed to lapse removes the recovery path for the number, so the carrier alias is kept alive for the life of the account.
The primary inbox behind the alias needs the same attention, because if it is protected only by SMS codes sent to the carrier number, a SIM swap breaks both at once. An address can be checked for past breaches at Have I Been Pwned before it is given to the carrier.
Number locks#
Each major US carrier offers a free number lock, and the lock is switched on at signup. The names differ by carrier, but the function is the same: the lock blocks SIM changes and number transfers until the account holder switches it off. The locks are opt-in and must be switched on, so they only help when the account holder turns them on.
| Carrier | Lock | Where it is switched on |
|---|---|---|
| T-Mobile | SIM Protection and Port Out Protection | T-Life app: Manage tab, gear icon, Security, SIM Protection; T-Mobile.com: Profile, Security, SIM Protection |
| Verizon | SIM Protection and Number Lock | My Verizon app or website, under Security settings |
| AT&T | Wireless Account Lock | AT&T app only; standalone tablet or hotspot locks are managed by contacting AT&T |
T-Mobile offers two features. SIM Protection is a free feature for T-Mobile postpaid customers that prevents bad actors from moving a number to another device. Account Takeover Protection blocks unauthorised users from transferring lines to another wireless carrier, and it must be added to each line individually. Only the Primary Account Holder can remove SIM Protection. T-Mobile also requires an account PIN of 6 to 15 non-sequential numbers, which cannot be a date of birth or a Social Security number.
Verizon splits the protection into two toggles. Number Lock is free and prevents a mobile number from being moved to another carrier, and a locked number cannot generate a Number Transfer PIN. Verizon states plainly that Number Lock does not prevent SIM card changes or equipment changes, so SIM Protection is needed as well. A Number Transfer PIN expires after 7 days.
AT&T combines the protection into one switch: Wireless Account Lock is a free security feature. When the lock is switched on or off, AT&T sends a confirmation email to the account email address and a text message to the wireless device. Account holders outside the United States need their own carrier's equivalent lock, and carrier app menu paths change often, so the locations above are taken from the carriers' own support pages as opened on 2026-11-11.
A number lock depends on carrier staff following the verification procedure when an attacker calls or visits a store. In August 2019, attackers took control of Twitter chief executive Jack Dorsey's account after tricking his mobile provider into handing over his number, an incident Twitter attributed to a security oversight by the mobile provider. The lock reduces the risk and does not remove it, which is why the second factor must not depend on SMS.
The second factor#
The second factor on the carrier account is app-based, never SMS-only. The Federal Trade Commission states that text message verification may not stop a SIM card swap, and recommends an authentication app or a security key for accounts with sensitive personal or financial information. The FTC's two-factor authentication guidance adds that an authenticator app is safer than a text message code because the passcode it generates is not susceptible to a SIM card swap attack, and that a security key is the strongest method.
An authenticator app generates codes on the device from a shared secret, so no code travels over the phone network and no number is involved. A SIM swap gives the attacker the number, but the app codes are generated on the owner's device and the attacker does not have them. NIST SP 800-63B-4 requires applications at Authentication Assurance Level 2 to offer a phishing-resistant authentication option. Some carrier steps still use SMS: AT&T sends a one-time code by SMS to validate switching Wireless Account Lock on or off, so where SMS is the only option for a particular step, the number lock and the account PIN carry the protection instead. The same rule applies to the email account behind the alias: two-factor authentication codes can be received at an email alias, but the codes are only as safe as the inbox they land in.
Alias rejection at signup#
Some websites reject alias domains at signup, usually through a blocklist of domains associated with alias services or short-lived inboxes. AliasFleet's own article on alias detection states that some websites can detect an alias, usually from its domain, but that detection is not rejection, and that many detected aliases are accepted. No carrier-published policy was found stating that T-Mobile, Verizon or AT&T block alias domains at signup, and this article does not claim that any named carrier does so. If a carrier signup rejects the alias, the fallback is a permanent address on a domain the account holder controls, or a mainstream provider address kept only for the carrier account. The question of whether aliases are safe in general is covered in the AliasFleet guide on alias safety.
Recovery planning#
Recovery planning is done at signup, while the account holder still controls the number and the inbox. The same pattern for another high-value account is described in the password-manager signup guide.
If a SIM swap happens, the FTC advises contacting the cellular service provider immediately to take back control of the phone number, then changing account passwords, checking bank and card accounts for unauthorised charges, and going to IdentityTheft.gov if Social Security, card or bank account numbers may have been stolen. The email account is secured first, because it is the route to every other account. The warning signs named by the FTC are a phone that suddenly stops working, or an unexpected notification that the SIM card has been activated on a new device.
AliasFleet and the carrier account#
AliasFleet provides managed forwarding aliases, with one dedicated alias per service, forwarding to a verified destination inbox. A carrier alias forwards carrier mail to the primary inbox, and it can be paused or disabled if it starts receiving spam, without changing the primary inbox address. The free plan includes 10 active aliases, as listed on the pricing page.
AliasFleet does not stop a SIM swap. The number lock, the account PIN and the app-based second factor do that work, and they belong to the carrier. What AliasFleet does is keep the carrier account isolated from every other signup, so a breach elsewhere does not hand an attacker the address that recovers the number.
Measures at signup#
At signup, one dedicated alias is created for the carrier account and used nowhere else, and it stays active for the life of the account. An app-based second factor, never SMS-only, protects both the primary inbox behind the alias and the carrier account itself. The carrier number lock is switched on at signup, in the carrier app or account settings, and an account PIN is set that is not a date of birth, a Social Security number or any other readily available personal detail. Backup or recovery codes for the email and carrier accounts are saved in a password manager or on paper in a safe place, with the authenticator app backed up or enrolled on a second device.
