Set a PIN or passcode on your mobile carrier account, protect the account with its own strong password and multi-factor sign-in, and store both in a password manager. CISA lists the carrier PIN as a key step against SIM swapping, because porting a number needs that PIN.
What the PIN protects
In a SIM swap, an attacker convinces a carrier, or an insider, to move your number to a SIM they control. Text messages and calls then go to them. Any account that uses SMS for sign-in or recovery is now exposed.
CISA says most carriers let you add an extra PIN or passcode that is required to log in to the account or to complete sensitive operations, such as porting a number. The guidance says to add a PIN and MFA to the carrier account to reduce SIM-swapping risk, then use a password manager to change the account password.
Steps
- Sign in to your carrier account from the official app or site. Type the address yourself.
- Find the security or privacy settings. Names vary by carrier. Look for account PIN, passcode, number lock or port-out protection.
- Set a PIN that is not a birthday or phone digits. Generate it in your password manager if the carrier allows long values.
- Turn on multi-factor sign-in for the account, using an authenticator or passkey rather than a text to the same number.
- Change the account password to a long random one from your password manager.
- Review authorized users. Remove anyone who no longer needs access.
- Ask what staff need to see before moving the number. If the carrier can describe its process, note it down.
If you cannot find the setting, call the carrier from a number you trust and ask what protections exist against unauthorized port-out. We have not verified specific menu names for any carrier, so rely on their own help pages.
Store it where you can find it
A PIN you cannot remember is a support call on a bad day. Store it with the account entry in your password manager. Make sure your emergency access plan, covered in our post on legacy contacts and inactive account plans, includes the carrier account.
What a PIN does not fix
A PIN will not help if the attacker already has your email and resets your carrier login. It will not stop someone who tricks you into reading out a one-time code. And it does not remove SMS as a recovery route on your other accounts.
So pair it with the steps in turning off the SMS fallback.
Signs your number may have been moved
- Your phone suddenly shows no service while others nearby have it
- Unexpected password reset or login codes arrive just before that
- Contacts report odd messages from you
Call the carrier from another phone, then secure email first.
Quick check
Does a carrier PIN stop all SIM swapping?
No. It blocks a common route, since porting requires it, but it does not help if your carrier login is itself compromised.
Sources
Last reviewed: 19 October 2026.
