Yes, someone can steal your identity using your phone number. The number itself is not the prize; it is the lever that pries open everything else, because banks, email providers, and social media accounts treat a working phone number as proof that you are you. An attacker who takes control of your number, or who simply looks it up in the right database, can reset passwords, intercept verification codes, and gather the personal details needed to impersonate you convincingly.
How a Phone Number Becomes Identity Theft
The most damaging attack is a SIM swap. A criminal calls your mobile carrier, claims to be you, and asks to activate your number on a new SIM card. Armed with your date of birth or the last four digits of your Social Security number, usually scraped from an earlier data breach, they can often talk a customer service representative through the switch. Your phone drops to “SOS only” or “No Service.” Every call and text meant for you now goes to their device, including the verification codes that protect your accounts.
A port-out scam works the same way but transfers your number to a different carrier entirely. Recovery takes longer because your original carrier no longer controls the number.
Voicemail is a quieter back door. Many carriers still ship accounts with default PINs like 0000 or the last four digits of the number itself, and many people never change them. Attackers can also spoof your caller ID when dialing into the voicemail system, and some carriers read that as the account holder calling and skip the PIN entirely. Once inside, they can listen for two-factor codes delivered by voice call and pick up personal details left by doctors, banks, and family. Your phone keeps working normally the whole time.
Even without hacking anything, a phone number by itself opens a filing cabinet. Reverse lookup services pull from public records, marketing databases, and social media to return a full name, current and past addresses, email addresses, and the names of family members. That is exactly the material used to answer security questions: mother’s maiden name, childhood street, city of birth.
Attackers also work the number from the outside. Using Voice over Internet Protocol tools, they can spoof outgoing calls so your name and number appear on someone else’s screen, then run a scam under your identity — especially effective against older relatives who trust caller ID. Smishing, the text-message version of phishing, arrives from the other direction. The FCC has warned of a steady rise in SMS scams posing as banks, delivery services, or the IRS, with links to counterfeit sites built to harvest logins and financial details.1Federal Communications Commission. Avoid the Temptation of Smishing Scams If your number has surfaced in a breach, these texts can carry your name or partial account details and read as legitimate.
What an Attacker Does Once They Have the Codes
Control of your number is valuable because of what it unlocks. The attacker clicks “forgot password” on your email, bank, or investment account. The platform texts a verification code. The attacker enters it, resets your password, and locks you out. The process takes minutes.
Your primary email is the worst account to lose, because it is the recovery address for everything else. Once inside, an attacker can scan your inbox for account confirmations and statements, take over each one in turn, and change the recovery email and phone number on the way out so you cannot get back in.
The Clock on Bank Losses
Federal law caps your liability for unauthorized electronic transfers, but the cap depends entirely on how quickly you report. Notify your bank within two business days of discovering the breach and your maximum liability is $50. Wait longer than two business days and the ceiling jumps to $500. Miss unauthorized transfers that appear on a periodic statement for more than 60 days and you can be liable for every dollar stolen after that 60-day window closes.2eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
Speed is the only thing standing between a $50 loss and a potentially unlimited one. The moment your phone loses service unexpectedly, your first call needs to be to your bank, not just your carrier.
Stop Using Text Messages for Two-Factor Authentication
The single most effective change you can make is to stop relying on SMS for two-factor authentication. Every account that offers an alternative should be switched.
Authenticator apps generate time-based codes that refresh every 15 to 30 seconds and are tied to your physical device rather than your phone number. A SIM swap is useless against them, because the attacker would need your actual phone to generate a valid code. Most major banks, email providers, and social media platforms support authenticator apps; look in your account security settings under “two-factor authentication” or “two-step verification.” Google Authenticator, Microsoft Authenticator, and Authy are the most widely used.
Lock Down Your Carrier Account
Most major carriers offer free protections that directly block SIM swaps and unauthorized port-outs, but they are usually not on by default. The names vary. T-Mobile calls them “SIM Protection” and “Port Out Protection.” Other carriers use terms like “Number Lock” or “Account Takeover Protection.” The function is the same: no one can move your number to a new device or a new carrier without extra verification beyond a standard customer service call.
Call your carrier and ask specifically for both SIM change protection and port-out protection. Some carriers require you to enable these on each line individually. Set a unique account PIN or passphrase while you are on the line, not your birthday, not the last four of your Social Security number, and not anything a reverse lookup would return. That PIN is the barrier a social engineer has to clear.
Change your voicemail PIN too. If your carrier offers the option to require a PIN even when calling from your own number, turn it on.
If Your Number Has Already Been Compromised
Unexpected loss of service or an “SOS only” indicator is an emergency. Use a different phone to call your carrier’s fraud department right away. You will need a government-issued ID and your account PIN to reclaim the number. Once service is restored, change the password on your email first, because it is the recovery key for everything downstream, then move to your financial accounts.
Freeze Your Credit
Place a credit freeze with all three bureaus: Equifax, Experian, and TransUnion. A freeze blocks anyone from opening new credit accounts in your name. Federal law requires the bureaus to place and remove freezes for free, and online or phone requests must be processed within one business day.3Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts You can lift the freeze temporarily whenever you need to apply for credit.
A fraud alert is a lighter alternative. An initial fraud alert lasts one year and tells lenders to verify your identity before approving new credit. Victims who have filed an identity theft report with the FTC or police can place an extended fraud alert that lasts seven years and also removes them from pre-screened credit offer lists for five years.4Federal Trade Commission. Credit Freezes and Fraud Alerts A fraud alert placed at one bureau is automatically shared with the other two, unlike a freeze, which you must place at each bureau separately.
File an Identity Theft Report
Report the theft at IdentityTheft.gov, the FTC’s dedicated portal. The site generates a formal FTC Identity Theft Report and a personalized recovery plan.5Federal Trade Commission. Identity Theft – IdentityTheft.gov You will need the report to dispute fraudulent accounts with creditors, and it is required for an extended fraud alert. Some creditors will also ask for a signed identity theft affidavit; notarization requirements vary, so ask before paying for a notary.
Protect Your Tax and Social Security Records
A criminal with enough of your personal information can file a fraudulent tax return in your name. The IRS offers an Identity Protection PIN, a six-digit number that must appear on your return before the IRS will process it. Anyone with a Social Security number or ITIN can request one through their IRS online account. Taxpayers who cannot verify online and whose adjusted gross income is below $84,000 (or $168,000 for married filing jointly) can apply on Form 15227 and receive the PIN by mail in four to six weeks.6Internal Revenue Service. Get an Identity Protection PIN A new PIN is issued each year through your online account starting in mid-January.
If you suspect someone used your identity for work, check your Social Security earnings record for wages you did not earn. Corrections can be requested through a my Social Security account or by calling the SSA at 1-800-772-1213, with W-2s or pay stubs to support the change. Corrections generally must be made within three years, three months, and fifteen days of the end of the tax year in question, with exceptions for certain errors.7Social Security Administration. How Do I Correct My Earnings Record
Keep a log of every call to carriers, banks, and government agencies through the recovery process, with the date, the representative’s name, and what was discussed. That record matters if a dispute drags on or you need to escalate.