← Back to Blog Mobile Security

SIM swap attacks: how a stolen phone number can take over your kid's accounts

Photo by User_Pascal on Unsplash

Most account-security advice for kids is about the phone in their hand: a lock screen, a strong password, don't tap strange links. A SIM swap skips all of that. The phone stays in your kid's pocket, still locked, still working, right up until it suddenly shows "No service." By then the phone number is live on a SIM card somewhere else, and every account that sends a login code by text is sending it to someone else.

A phone number belongs to the carrier account, not the physical phone. Carriers can move a number to a new SIM or eSIM, which is exactly what should happen when someone loses a phone. In a SIM swap, an attacker asks for that same move while pretending to be the account holder. Usually they call support or walk into a store with enough personal details to pass the identity check, and sometimes they have help from a bribed insider.

Once the number moves, the attacker taps "forgot password" on the accounts tied to it. A reset code arrives by text, and the account is theirs.

This is a small crime by volume, but it hasn't gone away. The FBI's 2025 Internet Crime Report, published this year, lists SIM swapping as its own crime category, with about $17.4 million in reported losses in 2025. That figure only counts cases people actually reported to the FBI. (FBI IC3 2025 Annual Report)

Kids rarely have bank accounts worth draining. What they do have is a phone number used as the recovery method for nearly everything: game accounts with paid skins and currency, a social account with a rare short username, a school email, sometimes a family streaming or shopping login. Gaming and social accounts get resold, and a hijacked social account can message every one of your kid's friends and ask for money or photos.

A quick way to see the exposure is to ask your kid which apps have ever sent them a code by text. Each one is an account that follows the phone number, wherever the number goes.

Your kid's line is almost always on your plan. The carrier treats you as the account holder, which means the protections that stop a swap are yours to turn on. Your kid can't do it for their own line, and an attacker impersonating you is trying to get past your identity check, not theirs.

• Turn on your carrier's number lock or port-out PIN. Most major carriers now offer a free setting that blocks SIM changes and number transfers until the account holder turns it off. Check it for every line on the plan, not just your own.
• Move important accounts off text-message codes. Where an app supports it, an authenticator app or passkey is tied to the device, not the number, and a SIM swap can't intercept it.
• Keep the carrier account's own details private. Account numbers, security answers, and the account PIN are exactly what an attacker needs to pass the identity check.
• Don't confuse this with the SIM PIN. The SIM PIN in Android's settings stops someone from using a SIM card that's been physically removed. It does nothing against a swap done at the carrier.

The clearest sign is one phone losing all signal while every other phone on the plan works fine. Other signs are texts about a SIM change or a "new device" login that nobody asked for. If you see these:

1. Call the carrier from another phone right away. Ask them to reverse the SIM change and freeze the line.
2. Reset the passwords on the most important accounts, starting with the email account the others recover through.
3. Check game and social accounts for new logins or changed recovery details, and tell your kid's friends to ignore any money or photo requests from those accounts.
4. Report it. In the US that's the FBI's IC3 site. Elsewhere, use your national cybercrime reporting portal.

No. Nothing installed on a phone, Paxio included, can stop a SIM swap, because it happens entirely on the carrier's side. The number lock above is the real defense, and only the account holder can turn it on. What Paxio's content filtering can do is block known phishing pages at the DNS level. Those fake "verify your account" pages are often where attackers collect the personal details they later read to carrier support.

Paxio's content filtering catches those known phishing pages in the background. The carrier lock is still a five-minute call you make yourself.

See why families choose Paxio for the broader set of protections beyond account security.

Try Paxio free →