SIM Swap Fraud: How to Protect Business Mobiles

Last checked: 9 November 2026

SIM swap fraud is when a criminal persuades a mobile network to move your phone number onto a SIM they control, so your calls and texts, including one-time security codes, go to them instead of you. For a business, that can mean a takeover of email, banking, accounting or supplier accounts that rely on text codes. The best protection is to stop relying on text codes for important logins, lock down who can change your mobile account, and act within minutes if a phone suddenly loses service.

This guide explains how SIM swap fraud works, how big the problem is in the UK, what the networks say they do to stop it, and a practical checklist for protecting a company mobile fleet.

What is SIM swap fraud?

Vodafone describes it as fraud where "scammers take control of a phone number by switching the service from the customer's SIM" to one they hold, after impersonating the customer to the network. EE warns that a swap "can give access to personal information and allow the fraudster to receive validation codes" used "for approving payments and accessing accounts".

The attack usually follows the same pattern:

Research. The fraudster gathers personal details about the target, often from data breaches, phishing or social media.
Impersonation. They contact the network (or use a stolen online account login) and ask for a replacement SIM or eSIM, claiming the original phone was lost or broken.
Takeover. Once the number is active on their SIM, the victim's phone loses service and the fraudster starts receiving calls and texts.
Account access. They request password resets and text-message codes for email, banking and other services.

A similar attack uses a fraudulent switch to another network (a porting request) rather than a replacement SIM on the same network. Three groups the two together as "SIM swap and PAC fraud".

How common is SIM swap fraud in the UK?

It rose sharply in 2024. Cifas, the UK fraud prevention service, reported in Fraudscape 2025 that unauthorised SIM swaps rose by 1,055% in 2024, with nearly 3,000 cases recorded by mobile providers. Mobile phone accounts made up 48% of account takeover filings in that report, more than any other sector.

The numbers show that networks are a target, not that every attempt succeeds. Some operators report falls on their own networks after adding checks: Vodafone says SIM swap fraud cases affecting its customers fell 86% between January 2024 and January 2025, and Three said in 2021 that it saw a 95% fall in reports of SIM swap and PAC fraud after introducing multi-factor authentication.

Why are businesses a target?

A business mobile number is often the recovery route for far more than one person's accounts. A director's or finance manager's number may receive codes for:

Business bank accounts and payment approvals
Microsoft 365 or Google Workspace admin accounts
Accounting and payroll software
Domain, website and social media accounts
Supplier portals and the mobile account itself

If those codes go to a fraudster, the damage can spread from one phone to the whole company. That is why the most important defence is not on the phone at all: it is how your other accounts verify who is logging in.

Warning signs of a SIM swap

Warning sign	What it might mean	What to do now
The phone suddenly shows "No service" or "SOS only" where it normally has signal	The number may have been moved to another SIM	Call the network from another phone straight away
A text or email from your network about a SIM change, eSIM transfer or PAC/STAC request you did not make	Someone has requested a change on the account	Contact the network using the number on its website or your bill, not one in the message
Password reset emails or login alerts you did not trigger	Someone is using codes sent to your number	Lock the affected accounts and alert the bank
An unexpected call "from your network" asking you to read out a code	The caller may be trying to authorise a swap	Hang up; never read out a one-time code

Vodafone advises customers not to ignore "warnings or notifications about unexpected or suspicious activity" on their account, and warns that a one-time code marked for online use should never be used over the phone, or the other way round.

What UK networks do to stop SIM swaps

Each network sets its own checks, and they change over time, so ask your provider what applies to your business account. The networks' own published information says:

Vodafone: online SIM swap requests need the My Vodafone username and password and generate a one-time code; requests by phone can only be authorised by a senior member of the customer care team; customers are notified of every SIM swap request; and banks can check through Vodafone whether a number has recently had a SIM swap.
Three: uses multi-factor authentication to verify "when a genuine customer is trying to access account information".
EE: asks customers who have been victims of fraud on their account to report it "as soon as possible", and its fraud team investigates. Suspicious texts can be forwarded free to 7726.

On a business account there is often an extra layer: changes may need to come from a named account administrator. Check who those administrators are, and remove anyone who has left.

How to protect your business from SIM swap fraud

1. Move important logins off text-message codes

This matters more than anything else. The NCSC's guidance on multi-factor authentication for corporate online services ranks methods by strength and says message-based methods (email, SMS and call-based) "are only likely to be appropriate when no other strengthening method is possible". It puts FIDO2 credentials, which it calls "one of the most secure, yet usable methods of MFA", at the top, followed by app-based approval and code generator apps.

In practice that means using passkeys, security keys or an authenticator app for email, Microsoft 365 or Google Workspace, banking and accounting software, and removing the phone number as a recovery option where the service allows it. The NCSC also notes that any two-step verification is still better than none, so text codes are a fallback, not something to switch off without a replacement.

2. Lock down the mobile account itself

Use a strong, unique password for the network's online account and turn on any extra verification it offers.
Ask your network what security it offers for SIM changes and porting on a business account, such as a password, PIN or authorised contact list.
Limit who is allowed to request SIM replacements, eSIM transfers or PAC/STAC codes, and keep that list current.
Make sure the notification email address on the account goes to someone who will read it, not an old mailbox.

3. Reduce what fraudsters can learn

SIM swap attempts depend on personal details. Train staff not to share mobile numbers, dates of birth or account details with unexpected callers, and treat any call asking for a one-time code as a scam. Our business mobile cyber security guide covers phishing and social engineering on staff phones.

4. Set a SIM PIN

A SIM PIN stops someone using a lost or stolen SIM in another phone. It does not stop a remote SIM swap at the network, but it closes a related gap. Our lost or stolen business phone guide explains what else to do when a device goes missing.

5. Write down a response plan

Decide in advance who calls the network, who calls the bank and who resets passwords, and keep those numbers somewhere that does not depend on the affected phone.

What to do if you think a business number has been SIM swapped

Call the network immediately from another phone, using the number on its official website or your bill. Ask it to stop any SIM change or port and restore the number.
Contact your bank using a number you know is genuine. The Stop Scams UK 159 service connects callers to their own bank and covers customers of more than 99% of UK retail bank current accounts.
Secure your accounts: change passwords for email and finance systems, sign out other sessions and check for new forwarding rules or recovery details.
Report it. In England, Wales and Northern Ireland, report fraud and cyber crime to Report Fraud, which replaced Action Fraud on 4 December 2025, at reportfraud.police.uk or on 0300 123 2040. In Scotland, Police Scotland asks for fraud to be reported on 101.
Keep a written record of every call, reference number and change, including the time the phone lost service.

Worked example: protecting a 12-phone business

Picture a firm with 12 company mobiles, where the two directors and the bookkeeper receive banking and Microsoft 365 codes by text.

Week 1: list every system that sends codes to those three numbers. Move Microsoft 365 and the banking app to an authenticator app or passkeys, and remove the mobile numbers as recovery options where possible.
Week 1: ask the network which security options are available for SIM changes and porting on the business account, and set up the ones it offers. Confirm only the office manager and one director can request SIM or PAC changes.
Week 2: brief all 12 users: if the phone shows no service unexpectedly, call the office manager from another phone, and never read a code to anyone who calls.
Ongoing: when someone leaves, remove them as an authorised contact the same day. Our guide to deleting business data from a personal phone covers the device side.

None of this needs new phones. Most of it is settings and process, which is why it is worth doing before anything goes wrong.

Frequently asked questions

What is SIM swap fraud?

It is when a criminal gets a mobile network to move your number onto a SIM or eSIM they control, usually by pretending to be you. They then receive your calls and texts, including security codes, and use them to get into your accounts.

How do I know if my SIM has been swapped?

The most common sign is a phone that suddenly shows no service where it usually has signal. You may also get a message from your network about a SIM change or switching request you did not make, or password reset alerts you did not trigger. Call your network from another phone straight away.

How do I prevent SIM swap fraud on business mobiles?

Move important logins away from text-message codes to passkeys, security keys or authenticator apps, as the NCSC recommends. Then protect the mobile account with a strong password and whatever extra checks your network offers, limit who can request SIM or porting changes, and train staff never to share one-time codes.

Can a fraudster port my business number to another network?

A fraudulent porting request is a recognised version of the same attack: Three refers to "SIM swap and PAC fraud" together. Limiting who can request PAC or STAC codes on your business account and acting quickly on any unexpected switching message are the main defences. Our switching guide explains how genuine switches work.

Who do I report SIM swap fraud to?

Tell your network and bank first. Then report it to Report Fraud (reportfraud.police.uk or 0300 123 2040) in England, Wales and Northern Ireland, or to Police Scotland on 101 in Scotland.

Is eSIM safer than a physical SIM?

Not on its own. An eSIM can be transferred by the network in the same way a physical SIM can be replaced, so the same account checks and the same move away from text-message codes apply.

Related guides

Sources

Compare secure business mobile options

Tell us how many lines you have and how your account is managed, and we will help you compare business mobile options with the account controls you need.

Get a free business quote