A stolen phone number has quietly become one of the fastest routes into an older American’s bank account. In a port-out scam, a criminal poses as the account holder, opens service at a competing carrier, and arranges to have the victim’s number transferred to a phone the criminal controls. A closely related trick, the SIM swap, moves the number to a new card at the victim’s own carrier. Either way, the text messages a bank sends to confirm a login or approve a transfer land on the attacker’s device instead of the customer’s, and the theft often begins before the phone owner knows anything is wrong.
How a hijacked number turns into an emptied account
The damage starts the instant the transfer goes through. Once the number rides on the attacker’s phone, every call and text meant for the account holder arrives there instead. Banks, brokerages, and email providers routinely send one-time passcodes by text to confirm that a login is legitimate, so the criminal can trigger those codes, read them as they arrive, and step past the second layer of security on one account after another. The victim’s own phone, meanwhile, shows no service at all.
Federal regulators describe the sequence in plain language. The Federal Communications Commission’s warning about port-out fraud explains that a bad actor transfers the number to a carrier the criminal controls, then rushes to reset passwords on financial and email accounts before the victim reacts. Because the phone goes dark first, the earliest clue is often a device that suddenly cannot call or text for no obvious reason, hours before any fraudulent charge appears on a statement.
Older account holders make attractive targets for a specific reason. Retirement and savings balances tend to be larger and less frequently checked than a working household’s churning checking account, so a thief who wins control of the phone may move money for hours before anyone logs in to notice. The same text-code system that protects a younger, app-savvy customer becomes the exact tool that betrays someone who relies on a bank’s default text alerts and rarely questions why a message failed to arrive.
Free retirement updates: Scam calls targeting retirees change every week. The free Retirement Shield newsletter flags the ones going around and the one tell that stops each. Sign up free.
Why the text-message code is the weak point
The vulnerability is not the bank’s app or the carrier’s network but the ordinary text message. Many institutions still accept a code sent by SMS as proof of identity, a convenience that turns against the customer the moment the number is stolen. Security specialists have long flagged text-based verification as the weakest common form of multi-factor authentication precisely because a hijacked number hands it over in full, with no password-guessing required and no warning to the account holder.
Regulators recommend a sturdier second factor. The Federal Trade Commission advises consumers worried about a SIM swap to move sensitive logins onto an authentication app or a physical security key rather than a texted code, since neither can be redirected by transferring a phone number. An authentication app generates the code on the device itself, so the number never travels across the cellular network where an attacker waiting on a hijacked line could intercept it.
There is only a narrow window to react. Because the stolen number stops working on the real owner’s phone, that dead signal is itself the alarm; a customer who treats an unexpected, total loss of service as a possible attack, rather than a network glitch, can call the carrier from another line and freeze the account before the passwords fall. Waiting until morning is often long enough for the money to be gone and the passwords already changed.
The carrier lock and the rules meant to slow the fraud
The industry’s own safeguards have tightened in recent years. In 2023 the FCC adopted rules to protect cell phone accounts that require wireless carriers to use secure methods to verify a customer before moving a number to a new device or provider, and to notify the account holder immediately whenever a SIM change or port-out request is made. The rules aim to close the gap that let a scammer talk a call-center agent into an unauthorized transfer.
Those rules do not replace the customer’s own line of defense. The FCC’s guidance on cell phone fraud urges account holders to set a unique PIN or passcode on the wireless account so a stranger cannot authorize a transfer, and to place a fraud alert with one of the three credit bureaus, which is then required to notify the other two. Both steps are free, take only minutes to arrange, and hold regardless of how convincing the impostor sounds on the phone.
The financial stakes explain why the number matters more than the handset. A hijacked line is rarely the goal in itself; it is the key that unlocks the checking account, the retirement account, and the inbox used to reset everything else. For an account holder living on a fixed balance, a single successful swap can move money that no consumer-protection rule guarantees will be returned in full, and recovering it can take weeks of disputes.
Speed ultimately decides the outcome. The one advantage the account holder keeps is that sudden loss of service, which usually arrives before the attacker has finished draining accounts, and a carrier PIN paired with an app-based code buys back the minutes that a texted passcode gives away. The tools cost nothing and already exist; what stays uneven is how quickly a customer notices the phone has gone silent and how fast the carrier responds when the call for help finally comes in.
This article was produced with AI assistance and reviewed against primary sources by The Money Overview editorial team.
More Financial Reading
