Start with the carrier, not the reset button
A password reset and a SIM swap can look similar from the outside: you cannot get in, and the code that used to arrive by text does not work. The difference is where the failure sits. A forgotten password is a problem inside one account. A SIM swap is a problem with the phone number itself, and it can block every account that depends on that number at once.
So the first decision is not “which password do I reset?” It is “does my number still belong to me?”
Signals that point to the number, not the password
Use the pattern of failures, not a single symptom, to decide which checklist to run.
| What you observe | More likely explanation | First move |
|---|---|---|
| One service rejects your password; calls and texts still arrive normally | Forgotten or mistyped password | Normal account recovery for that service |
| Calls, texts and mobile data stop together, with an unexpected SIM activation notice | Possible SIM swap | Contact the carrier immediately |
| Texts work for some senders but verification codes never arrive | Unclear; could be the service, the number or the device | Contact the carrier to confirm the number’s status before resetting anything |
| You receive a carrier message about a SIM change you did not request | Possible SIM swap | Contact the carrier immediately |
Sudden loss of calls, texts and data together with an unexpected SIM activation notice can indicate a SIM swap. Source
A carrier message about an activation you did not request is a reason to call, not proof of an attack. Carriers also send legitimate notices, and a device or plan change can interrupt service. The point of calling is to find out which situation you are in before you start resetting passwords that an attacker may also be resetting.
Carrier-first incident checklist
Work through these in order. The sequence matters because password resets sent by text are useless, and possibly counterproductive, while someone else controls the number.
- Call your carrier using a number you already know. Use the contact number on your bill, your carrier’s app or your own saved contacts. Do not use a number from an unexpected message asking you to “confirm” or “restore” your SIM.
- State the specific problem. Say that calls, texts and data stopped together and that you received a SIM activation notice you did not request. Ask the carrier to confirm whether the SIM was changed and to restore control of the number.
- Ask what protection the carrier offers. A carrier PIN or account lock can reduce exposure to a repeat attempt. Treat it as a reduction in risk, not a fix.
- Only after the number is back under your control, change passwords. Start with the accounts that can move money or reset other accounts, then work outward.
- Replace SMS-only authentication where you can. Move to an authenticator app, a passkey or a hardware key where the service supports it. Keep at least one recovery method you control.
- Check for changes made during the gap. Look for new login alerts, changed recovery addresses, new payment methods or forwarding rules on the accounts that matter most.
- Record what happened. Note the time you first noticed the outage, the carrier reference number and the accounts you changed. This helps if you need to dispute charges later.
The FTC advises contacting the mobile carrier immediately to regain control of the number and then changing affected account passwords. Source
That order is editorial advice built on the official sequence: regain the number first, then change passwords. Resetting passwords while the number is still controlled elsewhere can hand the attacker a fresh code.
Build an account-dependency ledger
The reason a SIM swap is worse than a forgotten password is dependency. Many accounts use the same number as a login name, a recovery route or a second factor. Map that before you need it.
| Column | What to record | Why it matters |
|---|---|---|
| Account | The service name | Keeps the list concrete |
| Role of the number | Login name, recovery route, SMS second factor, or notification only | Tells you what breaks if the number is lost |
| Stronger option available | Authenticator app, passkey, hardware key, backup codes | Shows where to reduce SMS reliance |
| Recovery method you control | Backup email, printed codes, second device | Must survive loss of the number |
| Priority | Money, email, then everything else | Sets the order for password changes |
Two rules keep the ledger useful. First, keep at least one recovery method that does not depend on the phone number, and keep it somewhere you can reach without the phone. Second, do not delete a recovery method until you have confirmed you can sign in another way; removing the last route you control can lock you out permanently.
SMS authentication can be compromised by a SIM swap; a carrier PIN and stronger account authentication can reduce exposure but are not guarantees. Source
A carrier PIN and an authenticator app are risk reductions, not guarantees. Some services still fall back to SMS, and some support staff will reset an account over the phone. The ledger should show where those fallbacks exist.
When it is probably not a SIM swap
Not every outage is an attack, and accusing a person or a location does not help you recover an account. Rule out ordinary causes before treating the incident as a swap.
- One service only: if calls and texts still work, the problem is likely inside that account, and normal recovery applies.
- Device or plan change: a new phone, eSIM transfer or plan change can interrupt service. The carrier can confirm what happened.
- Carrier outage: check whether the carrier reports a local outage before assuming fraud.
- Verification codes only: if texts from friends arrive but codes do not, the cause is unclear. Ask the carrier to confirm the number’s status rather than resetting repeatedly.
If the carrier confirms the SIM was changed without your request, treat it as a security incident even if service returns quickly. The attacker may have used the gap to reset accounts, and those resets do not undo themselves.
A recovery path you keep
A forgotten password is recoverable on its own. A SIM swap removes the recovery route that many accounts share, so the practical goal is to stop depending on a single number for everything.
If you are now mapping which services use your number, the guide on how to find all accounts linked to a phone number is a reasonable next step. Treat any list you build as a starting point for your own checks, not as a complete inventory, and confirm each account through its own recovery process.
TraceSeek, the app covered by TruthsSeek, checks usernames across 3,000+ platforms and offers a free first scan that takes 20-30 seconds, with no registration or login required for that first scan. That is useful for finding public profiles tied to a username; it does not restore a phone number, and a public match is a lead, not proof of who owns an account.