Sudden signal loss and a suspected SIM swap: act fast

Sudden loss of mobile service can be an ordinary network fault, but if calls and texts stop unexpectedly while banking or email alerts appear, consider a SIM-swap attack. A successful swap can let a criminal receive SMS codes and calls intended for you.

A SIM swap transfers control of the phone number, not the physical phone

The NCSC explains that attackers can use social engineering to persuade a mobile provider to move a customer’s number to another SIM. The genuine handset then loses service while the attacker receives calls and SMS sent to that number.

This can happen while your phone is still in your hand. That is why unexplained “No Service” combined with security alerts deserves more attention than a simple dead battery.

Practical checkpoint for sudden signal loss and a suspected SIM swap: establish the starting position before you change anything. Use a phone that suddenly loses calls and texts while password-reset or banking alerts appear as a worked example and write down mobile-network account status, SIM-change reference, email logins, bank alerts and recent transactions. That turns 'A SIM swap transfers control of the phone number, not the physical phone' into a testable sequence rather than a vague problem.

Check the mobile account first because the number is the asset under attack

Call the network provider from another line or use its official online account. Ask whether a SIM replacement, eSIM activation or number transfer has occurred. Do not call a number supplied in a suspicious message claiming to explain the outage.

If the provider confirms an unauthorised change, ask it to secure the account and restore control of the number according to its process.

Run the numbers or sequence on paper before repeating the action. In the example of a phone that suddenly loses calls and texts while password-reset or banking alerts appear, separate the amount, date, channel and decision point, then mark which part is confirmed and which part is still an assumption. For 'Check the mobile account first because the number is the asset under attack', the useful question is not simply whether something can work, but what result you should see next and how long you are prepared to wait before changing route.

Second check for section 2, 'Check the mobile account first because the number is the asset under attack': use a phone that suddenly loses calls and texts while password-reset or banking alerts appear and write a one-line expected result beside the actual result. Then verify mobile-network account status, SIM-change reference, email logins, bank alerts and recent transactions. If the two do not match, pause rather than creating another transaction or application. Contact the mobile provider from another device, lock down email and banking access, then replace sms recovery where safer options exist.

Then protect accounts that use SMS for security

Contact the bank if SMS codes, telephone verification or the mobile number are linked to the account. Review payments, new payees, device registrations and changes to contact details.

Also secure email and messaging accounts. A compromised number can assist password resets or account-recovery attempts outside banking.

Use a controlled process for 'Then protect accounts that use SMS for security'. Gather mobile-network account status, SIM-change reference, email logins, bank alerts and recent transactions, take one deliberate action, and record the result before trying a second route. Do not wait for the signal to return before protecting accounts that use sms recovery. If the first route clearly cannot complete the job, contact the mobile provider from another device, lock down email and banking access, then replace SMS recovery where safer options exist rather than improvising with an unverified workaround.

A restored signal does not prove nothing happened

The network may restore your number after the attacker already used a code or reset process. Check the actual account history rather than treating renewed signal bars as the end of the incident.

If an unauthorised payment occurred, tell the bank promptly. If you were deceived into approving something during the incident, explain the social-engineering sequence as well.

Build a failure plan before the deadline matters. For sudden signal loss and a suspected SIM swap, decide what you will do if the normal route fails at the worst reasonable moment: a bill is due, a payment is time-critical, a phone is unavailable or verification will not complete. Keep enough time and money outside the process to recover. Under 'A restored signal does not prove nothing happened', note the exact error or refusal wording because that is usually more useful to support than a general statement that it did not work.

Second check for section 4, 'A restored signal does not prove nothing happened': use a phone that suddenly loses calls and texts while password-reset or banking alerts appear and write a one-line expected result beside the actual result. Then verify mobile-network account status, SIM-change reference, email logins, bank alerts and recent transactions. If the two do not match, pause rather than creating another transaction or application. Contact the mobile provider from another device, lock down email and banking access, then replace sms recovery where safer options exist.

Strengthen recovery methods after the incident

Where services offer stronger authentication than SMS, consider using it. The NCSC notes that SMS can be vulnerable to SIM-swap attacks and recommends stronger authentication methods where appropriate.

Use a unique mobile-account password or PIN and review the provider’s security options, because preventing another unauthorised SIM change is part of the recovery.

Treat evidence as part of the solution, not paperwork added afterwards. For 'Strengthen recovery methods after the incident', keep mobile-network account status, SIM-change reference, email logins, bank alerts and recent transactions in one dated folder and write a two-line chronology of each contact. Do not wait for the signal to return before protecting accounts that use sms recovery, and use only a channel you reached independently when security or fraud is involved.

Treat simultaneous phone and banking problems as a linked incident

A sudden loss of mobile service can have innocent causes, but if it happens alongside unexpected password-reset messages, new-device alerts or banking login failures, act as though the mobile number may be under somebody else's control. From another phone, contact the mobile network and ask whether a replacement SIM, eSIM or account change was made. Then contact the bank through a verified route and explain that SMS authentication may no longer be trustworthy.

Do not wait for the signal to return before securing email. Email is often the recovery channel for mobile-network and financial accounts, so change its password from a clean device, sign out unknown sessions and check whether forwarding rules were added. If the bank uses an app-based authenticator, review trusted devices as soon as you regain access.

Keep the network case reference and bank case reference together. If an unauthorised payment later appears, the time the phone lost service can be a useful boundary in the investigation. Avoid repeatedly requesting new verification texts to the compromised number until the network confirms control has been restored.

Finish with a decision rule for sudden signal loss and a suspected SIM swap. In the worked example of a phone that suddenly loses calls and texts while password-reset or banking alerts appear, the safer next step is the one that preserves evidence and keeps essential money or account access recoverable. If the provider cannot explain the next step clearly, contact the mobile provider from another device, lock down email and banking access, then replace SMS recovery where safer options exist and keep the case reference until the outcome is reconciled.

Sources and verification

• NCSC - Protecting SMS messages
• NCSC - Phishing scams: what to do
• FCA - Fraudulent payments
• NCSC - phishing and account protection guidance

MyBankAnswers uses official provider and UK regulatory sources wherever practical. Information is general and does not constitute financial advice.