The Quiet Phone Panic: What to Do in the First 20 Minutes of a Suspected SIM Swap

On a damp November morning, the phone in your pocket goes quiet. No bars. Then a text arrives that you did not ask for, mentioning a PAC code or a switch date. It could be a network glitch. It could also be the opening move in a SIM swap. The difference matters, because the first 20 minutes are when you can still make life difficult for whoever is trying to take your number.

A SIM swap is not a clever bit of coding. It is usually a customer service con with a deadline. Someone persuades your mobile network to issue a PAC — the code that lets a number move to another network — or a STAC, which is used to switch without keeping the number. Once your number lands on their SIM, they start collecting the SMS codes that many accounts still treat as proof of identity. Your bank, your email, your WhatsApp and your business admin all become easier to reach.

At McAfeeCom UK, we would rather you spend 20 minutes now than a fortnight untangling the paperwork later. This is the calm, practical version.

Why a phone number is worth more than a handset

Most of us think of a mobile number as a label. In practice, it is often the spare key to the house. It receives login codes, resets passwords and confirms new payees. For a small firm, the business mobile might be the recovery number for payroll, HMRC, the domain registrar, the cloud admin account and the accountant's portal. If it is also the number printed on the van, the scammer knows where to aim.

The warning signs are easy to dismiss one by one. Together, they deserve a second look. Watch for an unexpected text containing a PAC or STAC, or a message saying your number will move on a certain date. Then there is the sudden loss of signal in an area you know well, calls going straight to voicemail, or texts that will not send. If your WhatsApp suddenly asks you to re-register, or friends say they are getting odd messages from your number, treat it as urgent rather than annoying.

The 20-minute response plan

Aim for these steps in order. You may not finish every item in 20 minutes, but the sequence gives you the best chance of limiting damage.

Minutes 0–3: Do not reply. Call the operator's fraud line.

Do not reply to the text. Do not tap any link. Use another phone, a work mobile or a VoIP line to call your mobile network's fraud or security team — not the general sales queue. Ask three blunt questions: has a PAC or STAC been issued on my number, has my SIM been swapped or deactivated, and can you place a port freeze or account PIN on the line? Write down the time, the adviser's name and any reference number.

Minutes 3–6: Lock the email account first.

Email is the reset button for almost everything else. From a device that is not relying on the hijacked number, change the password, sign out all active sessions and check the recovery email and phone number. If the account still uses SMS as a second factor, switch to an authenticator app or a passkey where the service allows it. Check for new forwarding rules or filter rules you did not create. Those are quiet ways for an attacker to keep reading.

Minutes 6–10: Move to banks and money apps.

Call your bank's fraud line from another phone. Ask them to freeze or restrict the mobile banking app, reset online banking credentials and check for recent payee changes. Do the same for credit cards and any payment wallets you use. If you cannot get through immediately, change the password from a secure device and remove the mobile number as a recovery option where the bank permits it. Do not rely on a password reset that sends a code to the number you have just lost.

Minutes 10–14: Secure WhatsApp and social accounts.

If your number has been ported, the attacker may be able to register WhatsApp on it. Tell close contacts through another channel that anything from your number should be treated with suspicion until you confirm otherwise. When you regain control, enable WhatsApp's two-step verification PIN, review linked devices and remove anything you do not recognise. Do the same for social accounts: change passwords, revoke active sessions and check that the recovery email is still yours.

Minutes 14–17: Check the business-critical accounts.

For a micro-firm, this is the part people forget. Log into payroll, accounting, cloud storage, the domain registrar and any staff chat tool from a secure device. Look for new admin users, changed recovery numbers and unusual forwarding. If one person's mobile is the recovery route for everything, change that today. Tell the team what has happened so they can ignore any odd payment requests.

Minutes 17–20: Report and document.

Report the incident to Action Fraud online at actionfraud.police.uk or by phone on 0300 123 2040. Tell your bank and your network operator as well. Keep screenshots of the suspicious text, call logs, reference numbers and a short timeline. If money has moved, call the bank immediately rather than waiting for the report to be processed.

What to ask your network operator

Be specific. Ask whether a PAC or STAC was generated, when it was generated and whether it has been cancelled. Ask whether the number has already been ported and, if so, to which network. Ask for a port freeze or a PIN on the account. Ask what evidence they need from you and what their complaint process is if the port goes ahead. If you are passed around, ask for the fraud team reference and keep it.

A pre-Christmas number hygiene checklist

Before the festive season fills the house with new devices and the small firm's inbox fills with festive orders, do a short number audit.

• List every mobile number attached to household and business accounts. Include old numbers that still sit in recovery fields.
• Replace SMS two-factor authentication with an authenticator app or passkey wherever possible. Where SMS is the only option, keep that number private.
• Set a SIM PIN on family phones and ask your operator about an account PIN or port freeze.
• Check WhatsApp two-step verification and remove unknown linked devices.
• For business mobiles, separate personal and work numbers, document who can authorise a port, and make sure admin recovery does not depend on one person's handset.
• Tell staff not to read out PAC or STAC codes in shared spaces, and remind them that a genuine network text will not ask them to forward a code.

A SIM swap is unsettling because it turns a everyday tool into someone else's key. But it is also a race with a short head start. If the signal drops and a porting text lands, do not wait to see what happens. Call the operator, secure the email, call the bank and write it down. The quiet phone is a warning, not a verdict.