What the standard says
Porting means moving a phone number from one provider to another. It’s what lets you keep your number when you switch. Port-out fraud is when someone pretends to be you, opens an account with a different carrier, and has your number moved there [1]. SIM swapping is the cell phone version: someone convinces your carrier to move your service to a phone they control [1]. Either way, your calls and texts go to them, including the one-time codes banks and other services send by text [2][3].
The FCC adopted rules in November 2023 that require wireless providers to verify customers securely before moving a number to a new device or carrier, and to notify customers right away when someone asks for a SIM change or port-out [1]. The rules also require wireless providers to offer a free account lock that blocks SIM changes and port-outs until the customer removes it [4]. They took effect January 8, 2024, with compliance on some parts set for later [4]. These rules cover wireless providers, so protections on an office or VoIP number depend on your provider’s own options [4].
The FTC’s advice is simple: set up a PIN or password on your phone account to help block changes you didn’t ask for [2]. Carriers name this differently. You’ll see “Number Transfer PIN,” “Wireless Account Lock,” “Port-out protection,” “SIM protection” and “Number Lock” [5][6][3]. Some locks must be added to each line separately, and some can only be turned off by the primary account holder [6][3].
Text-message codes deserve a second look. CISA calls them the weakest form of MFA and says to use them only when nothing else is available [7]. NIST restricts codes sent over the phone network and tells services to watch for warning signs like a SIM change or number port before relying on them [8].
Two related items show up in the Free Security Assessment:
Consistent listings. Google asks businesses to list a number that connects to the actual business and that the business controls directly [9]. When your website and listings show different numbers, customers can’t tell which one is real, and a fake number looks more believable.
The phone-system admin portal. If your business uses a VoIP phone system (phone service over the internet), whoever controls its admin portal can forward calls, change voicemail and run up long-distance charges. The NSA warns that attackers who get into these systems can commit toll fraud, meaning calls billed to you [10]. MFA on that portal is the fix.
What you’ll hear
“Our main number is an office line, not a cell phone, so SIM swapping isn’t our problem.”
There’s truth in it. SIM swapping is a cell phone attack, and the FCC’s 2023 rules are written for wireless providers [1][4]. But office and VoIP numbers can usually be ported too; that’s how businesses switch providers. And many owners’ cell phones receive sign-in codes for business email, banking and payroll. The fair version: protect the office line and the cell phones tied to business accounts.
What the numbers say
1,611 complaints and more than $68 million in losses tied to SIM swapping were reported to the FBI’s Internet Crime Complaint Center (IC3) in 2021 [11]. From January 2018 through December 2020, IC3 received 320 such complaints with about $12 million in losses [11].
Publisher: FBI, in a February 2022 public service announcement [11]. Sample: complaints people chose to file with IC3, mostly individuals; businesses aren’t broken out. Funder: US government. Fit for a small business: limited. It shows a rising trend, but counts only reported cases and doesn’t measure business losses. We found no current public figure for port-out fraud against businesses.
What we’ve seen
We haven’t run into this yet.
Putting it together
Your phone number is part of how customers find you and how many of your accounts confirm it’s you. Adding a port-out PIN or number lock is usually free and takes one call. Keeping the number consistent and putting MFA on your phone-system portal finish the job.
What good looks like
A port-out PIN or number lock on every business line, including owners’ cell phones used for sign-in codes.
An account PIN or passcode for calls to carrier support.
The PIN stored somewhere safe, not on a sticky note, and known to more than one trusted person.
The same business number on your website, Google listing and directories.
MFA on the phone-system admin portal and the carrier’s online account.
Authenticator apps or security keys instead of text-message codes where an account allows it.
Questions for your IT resource
Which of our lines have a port-out PIN or number lock, and who can remove it?
Who is listed as the primary account holder with each carrier?
Does our phone-system admin portal require MFA for every admin?
Are international calling and call forwarding limited to what we actually use?
Which business accounts still send sign-in codes by text to a single person’s phone?
For the carrier: Do you offer a port-out PIN or account lock for this line, and will you notify us of a port or SIM change request?
Related learning
What is MFA, and why a password isn’t enough
MFA, short for multi-factor authentication, asks for a second proof after your password, like a prompt on your phone or a security key. A stolen password alone is no longer enough to sign in.
How we put together your Free Security Assessment
The Free Security Assessment is a review of what’s already public about your business: your email setup, domain, website, phone listings and anything left open to the internet. We make one ordinary visit to your home page and never scan, log into or test anything.
How many admin accounts should your business have?
An admin account can change settings, reset passwords and read company data across Microsoft 365 or Google Workspace. Keep only a few, protect each one well, and use them only for admin work.
Sources
FCC, FCC Adopts Rules to Protect Consumers’ Cell Phone Accounts, news release, November 15, 2023. (checked 2026-10-07)
FTC, SIM Swap Scams: How to Protect Yourself, October 23, 2019. (checked 2026-10-07)
Verizon, Unauthorized Port Outs, Verizon Account Security, updated November 2024. (checked 2026-10-07)
FCC, Protecting Consumers from SIM-Swap and Port-Out Fraud, Federal Register final rule, December 8, 2023. (checked 2026-10-07)
AT&T, Get a PIN to transfer your wireless number, AT&T Support, updated August 21, 2026. (checked 2026-10-07)
T-Mobile, Protect your T-Mobile account from fraud, T-Mobile Support. (checked 2026-10-07)
CISA, Multi-Factor Authentication. (checked 2026-10-07)
NIST, SP 800-63B-4: Digital Identity Guidelines, Authentication and Authenticator Management, August 2025. (checked 2026-10-07)
Google, Guidelines for representing your business on Google, Google Business Profile Help. (checked 2026-10-07)
NSA, NSA Releases Guidance on Securing Unified Communications and Voice and Video over IP Systems, June 17, 2021. (checked 2026-10-07)
FBI Internet Crime Complaint Center, Criminals Increasing SIM Swap Schemes to Steal Millions of Dollars from US Public, February 8, 2022. (checked 2026-10-07)
How we rate these. Our judgment from real setups, applied the same way on every page. Cost: $ = no new spend or under $25/month · $$ = a modest monthly tool or a short project · $$$ = new hardware, licensing, or a larger project. Effort: Light = one sitting · Moderate = setup plus follow-up over days or weeks · Heavy = planning, testing and staff changes. Outlined marks show how far it can go for some businesses. N/A = doesn’t apply to this topic. Time to fix: how long the first useful step takes, then how long until it’s fully done. Ratings are typical averages, not quotes. Time to fix: the filled dot is when the first useful step lands, the hollow dot is when it’s fully done. Who can do it: highlighted chips are who can reasonably handle it.