AT&T Wireless Lock and SIM Swap Attacks: How Carrier Locks Work and What to Do

Key takeaways

• A SIM swap moves your phone number to the attacker's SIM, so SMS one-time codes and calls go to them.
• Carrier locks, such as the AT&T feature, aim to block unauthorised SIM and device changes. AT&T's service is for US customers.
• The best personal defence is not relying on SMS for security: use authenticator apps, passkeys or security keys.
• If your phone suddenly loses signal unexpectedly, treat it as an emergency and contact your operator and bank.

What is a SIM swap attack?

Your phone number is tied to a SIM card. If an attacker convinces your mobile operator to link your number to a new SIM that the attacker holds, calls and text messages for your number arrive on their device. Many services still send one-time passwords (OTPs) and account-recovery codes by SMS. With your number, an attacker can reset passwords and approve transactions.

The attacker usually needs some personal details, gathered from data leaks, social media or phishing. They then use social engineering on the operator's support staff or on a retail outlet, or in some cases an insider. This is the same pattern seen in other fraud: the weak point is a human process, not encryption.

Warning signs

• Your phone suddenly shows "No service" while others on the same network are fine.
• You receive alerts about SIM changes or login attempts you did not make.
• You are logged out of accounts or locked out by password resets.
• Your bank or UPI app reports a new device.

Act at once: contact your operator from another phone, then your bank, then reset account passwords.

What is AT&T's Wireless Lock?

AT&T, a US mobile operator, introduced a feature called Wireless Lock, reported to be available to customers from mid-2025. As described in reports, the lock blocks changes to the account that could enable a SIM swap, such as moving the number to a new SIM or device, until the account holder lifts the lock. Specific details, availability and the exact rollout date are for AT&T to state, so check AT&T's own announcement before relying on this summary. It applies only to AT&T customers in the United States, so it does not protect Indian numbers.

The idea behind the feature is useful anywhere: a "lock" that the legitimate owner controls turns a SIM change from a support-desk judgement into a deliberate action.

What this means in India

Operators and rules differ by country, and the safeguards available to you depend on your operator and current regulations. Do not assume an AT&T-style lock exists for your number. Ask your operator what protections it offers against unauthorised SIM replacement, and check the current regulatory guidance from the Department of Telecommunications and your operator's website.

What you can do now

1. Do not rely on SMS for important accounts. Use an authenticator app, passkeys or a hardware security key for email, banking and social accounts.
2. Protect your email first. If an attacker controls your email, they can reset almost everything else.
3. Ask your operator about SIM change safeguards, set a PIN or password on the account if offered and keep your registered details up to date.
4. Limit what you share publicly: date of birth, address and phone number help attackers pass identity checks.
5. Turn on alerts for bank and UPI transactions, and for device changes.
6. Be careful with calls and messages claiming to be from your operator. Do not share OTPs or SIM details.
7. Keep recovery options separate: use a different recovery email, not a phone number that can be swapped.

If it happens to you

1. Contact your operator from another phone and ask to block the SIM and restore service.
2. Call your bank and freeze affected accounts and UPI.
3. Change passwords for email first, then financial and social accounts, and enable app-based MFA.
4. Call the national cyber crime helpline 1930 and file a report at cybercrime.gov.in.
5. Keep records: screenshots, times, and messages.

Why is SMS-based MFA weak?

SMS codes can be redirected through SIM swapping and can be phished. See why MFA is sometimes not enough and MFA protocols you should know for stronger options.

Next steps

Understanding identity attacks is a core skill. Explore the Cyber Security course or the CCCSO and security leadership path if you plan a governance role.

Related reading

• Chinese Student Caught in London for Massive Smishing Attack Using Rogue SMS Tower | July 2026
• What are the best ways to protect online video calls from hackers in 2026?
• Bluetooth Flaws Could Let Hackers Spy Through Your Microphone | Vulnerabilities in Airoha Chips Explained