<![CDATA[SIMGUARD]]>https://simguard.hashnode.devRSS for NodeWed, 04 Nov 2026 06:24:23 GMT60<![CDATA[How SIM swap attacks work, and how to get early warning on Android]]>https://simguard.hashnode.dev/how-sim-swap-attacks-work-and-how-to-get-early-warning-on-androidhttps://simguard.hashnode.dev/how-sim-swap-attacks-work-and-how-to-get-early-warning-on-androidThu, 29 Oct 2026 18:00:30 GMTDisclosure: I'm on the SIMGUARD team, and the app is mentioned near the end. This post was drafted with AI assistance and reviewed by our team.

What a SIM swap is

In a SIM swap (or port-out), someone gets your carrier to move your phone number to a SIM or eSIM they control. After that, SMS codes and "reset your password" texts go to them. Any account that falls back to SMS becomes a target: email, banking, exchanges.

Why you often notice late

The first sign is usually that your phone shows no service, and that's easy to blame on bad coverage. Attackers count on that gap. By the time you call the carrier, password resets may already be under way.

Prevention comes first (no app needed)

  1. Carrier account PIN and port-out/number lock. Ask your carrier for both. These make it harder to move your number. No app can do this for you, because the carrier controls transfers.
  2. Move off SMS 2FA. Use an authenticator app or a security key, starting with your primary email.
  3. Secure your email first. It's the reset path for everything else. Check recovery options and forwarding rules.
  4. Keep Play Protect and Android updates on.

If you think it's happening right now

Use a trusted device:

  1. Call your carrier's fraud line and ask whether a SIM replacement or port was requested.
  2. Secure your primary email: change the password, sign out of all sessions, check recovery options and forwarding.
  3. Check your bank and exchange accounts.
  4. Change affected passwords.
  5. Move off SMS 2FA.
  6. Keep case numbers and timestamps.

Early warning on the phone

Android exposes SIM, eSIM and carrier state to apps. An app with phone-state permission can notice when that state changes unexpectedly (SIM change, carrier or network change, loss of mobile service) and alert you, so you call the carrier sooner. An alert is a signal, not proof. Ordinary network issues trigger some of these events too.

What we built

SIMGUARD is an Android app built around this idea.

  • Premium ($9.99/mo or $79.99/yr US after a 5-day trial; Play shows your local price) watches SIM and number signals 24/7. Each alert explains what happened and what to do next.
  • Free, no account needed:
    • Spyware Check: an on-device scan against known lists
    • Verify a Link
    • Scam Watch, Defender Drill and Security Briefings
  • Ads: none.

Privacy: threat detection and private vault data stay on your device. We don't see your alerts or vault. Play's Data Safety covers optional location and anonymous product analytics/payments via Google, not our reading of your security content. We don't sell data.

Honest limits:

  • It can't stop a SIM swap. Your carrier controls the number transfer.
  • The spyware scan is known-list, so a clean result isn't proof the phone is clean.
  • It doesn't remove malware or recover accounts or crypto.
  • No guarantee.
  • It's proprietary, with no public third-party audit yet.
  • Android only.

Full limits: https://simguard.app/security-methodology

Questions and criticism welcome in the comments. I'll answer what I can.

]]>