Dan finds a rule in his email: “forward all mail to d4n.backup@…”, which he never created. What does it mean?

The email is already hacked: delete the rule, change the password, sign out everywhere and turn on 2FA. A stranger’s forwarding rule is a classic sign of a hack. Deleting it isn’t enough: whoever set it knows the password and can come back.

In the city centre at midday Dan’s phone suddenly loses signal, and a minute later an email says “Your exchange password was changed”. What’s going on?

Looks like a SIM swap: call the carrier from another phone and the exchange’s support via the official app, fast. Lost signal plus a password change is almost certainly a SIM swap. It’s a matter of minutes: the carrier can return the number and the exchange can freeze the account.

Which of these protects best against a SIM swap?

A port-out PIN at the carrier and passkey logins instead of SMS. The PIN makes the number hard to steal, and passkeys make a stolen number useless for logging in. Together they close the door.

Email and phone number: the master keys

Lesson 6 of 16 in the course “Cybersecurity from Scratch”. Free, with animations and a quiz.

Why email matters more than the exchange

Almost every service has a “Forgot password?” button, and the reset link goes to your email. So whoever owns your email can get in almost anywhere. A skilled attacker also hides the traces: sets up forwarding of all mail to himself and a filter that sends the alerts to the bin. You don’t notice anything for a long time. That’s why email is the first lock to make the strongest.

A 10-minute email check-up

Open your email’s security settings. Password: unique, from the manager, plus a passkey or authenticator. Recovery email and phone: yours and working; they’re how you get access back, and how strangers would take it. In forwarding and filter settings there should be nothing you didn’t create. In the device list, sign out of anything unfamiliar. And revoke access for old apps and sites you once allowed to “sign in with email”.

SIM swap: how your number gets stolen

A SIM swap is when a scammer moves your number onto his own SIM card. He gathers your data from leaks and social media, calls or visits the carrier, pretends to be you and says he lost his SIM. If the staff believe him, your phone suddenly loses signal and all your texts and calls go to the scammer. Then he resets passwords wherever the number confirms a login.

How to protect your number

Call your carrier and ask about a port-out PIN and a ban on SIM replacement without an in-person visit with ID. Many carriers around the world call this Number Lock or SIM Protection. Set a PIN on the SIM card itself, so a thief can’t put it into another phone. Wherever you can, switch logins from SMS to a passkey or authenticator. And if your signal vanishes for no reason where it’s usually fine, call the carrier from another phone right away.

Check yourself

Dan finds a rule in his email: “forward all mail to d4n.backup@…”, which he never created. What does it mean?
Correct answer: The email is already hacked: delete the rule, change the password, sign out everywhere and turn on 2FA. A stranger’s forwarding rule is a classic sign of a hack. Deleting it isn’t enough: whoever set it knows the password and can come back.
In the city centre at midday Dan’s phone suddenly loses signal, and a minute later an email says “Your exchange password was changed”. What’s going on?
Correct answer: Looks like a SIM swap: call the carrier from another phone and the exchange’s support via the official app, fast. Lost signal plus a password change is almost certainly a SIM swap. It’s a matter of minutes: the carrier can return the number and the exchange can freeze the account.
Which of these protects best against a SIM swap?
Correct answer: A port-out PIN at the carrier and passkey logins instead of SMS. The PIN makes the number hard to steal, and passkeys make a stolen number useless for logging in. Together they close the door.

← 2FA: from SMS to passkeys Updates: the boring superpower →