Google Fi’s new ‘Number Lock’ protects against SIM swaps

Abner Li | Jul 9 2024 - 3:24 pm PT

Google Fi Wireless has a new Number Lock feature that provides an “additional layer of protection against illegal SIM swaps.”

“SIM swapping happens when someone is able to steal your phone number by convincing your carrier to port your phone number over to a SIM card they own. For example, someone may call your carrier, pretend to be you, and convince your carrier that you have lost your phone and need to move your number to a new phone.”
Google

When Number Lock is enabled, “you can’t transfer your number to a new device or carrier while this lock is active.”

To enable, go to the Google Fi website (fi.google.com/account) and select your user (if you have multiple as part of a group plan). Go to Phone settings > Privacy & security > Number lock.

Tap “Sign in to manage Number lock” and confirm your Google Account credentials to enable the toggle.

If you ever want to “transfer your number to a new device or port to another carrier,” return to that page, which is not available in the Android or iOS apps. Since the inconvenience is minimal, enabling Number Lock should be a good idea for most users.

Outside of this feature, transferring a number out of Google Fi is made more difficult by existing Google Account protections, especially with two-factor authentication enabled, that require you to be signed-in and authenticate. However, the issue is a nefarious party targeting the T-Mobile backend, which is what looks to have happened last year. A good precaution in general is disabling SMS-based 2FA when possible.

Update: According to a new FCC rule, carriers have to give customers the “option to lock or freeze their account to stop SIM changes.” Number Lock is Google Fi’s take on that requirement.

…when activated, wireless providers must not fulfill SIM change requests until the customer deactivates the lock
FCC

Carriers also have to let users “lock or freeze their accounts to stop port-outs.”

Port-out fraud takes place when the bad actor, posing as the victim, opens an account with a carrier other than the victim’s current carrier. The bad actor then arranges for the victim’s phone number to be transferred (or “ported out”) to the account with the new carrier controlled by the bad actor.
FCC