Lock Your SIM Card: The Anti-Theft Setting Most People Skip
Your screen is locked. Your SIM almost certainly isn't. It pops out in ten seconds, goes into another handset, and starts receiving your text codes. Two minutes of settings tonight closes that door for good.
Lock your SIM card and you shut down an entire category of theft in about two minutes. Almost nobody does it. The reason is simple: people assume a locked screen protects everything inside the phone. For one small part, it doesn't. The SIM comes out with a paperclip, drops into the next handset, and walks off with your phone number. And your number is now the backup key to your bank, your email and half your apps. Here's what actually happens in the hour after a theft, then the exact path, screen by screen, on iPhone and Android.
The mechanismWhat your SIM card does without you while you're still looking for your phone
A thief doesn't need to get inside your handset. That's the detail almost every guide misses. He only needs to take the small card out and put it somewhere else. The moment it's live in another phone, that phone receives your calls and your texts. Including the six-digit verification codes your bank sends the second somebody taps "forgot password".
France's national cyber agency spells it out in its mobile phone threat landscape published on 26 November 2025, written with UK agencies: "A SIM card that is locked and protected by a PIN code cannot be used in an alternative device, which limits the attacker's ability to obtain two-factor authentication codes." One sentence, two minutes of settings, and the whole timeline below falls apart.
The card comes out
The SIM tray opens with a paperclip, an earring, the tip of a pen. Thirty seconds in a side street. Many thieves do it first just to stop you tracking the handset, without even thinking about your accounts.
It goes into a burner
A £20 second-hand phone is enough. If no code is asked for at start-up, the line activates on its own. Your number has changed hands, and your handset shows "No Service" on the other side of town.
"Forgot password"
Email, banking app, social accounts: the recovery flow sends a code by text. That code now lands with somebody else. Nothing was hacked. Everything was delivered to the right address, just not to the right owner.
The account changes owner
Password changed, recovery email swapped, alerts switched off. Getting back in now runs through customer support and days of waiting. That step, not the resale value of the handset, is what really costs you.
Never guess your SIM PIN
Three wrong tries and the card locks. You then need an eight-digit PUK code that only your carrier can give you, after an identity check. Get the PUK wrong ten times and the card is dead for good. Before you touch the setting, get the default code from your provider, or find it on the plastic card the SIM originally came in.
iPhoneHow to lock your SIM card on iPhone: three screens, two minutes
Open Settings, then Cellular or Mobile Service
Scroll down to "SIM PIN". On dual-line devices, each line is set separately: the work number as well as the personal one.
Flip the switch using the current code
iOS asks for the code already in place. That's the carrier's, usually 0000 or 1234, sometimes 1111 in North America. Don't know it? A five-minute call to customer support settles it. The rule never changes: you don't take a chance. Apple documents the flow in its official SIM PIN guide.
Change the default code straight away
Tap "Change PIN" and pick four to eight digits that are neither a birth year nor the last four digits of your number. The code is only requested when the device restarts or when the card moves to another phone: almost never for you, every single time for a thief.
An eSIM takes the same setting. The risk is lower to begin with, since an eSIM can't be pulled out with a paperclip and needs a software transfer from an unlocked device. That matters more every year: iPhone 17 models sold in the US, Canada, Japan and nine other markets have no physical SIM tray at all.
AndroidHow to lock your SIM card on Android: same setting, different path
Settings, then Security & privacy
Look for "SIM card lock" or "Other security settings". The label shifts between manufacturers; on Samsung it sits under "Other security settings". Typing "SIM" into the settings search bar beats hunting through menus.
Turn on "Lock SIM card"
Same logic as iPhone: the carrier's code first, yours second. Some handsets show the number of attempts remaining on that screen. If it reads fewer than three, stop and call your provider.
Test it immediately
Restart the phone. If the code is requested before the network appears, you're done. That thirty-second check stops you discovering in six months that the switch never really took. While you're there, confirm remote tracking is switched on too.
Discover LOCKÜP
Check the current product page for price, availability, included components and compatibility before choosing.
View the product page →The comparisonLocked SIM, authenticator app, text codes: what actually holds
A SIM PIN isn't a complete answer, and it's worth saying so. It blocks one precise scenario: the physical card moved into another device. It does nothing against the remote version, where a fraudster talks a carrier into issuing a replacement SIM in your name. Against that one, only a single move really works: stop receiving your codes by text.
| Protection | SIM moved | SIM re-issued remotely | Effort | Verdict |
|---|---|---|---|---|
| Screen lock alone | No | No | None | Protects the contents, not the line. Most people stop here. |
| SIM PIN | Yes | No | 2 minutes | Best effort-to-result ratio on the list. Do it tonight. |
| Codes by text | No | No | None | The weak link fraudsters aim at. Remove it from sensitive accounts. |
| Authenticator app | Yes | Yes | 15 minutes | Codes live in the app, not on the network. Formally recommended. |
| Passkeys | Yes | Yes | Varies | The strongest option where a service offers it. Nothing to intercept. |
Thirty minutes on a Sunday evening covers the three lines that matter: SIM locked, bank and email moved to an authenticator app, text codes removed wherever the service allows it.
The rest of the planThree moves that make the SIM lock worth having
A SIM code is something you set up before, not after. Three things go with it, and they fit into the same Sunday evening.
Write down your IMEI somewhere other than the phone. Dial *#06# and copy the number into a notebook or a password manager. That number is what lets you get the handset blocked across carriers, which makes it unsellable locally.
Hide notification previews on the lock screen. A six-digit code showing in plain text on a sleeping screen undoes part of the work. The setting lives under Notifications, in "Show Previews".
Know the order of operations in advance. If the phone disappears, the sequence matters more than the speed. Our guide to the first minutes after a theft fits on one page, and the one on protecting payments and bank accounts covers what comes next.
FAQLocking your SIM card: your questions
What is the default SIM card PIN?
It depends on the carrier, not the phone. The most common are 0000 and 1234, and some North American carriers use 1111. This is not something to guess at: three wrong tries lock the card. The code is printed on the plastic holder the SIM came in, sits in your online account, or can be read out to you by customer support.
What happens if I enter the wrong SIM PIN three times?
The card locks and asks for an eight-digit PUK code. That code comes from your carrier after an identity check and cannot be changed. Ten wrong PUK entries destroy the card permanently and you'll need a replacement. That's exactly why you never take a chance on the PIN.
Does a SIM PIN stop me tracking a stolen phone?
No. Tracking runs through your Apple or Google account, not the SIM card. A handset on Wi-Fi stays visible, and crowd-sourced finding networks work offline. The SIM PIN protects your phone line and your verification codes, which is a different, and often far more expensive, problem.
Can you lock an eSIM the same way?
Yes, the setting is identical on iPhone and Android. The underlying risk is lower: an eSIM can't be pulled out with a paperclip and requires a software transfer from an unlocked device. With iPhone 17 shipping without a SIM tray in the US, Canada and ten other markets, the attention shifts to locking down your carrier account instead.
Do I have to type the SIM code every day?
No, and that's what makes the setting such good value. The code is only requested when the device restarts or when the card is put into a different phone. For you, that's a few seconds a month. For a thief, it's a wall that appears in the first two minutes.
Keep your phone within reach
A SIM code closes the door after the fact. The bracelet does better: it keeps the phone from leaving in the first place.
Explore the LOCKÜP collection →Sources: ANSSI / CERT-FR, "Mobile Phones: Threat Landscape Since 2015", CERTFR-2025-CTI-013, 26 November 2025 · FBI Internet Crime Report 2024 (IC3) · Cifas, 1,055% surge in unauthorised SIM swaps · Apple, use a SIM PIN for your iPhone or iPad. Written by the CARRY U team. Updated: August 2026.