What Is a Transfer PIN? How Port-Out Codes Protect Your Phone Number
Introduction
Your smartphone may have strong encryption, biometric authentication, and the latest security updates, but none of those protections determine whether your mobile carrier can transfer your phone number to someone else. That decision happens within the carrier's account management and number-portability systems, which operate independently of the security features on your device.
This is where a transfer PIN, also called a Number Transfer PIN or port-out PIN, becomes important. It provides an additional authorization credential when someone wants to move an existing phone number to another wireless provider. Its purpose is to make it harder for criminals to transfer a number using stolen personal information or compromised account details.
At Efani, we focus on the security of the mobile number itself, including the procedures carriers use to authorize SIM replacements and number transfers. In examining the publicly documented processes at Verizon, AT&T, and T-Mobile, I consider transfer PINs a meaningful security improvement, but their effectiveness depends heavily on how securely the carrier issues those credentials and handles exceptions.
For individuals whose phone numbers are connected to banking, cryptocurrency accounts, sensitive business communications, and online account recovery, understanding these limitations is essential.
Quick version, if you don’t want to read the whole thing:
- A transfer PIN (also called a Number Transfer PIN, NTP, or port-out PIN) is a one-time, temporary code your carrier gives you to move your number to a new provider.
- It exists for one reason: to stop someone from hijacking your number using nothing but your name, address, and a few guessed details.
- It isn’t your account password. It isn’t your voicemail PIN either. Different credential, different purpose.
- AT&T’s expires in 4 days (14 for business accounts), Verizon’s lasts 7. T-Mobile doesn’t publish a clear number for this, which is worth knowing if you’re relying on it.
- You get one through your carrier’s app, your online account, or a short code, #PORT on Verizon, *PORT on AT&T. More detail on each below.
- Don’t cancel your old line before the port goes through. Do that too early and you risk losing the number mid-transfer instead of completing the switch.
Is your cellphone vulnerable to SIM Swap? Get a FREE scan now!
Please ensure your number is in the correct format.
Valid for US numbers only!
What Is a Transfer PIN?
A transfer PIN is a security code used to authorize transferring an existing phone number from one telecommunications provider to another. It is issued through the subscriber's current carrier and provided to the new carrier as part of the number-porting process.
The terminology varies by provider. Verizon and AT&T call it a Number Transfer PIN (NTP), while T-Mobile uses Temporary Port Out PIN (TPOP). The terms porting PIN and port-out code are also commonly used.
Transfer PINs exist because of number portability, a system that allows subscribers to change wireless providers without losing their telephone numbers. When someone switches from Verizon to AT&T, for example, the receiving carrier must obtain the information required to validate the transfer with the existing provider.
The transfer PIN adds a credential specifically associated with that authorization.
How Does a Transfer PIN Work?
The number-porting process involves two providers: the losing carrier, which currently serves the number, and the gaining carrier, which will receive it.
A legitimate number transfer generally follows these steps:
- The subscriber obtains a transfer PIN through the existing carrier's website, mobile application, or another approved method.
- The new carrier collects the required information, typically including the telephone number, existing account number, applicable transfer PIN, and billing details.
- The gaining carrier submits the port request through the telecommunications industry's number-portability procedures.
- The request is validated against the applicable account information and authorization requirements.
- The number is transferred, allowing the new provider to begin serving it.
One thing people get wrong here: don’t cancel your old service the moment you request the transfer. Keep it active until the new carrier confirms the port is done. Cancel too early and you can lose the number instead of moving it.
In the United States, the Number Portability Administration Center (NPAC) provides infrastructure that supports number portability. The transfer changes which provider serves the telephone number; it does not require copying the subscriber's physical SIM card or accessing information stored on their smartphone.
Generating a transfer PIN does not automatically transfer the number or cancel the existing service. The receiving provider must still initiate and complete the porting process.
Why Do Transfer PINs Expire?
Many carriers issue temporary transfer credentials to limit the time during which an exposed code remains usable.
Verizon's consumer Number Transfer PIN expires after seven days, while AT&T's expires after four days for consumer accounts and fourteen days for business accounts. T-Mobile also issues a temporary credential, although its publicly documented expiration requirements are less explicit.
Short-lived credentials reduce the risks associated with a code remaining valid indefinitely. However, expiration offers limited protection if an attacker can compromise the subscriber's account and request another PIN.
This is why a transfer PIN should generally be generated only when the subscriber is preparing to change providers, rather than kept active without a legitimate reason.
Transfer PIN vs. Account PIN: What Is the Difference?
A transfer PIN and an account PIN serve different purposes, although some carrier procedures require both.
An account PIN or passcode is typically a longer-lived credential used to authenticate the subscriber during customer-support interactions, account management, or sensitive account changes.
A transfer PIN is specifically associated with authorizing a number transfer to another provider. It is commonly generated on demand and remains valid for a limited period.
Worth clearing up early: your transfer PIN isn’t the same thing as your login password or your voicemail PIN. They’re separate credentials, even though some carriers ask for more than one of them in the same process.
The distinction becomes important when considering what happens after account credentials are compromised.
AT&T, for example, requires the account passcode when a customer uses the *PORT process to request a Number Transfer PIN. T-Mobile's published porting instructions also identify the existing account PIN or passcode among the information required during a transfer.
In these circumstances, a separate transfer credential adds protection without making the underlying account PIN irrelevant.
Why Static Account PINs Became a Security Concern
Traditional account passcodes can remain unchanged for years, which increases the consequences of a data breach.
In March 2024, AT&T reset passcodes for approximately 7.6 million current customers after customer information was exposed. The incident demonstrated the potential problems associated with persistent account credentials, particularly when other personal information used in identity verification may also be compromised.
Temporary transfer PINs reduce reliance on standing credentials during applicable porting transactions. Their effectiveness nevertheless depends on securing the account and verification processes responsible for issuing them.
Is a Transfer PIN the Same as a SIM PIN?
A SIM PIN serves a different purpose. It restricts access to the SIM credential through a device, generally requiring authentication when the SIM is initialized or used in another phone.
A transfer PIN operates within the carrier's number-porting process. Enabling a SIM PIN does not independently prevent the carrier from authorizing a replacement SIM or transferring the telephone number to another provider.
The two protections address different security risks and should not be confused.
Why Carriers Introduced Transfer PINs
Number portability gives consumers the freedom to change mobile providers without surrendering established telephone numbers. However, it also creates an authorization challenge: a carrier must distinguish a legitimate customer requesting a transfer from an impostor presenting stolen account information.
Historically, some porting procedures relied on account numbers, billing information, personal identifiers, or static security passcodes. Criminals could potentially obtain these details through data breaches, phishing, compromised accounts, or social engineering.
Major carriers increasingly adopted dedicated transfer credentials during the early 2020s. Verizon introduced Number Transfer PINs around 2020, AT&T implemented separate requirements in late 2021, and T-Mobile publicly moved toward temporary port-out credentials in 2022.
The transition occurred against a broader background of SIM-swap fraud, cryptocurrency theft, and growing scrutiny of carrier authentication practices.
Research Exposed Weaknesses in Carrier Authentication
A 2020 Princeton University study, An Empirical Study of Wireless Carrier Authentication for SIM Swaps, examined authentication procedures at five U.S. prepaid wireless carriers.
Researchers identified weaknesses in the authentication mechanisms used by all five carriers studied. They also examined more than 140 websites offering telephone-based authentication and identified 17 where, under the conditions tested, a SIM swap alone could enable account compromise without the attacker first obtaining the account password.
The study investigated SIM-swap procedures rather than today's major-carrier transfer PIN systems. However, its findings highlighted an important security issue: authentication requirements can appear robust while still allowing a determined attacker to exploit weaker verification alternatives.
The FCC's Response to SIM Swap and Port-Out Fraud
In November 2023, the Federal Communications Commission adopted a Report and Order addressing SIM swapping and fraudulent number transfers.
The framework covers stronger customer authentication, notifications for sensitive account changes, customer-controlled locking protections, employee safeguards, and fraud-response procedures.
The regulatory timeline requires some qualification. The FCC issued a compliance waiver in July 2024, and the published regulatory text has continued to include deferred-compliance provisions for certain port-out requirements. The adoption of the framework should therefore not be confused with every requirement becoming enforceable simultaneously.
What Do the FBI's Fraud Statistics Show?
According to the FBI's Internet Crime Complaint Center (IC3), SIM-swap complaints accounted for approximately $17.37 million in reported losses during 2025, compared with $25.98 million in 2024, $48.80 million in 2023, and $72.65 million in 2022.
These figures show a substantial decline in reported losses, although they do not establish that transfer PINs caused it. The statistics also do not isolate fraudulent port-outs from other SIM-related account takeovers, and some resulting financial crimes may be reported under different classifications.
The evidence supports a more limited conclusion: telephone-number takeover has caused significant documented financial harm, and carriers have introduced additional safeguards intended to reduce that exposure.
SIM Swap Protection
Get our SAFE plan for guaranteed SIM swap protection.
How Attackers Abuse Port-Out Requests
A fraudulent port-out occurs when an attacker impersonates a legitimate subscriber and causes their telephone number to be transferred to another service provider without authorization.
The attacker's objective is usually to gain control of the number so that incoming calls, SMS messages, and account-recovery communications can be redirected.
Port-Out Fraud vs. SIM Swapping
Although the terms are frequently used together, they describe different operations.
In a SIM swap, an attacker causes the existing carrier to associate the victim's number with another SIM card or eSIM. The provider generally remains the same.
In a fraudulent port-out, the number moves from its current carrier to a different provider.
Both attacks can redirect calls and text messages, but they involve different authorization procedures. A transfer PIN that protects inter-carrier porting does not necessarily prevent an unauthorized SIM replacement within the original carrier.
How a Fraudulent Port-Out Happens
An attacker may begin by collecting information about the subscriber, including personal details, carrier information, account identifiers, and other data that could assist impersonation.
The next objective is to satisfy or circumvent the carrier's authorization requirements. Depending on the provider's procedures, the criminal may attempt to compromise the carrier account, phish an active transfer PIN, impersonate an authorized account holder, or exploit weaknesses in customer-support verification.
Where a temporary transfer PIN is required, the attacker must obtain a valid credential or undermine the process responsible for enforcing it.
If the fraudulent request passes the applicable checks, the number may be transferred to an account controlled by the attacker. The legitimate subscriber can lose service while incoming communications begin reaching the receiving account.
From there, the attacker may attempt to compromise other services linked to the number, particularly those that permit authentication or account recovery through SMS.
Why a Transfer PIN Is Not a Complete Defense
The principal limitation is that a transfer PIN must be issued through an authorized account-management process.
If that process is compromised, an attacker may attempt to obtain a legitimate credential rather than guess its value.
Carrier account recovery introduces another challenge. Providers must assist customers who lose devices, forget passwords, or become unable to access their accounts. These legitimate recovery procedures require careful verification because they may also attract impersonation attempts.
I consider this one of the most important questions when evaluating port-out security: who can authorize the change, and what prevents an impostor from acquiring that authority?
A six-digit code or short expiration period provides limited assurance if the underlying account or recovery process is inadequately protected.
This does not establish that every carrier's transfer PIN process is vulnerable to the same bypass. It explains why authentication, administrator permissions, lock removal, and exception handling deserve scrutiny alongside the credential itself.
When Phone-Number Theft Leads to Financial Loss
A hijacked number becomes especially valuable when financial services rely on SMS codes or telephone-based recovery.
In March 2025, law firm Greenberg Glusker announced a $33 million arbitration award against T-Mobile in connection with a SIM-swap incident involving cryptocurrency investor Josh Jones. Although the case concerned SIM-change security rather than necessarily an inter-carrier port-out, it illustrates the potential financial consequences of unauthorized control over a mobile number.
However, controlling a number does not automatically compromise every associated account. An attacker still needs to satisfy the authentication or recovery requirements of the targeted service.
A properly secured hardware wallet, for example, does not reveal its private keys merely because an attacker receives SMS messages intended for its owner.
The more serious risk arises when a compromised number becomes a pathway into email, financial services, cryptocurrency exchanges, or business systems that continue to trust telephone-number possession as evidence of identity.
Monthly
Yearly
How Transfer PINs Work at Verizon, AT&T, and T-Mobile
The three largest U.S. carrier networks use similar authorization concepts, but their implementations differ in ways that affect account security.
These procedures vary by account category, and prepaid, business, and reseller accounts may have different requirements.
Verizon
Verizon allows eligible Account Owners and Account Managers to generate Number Transfer PINs through My Verizon. Subscribers can also use #PORT to access the relevant process.
For standard consumer accounts, one PIN can authorize transfers involving eligible lines on the account. Verizon Business uses a different model involving line-specific credentials.
Verizon's Number Lock restricts number transfers to other carriers, while its separate SIM Protection feature restricts certain transactions involving new SIMs or device associations.
The distinction is important because Number Lock does not independently prevent every SIM change. Verizon also documents a 15-minute blocking period for relevant changes after SIM Protection is disabled.
AT&T
AT&T's consumer Number Transfer PIN expires after four days, while the business version remains valid for fourteen days.
Customers can request a PIN through supported online methods or by calling *PORT, which requires the account passcode. Requesting a new Number Transfer PIN invalidates previously issued codes.
In July 2025, AT&T introduced Wireless Account Lock, which restricts number transfers, SIM/eSIM changes, device upgrades, and certain administrative transactions.
Unlike Verizon's separate controls, AT&T combines several restrictions into one account-level feature. However, users with primary or secondary online account access can manage that protection, making account permissions an important consideration.
T-Mobile
T-Mobile requires the Primary Account Holder to generate a Temporary Port Out PIN through an approved account workflow.
For applicable personal accounts, the documented process requires access from a device connected to T-Mobile's mobile network, with Wi-Fi disabled. Additional account verification may also be required.
T-Mobile offers Port Out Protection, a free feature that must be enabled individually for relevant lines. On applicable postpaid accounts, only the Primary Account Holder can remove the restriction.
What stands out to me is that these carriers use different combinations of account permissions, device requirements, temporary credentials, and locking mechanisms. Comparing PIN expiration periods alone tells us relatively little about the overall strength of their authorization procedures.
How to Protect Your Phone Number From Unauthorized Port-Outs
Protecting a number requires preventing unauthorized changes before an attacker has an opportunity to initiate them.
The most practical starting point is to enable available carrier restrictions and secure the account credentials used to manage those protections.
Enable Number Locks and SIM Protection
Verizon customers should review Number Lock and SIM Protection separately. AT&T customers should enable Wireless Account Lock where available, while T-Mobile customers should verify that Port Out Protection is active on every important line.
These controls create additional restrictions beyond merely presenting the correct transfer credential.
However, their effectiveness also depends on how securely the carrier authenticates requests to disable them.
Secure Your Carrier Account
Use a unique password and the strongest available account authentication. Protect the recovery email address and configure a strong account passcode that does not rely on easily guessed personal information.
For family and business accounts, review who holds administrative permissions. A compromised Account Owner, Account Manager, or authorized administrator may expose more than one line.
Treat Transfer PINs as Sensitive Credentials
Only request a transfer PIN when preparing for a legitimate carrier change, and provide it through the receiving carrier's approved process.
Avoid storing active PINs in unsecured messages, screenshots, or shared documents. Never disclose a transfer PIN or account passcode to an unexpected caller claiming to represent a carrier's fraud department.
If a PIN may have been disclosed, contact the existing provider and follow its instructions for replacing or invalidating the credential.
Monitor Suspicious Account Activity
Enable available notifications for transfer requests, account changes, and SIM replacements.
An unexpected transfer PIN notification or sudden loss of mobile service should be investigated promptly, particularly when accompanied by unusual login attempts or account-recovery messages.
Loss of service alone does not establish a SIM swap or fraudulent port-out, but a suspected number takeover warrants immediate contact with the carrier's fraud department.
After completing a legitimate transfer, review and enable equivalent safeguards at the receiving carrier.
Additional Security Layers Beyond Carrier PINs
Carrier controls reduce the likelihood of unauthorized number reassignment. Additional protections should reduce the damage an attacker can cause if a takeover nevertheless occurs.
For high-net-worth individuals, executives, and cryptocurrency investors, I would prioritize making control of the phone number insufficient to authorize access to valuable accounts or assets.
Move Away From SMS-Based Authentication
SMS two-factor authentication remains vulnerable to certain telephone-number takeover attacks because verification messages follow whoever controls the number.
NIST SP 800-63B-4 classifies authentication through the public switched telephone network, including SMS and voice-based verification, as a restricted authenticator. It also identifies recent SIM changes and number porting as risk indicators that services should consider.
For sensitive accounts, passkeys and FIDO2 hardware security keys provide stronger protection because they use cryptographic authentication rather than relying on text messages.
Authenticator applications that generate time-based one-time passwords are another useful alternative to SMS, although conventional one-time codes can still be phished.
Secure Account Recovery
Strong login authentication can be undermined if a service allows weaker recovery through SMS.
Review the recovery settings of your email, password manager, cryptocurrency exchanges, and financial accounts. Remove unnecessary telephone-number recovery options where possible, register backup security keys, and protect recovery codes separately.
The objective is to ensure that losing control of a number does not automatically grant access to unrelated accounts.
Separate Public and Sensitive Numbers
Executives, founders, and public figures often disclose telephone numbers for professional communications.
Using a separate, unpublished number for sensitive services can reduce the connection between publicly accessible information and important account-recovery channels.
This is a form of exposure reduction rather than a guarantee of security. Every number involved still requires appropriate carrier protection.
Protect Financial Assets Independently
A compromised telephone number can facilitate attacks against custodial cryptocurrency accounts if an exchange relies on SMS verification or recovery.
It does not automatically compromise private keys held securely offline.
Hardware wallets, multisignature authorization, withdrawal allowlists, transaction delays, and independent transaction approvals can limit the consequences of compromised communications or account credentials.
For substantial holdings, a single compromised authentication channel should ideally be insufficient to authorize a high-value transfer.
Where Efani's Carrier-Level Protections Fit
At Efani, our approach focuses on securing the mobile identity and the authorization procedures behind sensitive carrier changes.
Our SAFE Plan is designed around additional verification and administrative safeguards rather than relying solely on a conventional account PIN or self-service port lock. Efani's published security architecture describes an 11-layer verification process, manual human verification for sensitive account changes, and a 14-day port-out cooling period, subject to the applicable service procedures.
These controls introduce additional scrutiny and time for verification when someone requests a sensitive change. For high-risk customers, that additional friction can be a deliberate security advantage, even though it may make legitimate transfers or recovery less convenient.
The distinction I would emphasize is that stronger carrier verification and stronger online-account authentication solve related but separate problems.
Efani's carrier-level safeguards are intended to reduce exposure to unauthorized SIM changes and number transfers. They do not replace endpoint protection, secure email, phishing-resistant authentication, or independent financial authorization.
A comprehensive security strategy needs these layers to work together.
What to Do if Your Number Is Ported Without Permission
If you suspect an unauthorized transfer, contact your original carrier immediately using another device or a trusted support channel.
Report the suspected fraud, request escalation to the appropriate security team, and ask the provider to initiate its investigation and recovery procedures. Keep the case reference and relevant timestamps.
At the same time, secure your primary email account and review financial services, cryptocurrency exchanges, and other accounts associated with the number. Revoke suspicious sessions, investigate changes to recovery settings, and notify financial institutions if unauthorized access is possible.
Preserve transfer notifications, transaction records, unusual login alerts, and communications with the carrier. Depending on the circumstances, consider filing reports with the FTC, FBI IC3, or appropriate law-enforcement authorities.
Restoring cellular service does not necessarily reverse changes an attacker may have made while controlling the number. Account recovery and financial-security checks remain necessary after the number is restored.
Conclusion
Transfer PINs have strengthened number portability by introducing a dedicated authorization credential into a process historically exposed to impersonation and misuse of account information.
Their effectiveness, however, depends on more than the code itself. Carrier authentication, PIN issuance, account recovery, administrator permissions, and number-lock enforcement all influence whether an unauthorized transfer can proceed.
My recommendation is to treat transfer PINs as one component of mobile identity security. Enable available carrier locks, protect the underlying account, and reduce reliance on telephone numbers for sensitive authentication and recovery.
For anyone whose number is connected to financial assets, privileged business access, or sensitive personal communications, the central question is whether the entire process governing that number is sufficiently protected against unauthorized changes.
That is the standard against which carrier security should ultimately be evaluated.
