Your phone says “SOS only” and your bank codes have stopped: the port-out scam

Port-out fraud is the quiet one. There's no phone call, no pop-up, no story. Someone who has collected enough of your details — name, date of birth, address, sometimes a driver licence number from an old data breach — contacts a mobile provider and asks to move your number to a SIM they control. If they get through the identity checks, your phone goes dead and theirs lights up with your number. From that moment, every text your bank sends to confirm a login or a transfer arrives on the scammer's handset. ACMA put out a warning on mobile fraud in April 2026 after a run of cases; the losses come not from the phone but from what the phone unlocks.

What a real port looks like

Since 2020, Australian telcos have been required to verify that the person requesting a port actually controls the number. In practice that means the gaining provider sends a code to your existing phone, and the port only proceeds when you provide it. So a genuine port has two features: you started it, and a code arrived on the old phone. Anything else is a fake or a fraud.

That text is the front door. It isn't from Telstra; the link is a login-stealing page. The details it harvests — your account number, PIN, date of birth — are exactly what a fraudster needs to pass the telco's checks and do the real port an hour later. A genuine warning from your telco about a port you didn't request tells you to ring them; it doesn't send you a link to a domain with a hyphen in it.

The signs, and what to do about each

1. A “cancel this transfer” text. Don't tap it. Ring your telco on the number from their website or the back of your bill and ask whether a port is pending. They can put a note on the account.
2. A porting code you didn't ask for. Someone has tried to start a port. Don't give the code to anyone who rings for it, however plausible. Ring the telco.
3. SOS only, or No service, when others have signal. This is the port having happened. Don't wait for it to fix itself. From any other phone: ring the telco and say my number has been ported without my consent; then ring every bank you use and say my mobile number has been taken over, freeze online access. The order matters and the clock is running.
4. Password reset emails you didn't request. With your number, the scammer can reset access to email, banking and myGov. Change your email password first, from a device you trust, and turn off SMS as your recovery method where you can.

Making it harder in advance

Ask your telco to add a port-out PIN or “no port without in-store ID” note to your account; most will. Use an authenticator app rather than SMS codes for your main bank and email where the option exists. And be stingy with your date of birth and licence number online — they are the two details that get a scammer past a telco's checks.

The person you worry about

An older parent's phone going to SOS only reads as “the phone's playing up”, and a day can pass before anyone connects it to the bank. That day is the whole scam. Is it a scam? answers the fake “cancel this transfer” text before it's tapped, and the family gets the same verdict at the same time. If the phone itself is dead, a photo of the screen from someone else's phone gets the emergency version: ring the telco now, then the bank. Paste any message into the free checker.

Common questions