Put a PIN on your SIM card

SMS is the weakest tier of two-factor authentication not because of SMS itself, but because your phone number can be moved. Once it moves, the codes obediently follow it to somebody else. A SIM PIN patches exactly that segment: it is a lock bound to the card rather than the handset, so pulling the card and putting it in another device stops at the first screen. It does not solve everything, but it is one of the few parts of this chain you can finish on your own.

What a SIM PIN actually is

It is a code set on the SIM card (or eSIM profile), separate from the passcode that unlocks your phone. The device passcode protects that handset; the SIM PIN protects that card — the lock travels with the card into whatever device it lands in.

Apple’s help page is blunt about when it fires: once enabled, “every time you restart your device or remove the SIM card, your SIM card or eSIM will automatically lock”, and the status bar shows Locked SIM. That tells you the trigger — not every unlock, only when the card’s custody changes.

Android has an equivalent setting, in a location that varies by manufacturer, usually under security or SIM settings. This article gives no exact path, because models differ; the menu in front of you wins.

What it blocks

One thing, and it is the one that matters: a physical card being taken and used in another device.

Phone stolen, card pulled, card slotted into another handset to receive your codes — that route stops at the boot screen. For any account that still uses SMS as a recovery path, that is worth having. Why SMS is the weakest 2FA covers why the chain is fragile; this article is the segment of it you can repair yourself.

What it does not block

This section matters more than the last one, because treating it as a universal lock buys false calm.

• It does not stop a carrier-side SIM swap. If someone walks into a shop with forged details and has your number reissued onto a new card, that is a new profile — the PIN you set on the old card plays no part. Defending that requires carrier-side measures such as an account password or extra verification.
• It does not help if the phone is taken unlocked. The PIN is asked at restart or card removal. A phone already running is already past it.
• It does nothing about anything unrelated to the number. Leaked passwords, phishing, malware — none of it involves this card.

The accurate summary: a SIM PIN closes the physical-transfer route and leaves every other route open.

The one thing to do before enabling it

Get the default PIN and the PUK from your carrier. Do not guess.

Apple’s page is unusually firm here: a wrong guess “can permanently lock your SIM card or eSIM, which means that you would need a new SIM card or eSIM”, and if you see a “PUK exhausted” alert the only remaining option is asking the carrier for a replacement. In other words, the price of locking yourself out is getting a replacement from the carrier — whether that is a physical SIM or an eSIM, and whether it can be done without a shop visit, depends on the carrier.

Default PINs, how many wrong attempts are allowed and how a PUK is obtained all differ by carrier. Ask yours. This article gives no numbers, because any number printed here would be wrong for someone.

Three small things once it is on

• If your carrier issued a default PIN, change it as their instructions describe. How those are handed out varies by carrier; any PIN that someone other than you might already know is not doing the job of a lock.
• Store the PIN and PUK somewhere other than this phone. Keeping them on the device that gets stolen defeats the point.
• Restart once to confirm you can enter it. That surfaces “I misremembered it” immediately, rather than on some random restart weeks later.

With those three done the lock is genuinely standing. It costs nothing, barely touches daily use (it only appears on restart and card changes), and is one of the better value items in account hardening.

Common questions