PanicStation.org
UK USA
us Technology & digital loss call forwarding alert • carrier alert message • unauthorized call forwarding • calls forwarded to another number • call forwarding enabled not me • phone number takeover • sim swap scam • port out fraud • account takeover suspected • voicemail hacked • verification codes intercepted • two factor texts compromised • mobile account security • wireless carrier fraud department • unexpected carrier change • phone service hijacked • identity theft steps • fcc complaint phone issue

What to do if…
you get a carrier alert that call forwarding was enabled and you did not set it

Short answer

Treat this as a possible phone-number takeover. Contact your wireless carrier immediately using a verified number/app and have them remove all call forwarding and secure your account before you rely on calls/texts for verification.

Do not do these things

  • Do not dial any “repair codes” given to you by an unexpected caller/text/voicemail.
  • Do not click links in the alert message unless you can confirm they’re from your carrier (use the official app/website instead).
  • Do not share one-time codes, your account PIN, your port-out PIN, or verification answers with anyone who contacts you first.
  • Do not assume turning off forwarding in phone settings is enough (forwarding can be set at the carrier/network level).

What to do now

  1. Contact your carrier via a trusted route (now).
    Use the official carrier app, the number on your bill, or the carrier’s official website. Ask for the fraud/security team.
  2. Ask the carrier to confirm what changed, then clear it at network level.
    Ask which type(s) of call forwarding were enabled and when, and have them remove/clear all call forwarding on the network.
  3. Ask for checks on SIM/eSIM and port-out activity.
    Ask whether there were any recent SIM swaps, eSIM activations, device changes, port-out requests, new lines, added authorized users, or address changes.
  4. Lock the wireless account down using the strongest protections they offer.
    Reset/set your account PIN/passcode and ask specifically for whatever prevents SIM changes and ports without extra proof (for example: a separate port-out PIN, a number/port lock, or in-person verification requirements, depending on the carrier).
  5. Secure voicemail right away.
    Change the voicemail PIN and confirm remote access requires a PIN. Ask if voicemail was reset or accessed recently.
  6. Secure the accounts that depend on your phone number (without locking yourself out).
    Start with your primary email: change the password, review recent sign-ins, remove unknown devices/sessions, and check for forwarding rules/recovery changes.
    Before changing 2FA methods elsewhere, save backup codes and confirm recovery options (so you don’t get locked out). Then move key accounts (banks, Apple ID/Google, payment apps) away from SMS 2FA if possible.
  7. Do a quick “damage check” (15 minutes).
    Review bank/credit activity and alerts, check app store/mobile wallet purchases, and check your carrier account for new lines or profile changes.
  8. If you suspect identity theft or carrier-level fraud, start an official recovery trail.
    Use IdentityTheft.gov to create a record and get tailored steps. If the carrier won’t fix the issue or you need escalation, file a consumer complaint with the FCC.
  9. Write down a short incident log.
    Capture: alert time/date, what the carrier confirmed, ticket/reference numbers, and which accounts you checked. This helps if you need to dispute charges or escalate.

What can wait

  • You do not need to figure out who did it or how they got your information right now.
  • You do not need to reset every password immediately—prioritize carrier account, voicemail, and primary email, then financial accounts.
  • You do not need to decide today whether to involve local law enforcement unless you have confirmed losses or ongoing impersonation.

Important reassurance

A surprise call-forwarding alert is alarming, but it’s often containable when you act quickly: remove forwarding at the carrier level, lock the account down, and secure the accounts that rely on your phone number.

Scope note

This guide is first steps only—focused on stopping interception and reducing immediate damage. Further recovery (restoring accounts, credit protections, and longer-term security changes) may require additional steps tailored to what your carrier finds.

Important note

This is general information, not legal, financial, or technical advice. If you see unauthorized transactions, account lockouts, or evidence your identity was misused, contact your financial institutions and carrier promptly and use official reporting channels.

Additional Resources
Support us