How to Set Up a New Phone Securely, in the Right Order

SIM swapping is worth explaining directly, since it's the reason the carrier-PIN step exists at all. An attacker who has gathered enough of your personal information can call or contact your mobile carrier, impersonate you, and convince a representative to transfer your phone number to a SIM card they control. Once that happens, any account that uses SMS text messages for account recovery or two-factor authentication is exposed, because the attacker is now receiving those texts, not you. A carrier account PIN adds a second piece of information an attacker needs beyond what's typically available through basic impersonation, which is exactly the gap CISA's guidance is closing.

The account-before-device sequencing matters for a related reason. A new phone is not a fresh start if the account it signs into is still using a weak recovery method, a reused password, or SMS-only two-factor authentication. CISA's guidance recommends phishing-resistant authentication (passkeys or hardware security keys) specifically because it removes the SMS interception risk entirely, not just the SIM-swap variant of it. Setting this up on the account before restoring anything to the new device means the new phone inherits the stronger setup, instead of temporarily reactivating the weaker one during the transfer.