A SIM-swap attack is when an attacker transfers control of your SIM card to a phone that they control. If you have accounts that use your phone number for 2FA then they can bypass that 2FA security.

xPortal is perfectly safe against SIM-swap attacks because they do not have access to your funds as they do not have access to your seed phrase.

If you use iCloud or Google Drive for backup, you should make sure to enable 2FA on your iCloud or Google account using Authy or 1Password. We don't recommend Google Authenticator or SMS verification because it is tied to your device.