Everyone who reads this needs to figure out that you cannot have any phone number associated with online accounts(so long as they allow this which most do, even google account you don't need or want to have any phone number whatsoever). Like nowhere in the whole profile or account. Need to use authenticator apps for 2FA and have absolutely no way of recovering/accessing the accounts through a phone number. This is only real way to protect from sim swaps. I'm not even sure that sim swap is what happened to him, but regardless if you aren't protected from sim swap then you aren't protected period.