Technology

SIM-swap fraud: how it happens and how to stop it

In a SIM swap, a fraudster gets your mobile number moved onto a SIM they control, and with it your bank OTPs. Here is how it is done in India, the safeguards that already exist, and what to do the moment your phone loses signal.

Chander Prakash

By Founder & Editor

8 min read

Illustrative cover: SIM-swap fraud: how it happens and how to stop it
Illustration: Pointales

SIM-swap fraud is when a criminal gets your mobile number moved onto a new SIM card, or an eSIM, that they control. Your phone suddenly shows “No service”, and every call, SMS and one-time password (OTP) meant for you goes to them. With your number and a few personal details, they can reset passwords and log in to banking, wallet and UPI apps. Indian rules now slow this down: a replacement SIM needs full identity checks, and SMS is blocked on it for 24 hours. The best defence is to treat an unexplained loss of signal as an emergency and call your operator and bank at once.

What a SIM swap is

A SIM, whether a plastic card or a downloaded eSIM profile, is what ties your phone number to a device on the operator’s network. Operators replace SIMs routinely: when a card is lost, damaged, too large for a new phone, or being converted to eSIM. A SIM swap simply means the operator deactivates your old SIM and activates a new one for the same number.

That process is legitimate. The fraud lies in someone else requesting it in your name. Once the new SIM is live, your own SIM goes dead and the fraudster receives your texts. For how SIMs and eSIM profiles work under the hood, see our explainer on eSIM.

How fraudsters pull it off

A SIM swap usually needs two things: enough of your personal details to pass as you, and a way to get the operator to issue the new SIM.

Gathering your details

Fraudsters collect your name, mobile number, date of birth, address, and identity document numbers or copies. Common sources are phishing messages and fake “KYC update” calls, leaked databases, photocopies of ID left with shops, and what people post publicly. Often they also learn which bank you use, because the swap is only worth doing if there is an account to drain.

Getting the new SIM

  • Forged or misused ID at a retailer. A fraudster walks into a store or a sales agent (a point of sale, or PoS) claiming to be you, with a forged or stolen copy of your ID, and asks for a replacement for a “lost” SIM.
  • Insider help. A dishonest agent skips checks or uses ID documents they already hold. The Department of Telecommunications (DoT) reported in September 2026 that a PoS agent in Chhattisgarh had illegally activated 25 SIMs using citizens’ ID documents without their knowledge. That case involved new connections rather than swaps, but it shows how ID left with a retailer can be misused.
  • Talking customer support into it. A caller impersonates you to the operator’s support line, or impersonates the operator to you, offering an “upgrade” and asking you to share a code or approve a request.
  • eSIM conversion abuse. In August 2025 the Indian Cyber Crime Coordination Centre (I4C) warned that scammers send fake eSIM activation links that convert a victim’s physical SIM to an eSIM on the fraudster’s phone, after which “all communications, including critical bank transaction OTPs, are then rerouted to the scammer’s eSIM”, as reported by India TV.

Why it is so dangerous

Your mobile number is the master key to much of your financial life. Banks send transaction OTPs to it. Many apps let you reset a password with an SMS code. UPI apps are registered to it. Email accounts often use it for recovery. Whoever holds your number can often get through all of these, one reset at a time.

This is the core weakness of SMS-based two-factor authentication, which we compare against authenticator apps and security keys in our guide to two-factor authentication. A code sent by SMS proves only that someone holds the number, not that it is you.

Warning signs

  • Your phone shows “No service” or “Emergency calls only” in a place where it normally works, and restarting does not fix it.
  • You get an SMS, email or call about a SIM replacement, eSIM conversion or porting request you did not make.
  • Someone calls offering a free SIM “upgrade” and asks for an OTP or asks you to approve something.
  • You stop receiving calls and texts, while friends say your phone rings normally or goes to a message you did not set.
  • Bank alerts arrive on email for transactions, password changes or new device logins you did not make.

The safeguards that exist in India

Several rules now make a quick SIM swap harder. They do not make it impossible, but they buy you time.

SafeguardWhat it doesSource
Full KYC for replacement SIMsA subscriber “has to undertake complete KYC for replacement of his SIM”, the same identity check as a new connectionDoT via PIB, Aug 2023
24-hour SMS barIncoming and outgoing SMS are barred for 24 hours on the replacement SIM, so OTPs cannot arrive straight awayDoT via PIB, Aug 2023
Seven-day porting barNo porting code can be issued within seven days of a SIM swap, so the number cannot be quickly moved to another operator; in force since 1 July 2024TRAI via All India Radio
Registered retailersOperators must register every PoS with biometric checks and physical verification of their address; violators can be terminated and blacklisted across all operatorsDoT via PIB, Aug 2025
Printed Aadhaar checked by QRDetails from a printed Aadhaar must be captured by scanning its QR code, to stop doctored photocopiesDoT via PIB, Aug 2023
Criminal penaltiesObtaining SIMs through fake documents, fraud or impersonation is punishable under the Telecommunications Act, 2023, with up to three years’ imprisonment and fines up to ₹50 lakhDoT via PIB, Sep 2026

The 24-hour SMS bar matters most. It gives you a window of roughly a day, after your phone goes dead, before the fraudster can receive SMS OTPs on the new SIM. Use it.

What to do immediately

If your signal vanishes and you did not ask for any change, act within minutes, not hours. Use another phone or a landline.

  1. Call your operator on its official helpline, found on its website or app, not from a search ad. Ask whether a SIM replacement or eSIM conversion was done on your number, and ask them to block it and restore your SIM.
  2. Call your bank on the number printed on your card or in its official app. Ask it to freeze online banking, cards and UPI on your accounts, and to block any change of registered mobile number.
  3. Lock down UPI and email. Use your bank’s and UPI app’s block options, and change the password on the email account linked to your bank.
  4. If money has gone, call 1930, the national cybercrime helpline, and file a complaint at cybercrime.gov.in. Speed matters: the helpline alerts banks to hold funds while they are still in the system.
  5. Write everything down: times, transaction references, and whom you spoke to. You will need it for the bank, the police and any complaint.

Report fast for another reason too. A transaction done through a hijacked SIM is an unauthorised one. Under the RBI’s 2017 rules on customer liability, which apply until new rules take effect on 1 January 2027, your liability is zero if a third-party breach is reported to the bank within three working days of the alert, and rises after that. Our guide to UPI frauds sets out the full liability table.

For a suspicious call or message where no money was lost, such as a fake “SIM upgrade” call, use the Chakshu facility on the DoT’s Sanchar Saathi portal. The government says Chakshu is for fraud that was attempted but not committed; cases involving actual loss go to I4C through 1930 and cybercrime.gov.in.

How to prevent it

No single step stops every SIM swap, because the weak point is often the operator’s process, not your phone. But you can make yourself a much harder target.

  • Guard your identity documents. Do not share Aadhaar, PAN or other ID copies with unknown callers or websites. When you must give a photocopy, write the purpose and date across it.
  • Never share OTPs or approve requests you did not start, especially about SIM upgrades, eSIM conversion or “KYC expiry”. Your operator will not call you to ask for these.
  • Start any SIM change yourself, through the operator’s own app, SMS short code or store.
  • Check the connections in your name. Sanchar Saathi’s “Know Mobile Connections in Your Name” service lets you see every number registered to your identity and report ones you did not take.
  • Set a SIM PIN. Apple says a SIM PIN means a code is needed for calls and mobile data; Google says Android asks for it whenever the phone turns on or the SIM goes into another device. Change the operator’s default PIN, and never guess: wrong guesses can lock the SIM permanently. Note what this protects against: a stolen phone or SIM, not a duplicate SIM issued by the operator.
  • Move away from SMS codes where you can. Use an authenticator app, or better, a passkey, for email and other important accounts. Passkeys do not depend on your phone number at all; our passkeys explainer shows how they work.
  • Turn on email alerts from your bank, so you still hear about transactions if your SMS stops.

The point: A SIM swap steals your phone number, and with it the OTPs that guard your money. Indian rules now force full KYC for replacement SIMs and block SMS on them for 24 hours, which gives you a short head start. If your phone suddenly loses signal for no reason, call your operator and bank from another phone straight away, and call 1930 if money has gone.

Sources

Share