SIM Swap Fraud: How Your Number Is Hijacked

Your mobile number is the master key to your money. Banks, UPI apps, Aadhaar, email recovery and the income-tax portal all send their codes to it. SIM swap fraud is the crime of taking that key: moving your number onto a SIM in a stranger's phone so the codes go to them instead. It leaves one visible trace, and it is the one most people ignore for an hour: the phone stops showing network.

This explainer covers how the swap is done in India, what the criminal does with the number in the hours that follow, how to recognise it the moment it happens, and the handful of settings that make you a poor target.

How SIM swap fraud is done

A SIM is just a card that tells the network "this handset is this number". Operators replace them every day for customers who lose phones or want a smaller card, and that routine process is what the fraud abuses. There are three ways in.

The store visit with forged ID

The criminal walks into a retail outlet with a forged Aadhaar or a printout of your ID from a data leak, says the SIM was lost, and asks for a replacement. Operators require verification, but a busy store, a convincing document and sometimes a small bribe get the duplicate SIM issued. Your card goes dead the moment theirs activates.

The "eSIM upgrade" message

You receive an SMS or email, apparently from your operator, offering a free eSIM upgrade or warning that your SIM will be deactivated unless you upgrade. The link or the reply leads you to request an eSIM yourself; the activation QR or confirmation goes to an email address the criminal controls, or you are talked into forwarding it. You did the swap for them.

The dishonest agent

Retail agents have the system access to process replacements. Gangs recruit a few. This route needs no forgery at all, and it is why operators now impose waiting periods and extra checks on SIM changes.

Two rule changes are worth knowing. After a SIM replacement, operators bar outgoing SMS for a period so that the new SIM cannot immediately be used for OTP-dependent registrations, and TRAI tightened mobile number porting rules in 2024 so a number cannot be ported within seven days of a SIM swap. Neither stops the fraud, but both narrow the window.

What they do with your number in the first hours

A SIM swap is rarely the first step. It is the last. By the time the swap happens the criminal usually has your net-banking user ID, your card number or your email address from phishing or a breach, and has run out of ways to get the OTP. The number closes the loop.

With the number live on their handset they reset your net-banking password ("forgot password" sends an OTP), approve transfers, register UPI on their phone (registration sends an SMS from the SIM, which is now theirs), take an instant pre-approved loan from the bank's app, and reset your email password if it recovers by SMS. The email reset is the dangerous one, because from your email they can reach every other account. Our OTP fraud explainer covers why the code is the whole game; the UPI fraud guide covers the re-registration trick.

The window is short by design. The criminal knows you will notice the dead phone, so the transfers are queued and fired within an hour, often late at night when you are asleep and the bank's fraud desk is quiet. The defence is noticing in time and knowing who to call before you need to.

How to recognise a SIM swap in progress

Do not wait for the network to come back. Borrow a phone and call the operator's customer care; ask directly whether a SIM change was processed and tell them to block the new SIM. Then call your bank's fraud line and freeze net banking, cards and UPI. If anything has already moved, dial 1930 with the details; the full order of steps is on the reporting page.

Closing the door before anyone tries

Check how many SIMs are registered against your identity on TAFCOP at Sanchar Saathi, the Department of Telecommunications portal, and report any you do not recognise; our TAFCOP walkthrough shows how. Ask your operator about a SIM lock or "SIM change PIN", where available, so replacements need a code only you know. Report the eSIM phishing messages on Chakshu, explained in our Chakshu guide, so the numbers are disconnected.

Then reduce how much your number can do. Move your email account's two-factor method from SMS to an authenticator app, and add a recovery email rather than only a recovery phone; our guide to password managers and 2FA walks through it. Keep savings in an account that is not linked to UPI and has no instant-loan facility, so a successful swap reaches a bounded amount. Never forward an operator's activation SMS or QR to anyone, whatever the reason given.

Finally, keep your bank's fraud line and your operator's customer care number saved on a second phone or written down, because when the swap happens your own phone is the one thing you cannot use.

After a loss: the bank, the Ombudsman and the second scam

SIM swap victims have a clearer case than most. You did not share an OTP or a PIN; a third party obtained your number through the operator's process. Write to the bank within three working days stating that, attach the operator's confirmation of the SIM change, and quote the RBI circular of 6 July 2017, under which third-party fraud reported in that window carries zero customer liability. If the bank has not resolved it in 30 days, escalate to the RBI Ombudsman. You may also have a complaint against the operator for the verification failure, which goes to its appellate authority and then to TRAI's channels.

And then the familiar warning. People whose details have been through one fraud get a call from a "recovery agent", a "cyber lawyer" or a "bank reversal team" who knows exactly how much went. That is the same network, or one that bought the list, and nobody can guarantee recovery. Our identity theft and SIM swap service handles the operator, bank and police follow-ups for a fixed fee if you want it done for you; the broader category is on the identity theft and SIM swap page, and the DoT's tools are described on the Sanchar Saathi page.