SIM swap fraud: how scammers steal your number to empty your account

SIM swap fraud is when a scammer gets a new SIM card issued for your mobile number. Your own SIM goes dead, and every call, SMS and OTP meant for you goes to them instead. Since most banking and UPI apps trust that OTP, whoever holds your number can often get into your money.

How it happens. First, the scammer collects your details: your name, number, perhaps your Aadhaar or bank details. These come from a phishing link, often sent by SMS (called smishing), a fake “KYC update” call, or a data leak. Then they visit or call your telecom operator, pretend to be you, and ask for a replacement SIM, saying the old one was lost or damaged.

Why the OTP matters so much. Once the new SIM is live, the scammer can tap “forgot password” on your bank or UPI app and receive the reset code. From there, they move money out. That is why a SIM swap is so dangerous: it quietly breaks the one safety check most people rely on.

Did you know? India has two rules that slow this fraud down. Under a September 2022 Department of Telecommunications instruction, SMS is barred for 24 hours on a new SIM after a swap or replacement, so OTPs cannot reach it straight away. And under TRAI rules in force since 1 July 2024, a number cannot be ported to another operator within 7 days of a SIM swap. Sources: DoT; TRAI press release No. 35/2024. Check the current rules with your operator.

The warning signs. That 24-hour gap is your window. Watch for these.

What to do, fast. If your phone loses signal for no reason, do not wait for it to come back. From another phone, call your telecom operator and ask if a SIM was issued for your number, and block it. Call your bank to freeze your accounts and cards. Then call the 1930 helpline and file at cybercrime.gov.in. Our guide on how to report a UPI fraud has the full steps.

How to make it harder. Never share an OTP, your Aadhaar details or ID photos with a caller, whoever they claim to be. Ignore “your SIM will be blocked, update KYC” messages, which is the KYC update scam. Turn on app locks and a UPI PIN only you know. You can also check which mobile numbers are registered in your name on the government’s Sanchar Saathi portal, sancharsaathi.gov.in, and report ones you do not recognise.

The takeaway. Your mobile number is the key to your bank account. If your phone suddenly loses signal for no reason, treat it as an emergency, not a network glitch. Call your operator and bank first, then 1930.

More on staying safe: safe habits on UPI, the KYC update scam, and the fake customer care number scam.