SIM-swap fraud in India: how it works and how to stop it

SIM-swap fraud is quiet, fast, and devastating. You lose signal for a few minutes, dismiss it as a network glitch, and by the time your phone comes back online the fraudster has reset your net-banking password, drained the account, and moved on. It's now one of the top three ways money is stolen from Indian bank accounts.

What actually happens

1. The fraudster collects enough personal information about you — usually from a data breach, a fake job form, or a phishing SMS — to fill out a SIM replacement form.
2. They walk into a mobile store (or use a lax online porting flow) and request a new SIM claiming the old one was lost.
3. The store issues a new SIM. Your handset loses signal.
4. They pop the new SIM into their phone, request OTPs for your net-banking, UPI, and email, and clean out everything with an OTP behind it.

The entire attack usually completes in under 60 minutes. By the time you notice, the money is often already through two or three mule accounts.

The 4 settings that block SIM-swap fraud

1. Turn on SIM lock (PIN). Settings → Security → SIM lock. Now the SIM asks for a PIN before it will work in any device. A stolen or freshly-issued SIM without the PIN is useless.
2. Set a port-out PIN with your telecom. Airtel, Jio and Vi all let you SMS PORT <number> to 1900 to see how easy porting is. Then dial your carrier and ask them to lock the number to your Aadhaar / ID with a port-out password.
3. Move OTPs off SMS where you can. Use an authenticator app (Google Authenticator, Authy) for email, brokerage and crypto accounts. SMS OTP is still the default for banks — you can't avoid it — but everything else should be app-based.
4. Enable transaction alerts on email AND SMS. A duplicate email alert is your only warning if your SIM has been swapped and SMS is going to the attacker.

Warning signs your SIM has just been swapped

• Sudden loss of signal that lasts more than a few minutes when the network is otherwise fine.
• “SIM registration failed” or “No SIM card” message.
• Emails about password resets you didn't request.
• Bank UPI / login SMS suddenly stops arriving on a working device.

If you think it's happening now

1. Call your bank's fraud helpline from another phone immediately — every minute counts.
2. Call 1930, the national cybercrime helpline. The “golden hour” is real; funds are reversible if reported fast.
3. Visit your telecom store with ID and ask them to reissue your SIM to you and reset the port-out password.
4. File a complaint at cybercrime.gov.in once the immediate freeze is in.

See our step-by-step reporting guide and bank fraud helplines page for the numbers to keep saved on a second device.