SIM swap fraud happens when a criminal gets a duplicate SIM, or an eSIM, issued for your mobile number, so that the OTPs and alerts meant for you reach them instead. The main warning sign is a phone that suddenly loses service for no clear reason. If that happens, use another phone or Wi-Fi to contact your bank and mobile operator immediately, and if money has gone, report to your bank and to 1930 or cybercrime.gov.in.
Who this is for and what you will have at the end
This guide is for anyone in India who uses mobile banking, UPI or SMS OTPs. At the end you will recognise how a SIM swap is set up, know the signs, have a protection checklist, and know the order in which to act if you think it has happened to you. It does not describe how to carry out the fraud. The description of the fraud comes from RBI's BE(A)WARE awareness booklet, and the reporting routes from the Sanchar Saathi portal and the National Cyber Crime Reporting Portal. Portal layouts and rules change, so check the live page before acting on a detail such as a connection limit or menu name.
How SIM swap fraud works
According to RBI's awareness material, fraudsters obtain a duplicate SIM, including an eSIM, for a customer's registered mobile number and use the OTPs that arrive on it. The RBI booklet also warns that scammers often pose as mobile network staff offering a SIM upgrade in order to collect customer details. The key precaution it gives is never to share identity credentials tied to your SIM.
In simple terms:
- The criminal collects enough personal details about you, often by phone or message.
- They persuade the operator, or you, to move the number to a SIM they control.
- Your own SIM stops working, and OTPs and alerts go to the criminal.
- They use those OTPs with stolen banking or wallet details.
Because the weakness is the phone number itself, anyone who relies on SMS OTP for banking is exposed if the number is moved.
Warning signs
- Sudden "No service" or no signal on a phone that was working, especially when others on the same network still have signal.
- Calls or messages offering a SIM upgrade or asking for KYC details for your SIM, followed by a request for a code or document.
- Unexpected messages from your operator about a SIM change or a new SIM activation you did not request.
- Bank or UPI alerts you did not trigger, or OTP messages you did not ask for.
- Being locked out of accounts because the code is going elsewhere.
None of these on its own proves a swap, but loss of service combined with any of the others should be treated as urgent.
What to do first if you think it has happened
Act in this order and keep notes of the time of each step.
- Use another phone or Wi-Fi to contact your bank. Ask them to block internet banking, UPI and cards linked to the number, and tell them you suspect a SIM swap.
- Contact your mobile operator through another phone or in person. Ask them to block the new SIM and restore your number. Take a government ID.
- Report the fraud. If money has left your account, call 1930, the national cybercrime helpline, or report at cybercrime.gov.in, the National Cyber Crime Reporting Portal. Report quickly, because speed improves the chance of stopping transfers.
- Change passwords for email, banking, and any app that uses your number for recovery. Do this from a trusted device.
- Collect evidence. Keep screenshots of messages, transaction details, and the time your signal was lost.
- File a complaint in writing with the bank and keep the reference number.
Do not share an OTP or any code with anyone who calls you during this process, including people who say they are from the bank or the operator. Call the official number printed on your card, statement or the operator's website yourself.
How to protect yourself
Protect your identity details
- Do not share OTPs, Aadhaar, PAN, SIM numbers or documents with callers or in messages.
- Be suspicious of any call about a "SIM upgrade", especially one that asks you to press a key or share a code.
- Do not post your mobile number, date of birth or ID details publicly.
Check which connections are in your name
The Department of Telecommunications runs the TAFCOP tool on the Sanchar Saathi portal (sancharsaathi.gov.in). You log in with your mobile number and OTP to see the mobile connections registered against your identity, and you can report numbers you did not take or no longer need. Public information about the portal states a subscriber can hold a maximum of nine mobile connections across all operators in India, and six for subscribers in Jammu and Kashmir, Assam and the North Eastern states. Confirm the current rule on the portal itself.
Reduce reliance on SMS OTP
- For important accounts, use an authenticator app or a hardware security key where the service offers it, because those do not depend on your phone number.
- Keep alerts on for every bank and UPI app, and check them often.
- Set transaction limits on UPI and cards to what you actually need.
Secure the phone number account
- Ask your operator whether they offer a PIN, password or extra verification for SIM changes, and set one if so.
- Keep your registered email address and alternate contact details with the bank up to date, so the bank can reach you when the SIM is dead.
Report suspicious calls
Sanchar Saathi's Chakshu facility lets you report suspected fraud calls, SMS and WhatsApp messages, such as fake KYC updates, before any money is lost. It is not for reporting a loss that has already happened. For that, use 1930 or cybercrime.gov.in.
Where to report
| Situation | Where to go |
|---|---|
| Money has left your account | Your bank first, then 1930 or cybercrime.gov.in |
| Your SIM stopped working and you suspect a swap | Your mobile operator and your bank |
| You received a suspicious call or message but lost nothing | The Chakshu facility on Sanchar Saathi |
| You want to check numbers in your name | TAFCOP on Sanchar Saathi |
Troubleshooting
- My signal dropped but it may be a network fault. Check with another person on the same operator or visit the operator's store. If you cannot confirm quickly, tell your bank anyway.
- I cannot reach my bank without OTP. Use the bank's official helpline on the back of your card or on its website, from another phone.
- A caller says my SIM will be blocked unless I share a code. End the call and do not share any code. Call the operator's official number yourself to check.
- I already shared an OTP. Treat it as a fraud in progress and follow the first-steps list above at once.
Checklist
- Never share OTPs or SIM details with callers.
- Treat sudden loss of signal as urgent.
- Contact your bank and operator from another phone.
- Report to 1930 or cybercrime.gov.in if money is lost.
- Check connections in your name on Sanchar Saathi.
- Use authenticator apps for important accounts where possible.
- Keep bank alerts on and limits sensible.
See also Fake customer care number scam: how to avoid it and Digital arrest scam in India: what to do.
References
- Reserve Bank of India, BE(A)WARE booklet: https://www.rbi.org.in/commonman/Upload/english/Content/PDFs/English%20BEAWARE.pdf
- Sanchar Saathi, Department of Telecommunications: https://sancharsaathi.gov.in/
- TAFCOP: https://tafcop.sancharsaathi.gov.in/
- National Cyber Crime Reporting Portal: https://cybercrime.gov.in/
Comments
Questions and tips are welcome. Comments are checked by the EpiFive team before they appear; please do not share passwords, phone numbers or other private details.