SIM Swap Fraud in India: How It Works and How Banks Can Respond

SIM swap fraud is a scam in which a criminal gets a mobile operator to issue a replacement SIM for your number, usually by impersonating you, so that your calls and SMS, including bank OTPs, reach the fraudster’s phone. With control of the number, the attacker can reset passwords and authorise transactions in your name.

The attack exploits a design assumption most of India’s digital finance still relies on: that whoever receives an OTP on a registered mobile number is the account holder. When that assumption breaks, two-factor authentication becomes one factor.

Regulators have narrowed the window. DoT, TRAI and RBI rules now delay SMS, block quick number porting and require risk-based authentication. This guide explains how SIM swap fraud works, the warning signs, what to do, and how banks and fintechs should re-verify customers when a SIM, device, or registered mobile changes.

How SIM Swap Fraud Works

A typical SIM swap attack in India runs in four stages:

1. Reconnaissance: the fraudster collects your name, mobile number, date of birth, and sometimes bank details through phishing calls, fake KYC update messages, data leaks, or malware.
2. Impersonation: using forged or borrowed identity documents, the fraudster requests a replacement SIM from your operator, claiming the original was lost or damaged.
3. Takeover: once the new SIM activates, your phone loses network. The attacker now receives your calls and SMS.
4. Extraction: the attacker resets net banking, UPI, or wallet credentials using OTPs and moves money out, often through mule accounts.

Variants include a “SIM upgrade” call, where a caller posing as operator staff persuades the victim to share the number printed on a new SIM, and insider-assisted swaps at retail points of sale.

Who gets targeted

Fraudsters favour people whose numbers are linked to high-balance accounts, demat accounts, or business current accounts. Customers who rely heavily on SMS OTPs and may not notice a lost signal quickly, such as many senior citizens and small business owners, are especially exposed.

Warning Signs of a SIM Swap

• Your phone shows “No service” or “Emergency calls only” for an unusually long time in an area with normal coverage.
• You receive a message from your operator about a SIM change or replacement request you did not make.
• Calls or messages from unknown people asking for a SIM number, OTP, or “upgrade” confirmation.
• Bank alerts by email about login, password reset, or beneficiary addition that you did not initiate.
• Friends report that calls to your number are answered by someone else or go unanswered.

What to Do If You Suspect a SIM Swap

1. Contact your mobile operator immediately from another phone and ask them to block the SIM.
2. Call your bank’s 24×7 helpline to freeze net banking, UPI, and cards linked to that number.
3. Report the fraud on 1930 or at cybercrime.gov.in, with times and transaction details.
4. Use the Sanchar Saathi portal to check connections issued in your name and report suspected fraudulent communication through its Chakshu facility.
5. After the number is restored, change passwords and review registered devices and beneficiaries.

Speed matters: the attacker needs only a short window with your OTPs to move money.

India’s Regulatory Safeguards Against SIM Swap

Three sets of rules now work together to slow down SIM swap fraud.

Telecom enforcement has scaled up as well. In a Rajya Sabha reply reported on 23 July 2026, the Minister of State for Communications said about 88 lakh suspicious connections had been disconnected after failing reverification flagged by DoT’s AI tool ASTR, and 11.18 lakh fraud reports had been filed through Chakshu.

Where the gaps remain

The 24-hour SMS bar helps only if the customer notices the lost signal and reports in time. The porting block stops one route, not swaps within the same operator. And RBI’s directions set minimum standards; whether an institution treats a fresh SIM as a risk signal is its own design choice.

Why OTP-Only Security Fails

An SMS OTP proves possession of a number, not identity. In SIM swap fraud, possession is exactly what the attacker has acquired.

RBI’s 2025 directions recognise this. As summarised by Khaitan & Co, at least one factor must be dynamic and unique to the transaction, and issuers may add checks beyond the minimum under their own risk policies. Ujjivan SFB’s explainer notes that risk-based checks can weigh device, location, transaction history, and amount, and that entities bear liability for losses arising from weak authentication or non-compliance.

The commercial message is plain. If your control stack sends an OTP to a number that changed SIM yesterday and accepts it without further checks, you carry the loss risk.

Detection and Step-Up Re-Verification for Banks and Fintechs

Fighting SIM swap fraud at an institution has two parts: knowing that something changed, and proving the customer is still the customer.

Signals that should trigger step-up

• A new device binding or app reinstall on a known account
• A change of registered mobile number or email
• Recent SIM change data where available from telecom partners
• Password reset followed quickly by beneficiary addition or a high-value transfer
• A login location or network inconsistent with the customer’s history

Your rules and device-binding stack generate most of these signals. At onboarding and at number change, confirms the number is active and plausibly tied to the customer.

Step-up options compared

A check against the photo captured at original KYC gives the strongest balance. Adding a check when a customer submits a new mobile number or bank account confirms the details belong to the same person.

Illustrative scenario

A digital lender (illustrative) sees a reinstall on a new device, a request to change the registered mobile number, and a disbursal request to a new bank account, all within an hour. Instead of trusting an OTP, it asks for a live selfie. The face does not match the KYC photo, and the change is blocked pending review.

Where BeFiSc fits: IDProof gives banks, NBFCs, and fintechs step-up re-verification through face match with liveness against the customer’s KYC photo, plus name match on new mobile or bank details, triggered when your systems detect a SIM, device, or registered mobile change. IDProof does not supply SIM-swap or device-change signals; those come from your own stack or telecom partners.

Key Takeaways

• SIM swap fraud transfers control of your mobile number, and with it your SMS OTPs, to a criminal.
• Warning signs include sudden loss of network, unexpected SIM change messages, and unrecognised bank alerts.
• DoT bars SMS for 24 hours after a SIM replacement, and TRAI blocks porting for seven days after a swap.
• RBI’s authentication directions, effective 1 April 2026, require two factors with one dynamic and allow risk-based checks, with liability for losses from weak authentication.
• Institutions should treat SIM, device and mobile changes as triggers for step-up face match and liveness, not another OTP.

Frequently Asked Questions

Conclusion

SIM swap fraud works because a phone number has become a stand-in for identity. India’s telecom rules have added friction, and RBI’s 2025 directions push institutions towards risk-based authentication.

For banks and fintechs, the next step is to stop treating a fresh SIM or device as routine. Re-verifying the person, not the number, at those moments closes the gap that OTPs leave open.

Add face match and liveness step-up checks with IDProof