SIM Swap Fraud in India 2026: Warning Signs and How to Protect Yourself

SIM swap fraud in India follows a pattern that is depressingly simple. Someone collects enough of your personal details to convince a mobile operator that they are you, obtains a replacement SIM for your number, and then uses that number to intercept the one-time passwords guarding your bank, your UPI apps and your email. The victim’s first clue is usually that their phone has quietly lost signal.

The attack works because so much of Indian digital life is anchored to a mobile number. Bank alerts, UPI registration, Aadhaar-linked verification, WhatsApp, email recovery: they all trust whoever holds the SIM. At TechLein we think this is worth understanding in detail, because the defences are cheap, the warning window is short, and the difference between reacting in twenty minutes and reacting the next morning is often the whole amount in your account.

Key takeaways

• A SIM swap gives an attacker your number, and with it every SMS one-time password sent to you.
• The clearest warning sign is sudden, unexplained loss of mobile signal that a restart does not fix.
• Move important accounts off SMS codes to an authenticator app or passkeys wherever the option exists.
• If it happens, call the operator and the bank immediately and report to the cybercrime helpline the same hour.

How the attack actually works

There are two routes, and both start with reconnaissance rather than hacking.

Step one: collecting your details

The attacker needs enough about you to pass a verification conversation: full name, date of birth, address, alternate contact number, sometimes recent recharge amounts or the last few digits of a linked document. Most of this comes from leaked databases, social media, or a phishing call posing as a KYC update or a courier delivery. Running the free checks in our guide to checking whether your data leaked in a breach often shows exactly which company handed over the raw material.

Step two: getting the SIM reissued

The first route is social engineering at a customer service touchpoint. The fraudster reports the SIM as lost or damaged and requests a duplicate, answering the verification questions with the details already collected. The second, and more common in reported Indian cases, is a corrupt or careless employee at a retail point of sale who processes a SIM replacement or an eSIM conversion without proper verification, sometimes for a fee.

Step three: the interception window

Once the new SIM activates, your handset drops off the network and theirs takes over the number. Every SMS one-time password, every bank alert, every account recovery code now goes to the attacker. They typically move fast, because operators apply cooling-off restrictions after a SIM change and because a victim who notices will call in. Within that window they attempt password resets on email, then work through banking and payment apps.

Why SMS is the weak link

SMS was never designed as a security channel. It is unencrypted, it can be read from a lock screen, it can be forwarded, and, most importantly here, it is tied to a SIM rather than to you. Any process that can move the SIM can move the second factor with it. That is a structural weakness no amount of care on your part can fix.

App-based authenticator codes are generated on your device from a secret stored on that device. Swapping the SIM does not move them. Passkeys and hardware security keys are stronger still, since there is no code to intercept at all. Our two-factor authentication setup guide walks through switching each major account across, and it is the single most valuable hour you can spend against this attack.

Warning signs worth reacting to

The signal-loss symptom is easy to dismiss on a bad network day, which is exactly what fraudsters rely on. If your phone shows no service while a family member on the same operator in the same room has full bars, that is not a network problem.

Preventive steps that actually help

• Set a SIM PIN. Both Android and iOS support locking the SIM so it cannot be moved into another handset without a code. This stops physical SIM theft, though it does not by itself prevent a fraudulently reissued SIM. Set it, but do not treat it as the whole defence.
• Ask your operator what account-level protections exist. Some offer an additional verification requirement or an alert on SIM change requests. Availability varies, so ask rather than assume.
• Move your important accounts off SMS. Email first, then banking and payments, then social accounts. Where SMS cannot be removed, at least add an app-based second factor alongside it.
• Turn on every alert your bank offers, including for logins, beneficiary additions and small transactions, and make sure they go to email as well as SMS. If the SIM is gone, email alerts are what still reach you.
• Do not over-share personal detail. Date of birth, address and alternate numbers posted publicly are exactly the verification answers a fraudster needs.
• Use unique passwords everywhere, so that intercepting one code does not unlock a chain of accounts. A password manager makes this practical.
• Audit which numbers are registered against your identity periodically, since a connection you never took is a warning in itself.

What to do in the first hour

Speed matters more than completeness here. Work in this order, using a friend’s or family member’s phone if yours is dead.

1. Call your mobile operator and tell them you suspect a fraudulent SIM swap. Ask them to block the newly activated SIM and restore service to yours. Note the complaint or docket number.
2. Call your bank’s fraud line next and ask them to freeze the account or at least block digital channels. Do this even if you have not yet seen an unauthorised transaction.
3. Block your UPI apps and cards through the bank or the app if you can still reach them. Guidance on containing payment fraud specifically is in our piece on UPI payment fraud protection.
4. Report to the national cybercrime helpline on 1930 and file a complaint on the National Cyber Crime Reporting Portal. Prompt reporting matters: the Reserve Bank’s limited liability framework for unauthorised electronic transactions is built around how quickly you inform the bank, so confirm the exact terms with your bank and do not delay.
5. Secure your email from another device. Change the password, sign out all sessions, and check for forwarding rules and filters the attacker may have added. If you have already lost access, follow our guide to recovering a hacked Google account.
6. Reclaim messaging accounts. Re-register WhatsApp once your SIM is restored and turn on its PIN protection; see how to secure your WhatsApp account so the number alone is not enough next time.
7. File a written complaint with the operator and keep copies of everything. You may also report the incident through the Sanchar Saathi portal, which handles telecom fraud reporting.
8. Follow up in writing with the bank within their stated window, listing every disputed transaction with dates and amounts.

What happens afterwards

Operators generally investigate how the duplicate SIM was issued and which outlet processed it. Banks run their own dispute process on the transactions. Both are slow, and both are far more responsive when you have complaint numbers, timestamps and a police or portal acknowledgement. Keep a single file with the docket numbers, the times you called, and screenshots of every alert.

Be cautious about a second wave. Victims of fraud are frequently targeted again by callers claiming to be recovery agents, cyber cell officers or bank investigators who can retrieve the money for a fee. That is a separate scam and it works on people who are already distressed. The mechanics are close to the pattern described in our explainer on the digital arrest scam. No genuine authority asks for a fee, a code, or remote access to your phone.

Frequently asked questions

Can a SIM swap happen without any action from me?

Yes. The fraudulent request is made to the operator, not to you. Your only involvement is that your personal details were used to pass verification, and those often come from leaks rather than anything you did.

Does a SIM PIN stop SIM swap fraud?

Not entirely. A SIM PIN stops someone using your physical SIM in another handset. It does not stop an operator from issuing a fresh SIM to an impostor. It is still worth setting.

Is eSIM safer than a physical SIM?

An eSIM cannot be physically stolen, which removes one attack path. The reissue process is still the weak point, so the same verification risks apply. Treat the security question as being about the operator’s process, not the format.

How do I know if my number was ported without permission?

Unauthorised porting also causes loss of service, and operators normally send confirmation messages before a port completes. Any port or SIM-change message you did not initiate should be challenged the same day.

Should I stop using SMS one-time passwords entirely?

Where you have the choice, yes, prefer an authenticator app or a passkey. Many Indian banks still mandate SMS, so the realistic goal is reducing how many accounts depend on it and adding a stronger factor where you can.

The bottom line

SIM swap fraud is not a technically sophisticated attack. It is an identity verification failure at a telecom counter combined with the fact that Indian banking leans heavily on SMS codes. You cannot fix the counter, but you can reduce how much your number is worth to a fraudster by moving your critical accounts to app-based authentication and keeping email alerts switched on as an independent channel.

If it does happen, treat the loss of signal as the alarm it is. Call the operator, call the bank, report to the cybercrime helpline, and secure your email, in that order and within the hour. Almost every case that ends well ends well because the victim moved fast.