The attack usually announces itself as an inconvenience: your phone loses signal in a place where it always worked. Most people restart the handset, shrug, and wait. Meanwhile, across town, a criminal is holding a SIM card that now carries your number — and every one-time password your bank, email provider and social accounts send to it. SIM swap fraud is one of the most effective account-takeover techniques in use because it does not attack technology at all. It attacks the process for replacing a lost SIM, using stolen or leaked personal details to convince a store or call centre that the criminal is you. Our fraud-prevention guides treat it as a must-know risk for every mobile user.
The groundwork is data: names, addresses, dates of birth and ID numbers scraped from breaches, phishing forms and social media. With enough of it, the fraudster requests a replacement SIM, ports your number, and then moves methodically — password resets on email first, because email unlocks everything else, then banking and payment apps. The whole sequence can finish in under an hour, often at night or on weekends when victims notice slowly and bank support lines are thin.
The Warning Signs to Act On Immediately
Sudden, persistent loss of network signal on a phone that worked minutes earlier is the cardinal sign, especially combined with unexpected password-reset emails or messages you did not request. Treat unexplained signal loss as an emergency until proven innocent: call your bank from another phone, freeze what can be frozen, and contact your operator to ask whether a SIM change was made on your account. Speed is everything, because the fraud depends on the gap between the swap and your response. Consumer guidance from the Reserve Bank of India repeatedly stresses that banks will never ask for OTPs or PINs — a caller who does is part of the attack.
Defences That Actually Reduce the Risk
Ask your operator what extra verification it can place on your account for SIM replacement, and use any available PIN or in-person-only flag. Move important accounts away from SMS codes wherever an authenticator app or hardware key is offered; an app on your physical phone is useless to someone who has only stolen your number. Keep ID documents off social media and out of unsecured chats, since the attack is built from personal data. Finally, check the connections registered in your name on the TAFCOP portal, so a stranger’s SIM cannot quietly share your identity. No defence makes the risk zero, but each layer steals time from the attacker — and time, in this fraud, is the whole game.
Employers should note their own exposure: a swapped executive number can unlock corporate accounts, which is why security teams increasingly require hardware keys for administrators and treat phone numbers as identifiers, never as proof. For individuals the same principle applies at household scale. The number that receives your life should be the hardest one in it to steal — and after reading this far, you know the handful of settings and phone calls that make it so.