SIM Swap Scam in India 2026: How to Spot and Stop It

A SIM swap scam is when a fraudster gets your phone number activated on their SIM card. Your phone goes dead. Every OTP, every call, every SMS your bank sends now goes to them. Within an hour they can reset your net banking password, drain your UPI, log into your email, and lock you out of your own life. The two routes in India are fake porting requests across telcos (MNP fraud) and duplicate SIM issuance from a telecom retail outlet, often with insider help. TRAI’s July 2024 rule added a 7-day cooling period on port-out after a SIM swap, which closed the easiest version of the attack, but the threat is still live. If your phone suddenly loses signal and stays dead in a place you usually have coverage, treat it as an attack until proven otherwise. Call your telco from a different phone, freeze your bank accounts, and call 1930.

Key findings

• Two attack routes in India: MNP port-out fraud (fake porting request across telcos) and same-telco duplicate-SIM fraud (issuance from a retail outlet, often with insider help). Same-telco is now the dominant variant per arrests in Mumbai, Hyderabad, Bengaluru, and Delhi through 2024 and 2025.
• TRAI July 2024 rule added a 7-day waiting period after any SIM swap before port-out, which closed the easiest variant. Did not close duplicate-SIM fraud or patient-attacker variants.
• The single biggest red flag: sudden total loss of signal in a place you usually have full coverage, lasting more than 30 minutes, while other phones in the same room work fine. Window between swap going live and money moving is often under 60 minutes.
• Three telco-side controls remove most of the risk: account PIN required for any change, port-out lock (in-person to lift), and registered alternate contact for swap notifications. Set all three in 30 minutes at a service center.
• Single highest-impact preventive measure: switch from SMS OTP to app-based 2FA (Google Authenticator, Microsoft Authenticator, Authy) wherever your bank, broker, email, and work accounts support it. This makes the SMS OTP useless to a SIM swap attacker.
• RBI’s 2017 customer liability rule rewards fast reporting: zero liability if third-party fraud is reported within 3 working days, capped liability between 4 to 7 days, full loss beyond 7 days. Speed of the 1930 call plus cybercrime.gov.in complaint plus written bank complaint is the single largest factor in fund recovery.

ScamNextStep is a Bengaluru-based cybersecurity firm. We verify suspicious telco upgrade calls, MNP messages, and unexplained signal loss for individuals and small businesses, free.

Who this is for

Anyone in India whose phone number is linked to a bank account, UPI app, email login, or social media account. That is basically every adult in the country. The most targeted profiles in 2026: high-net-worth individuals with public LinkedIn profiles, founders and senior executives whose bank account size is inferable from public funding announcements, business owners whose number is publicly displayed for customer contact, NRIs maintaining Indian bank accounts, and senior citizens whose family details and address are findable on social media. This guide is also for parents, partners, and siblings who manage finances for elderly family members.

What a SIM swap actually does

Your phone number is the master key to almost everything financial in India. Bank login OTPs, UPI registration, net banking 2FA, email password reset, GPay, PhonePe, Paytm, social media recovery, even your Aadhaar-linked services. If a scammer controls your number, they control the OTP, and the OTP unlocks almost everything else.

When a SIM swap goes through, your original SIM stops working within minutes. The phone shows ‘no service’ or ‘SIM not provisioned’ or ‘emergency calls only’. The new SIM in the attacker’s phone immediately picks up your number. Every SMS, call, and OTP routes to them. They then run a fast sequence:

1. Reset net banking password using the SMS OTP they now receive
2. Add new beneficiaries to your bank account (some banks impose a cooling period here; not all do)
3. Initiate transfers via NEFT, RTGS, IMPS, or UPI
4. Reset email passwords to take over your Google or Apple account
5. Lock you out by changing 2FA settings everywhere they can

In the most aggressive cases the entire chain runs in 30 to 60 minutes. By the time you walk to a telco store, the money has already moved and layered through mule accounts.

The Reserve Bank of India has flagged SIM swap as one of the dominant account takeover vectors in its annual cyber fraud reporting. CERT-In has issued advisories on SIM swap protection. TRAI has updated mobile number portability rules (TRAI MNP amendment 2024) specifically to slow down the attack. Industry awareness has improved. The attack itself has not gone away.

The two routes scammers use

Route 1: MNP port-out fraud

Mobile Number Portability lets you move your number from one telco to another while keeping the same number. It is a real, useful consumer right. It is also a known attack vector.

The fraud version: the scammer files a porting request to move your number from Airtel to Jio (or any other telco combination) using a forged ID, a UPC (unique porting code) they have somehow obtained, and your basic details. If approved, your number leaves your current SIM and lands on a SIM the scammer holds. TRAI’s July 2024 amendment introduced a 7-day waiting period after any SIM swap before port-out can be processed, which has reduced this attack. It still works on patient attackers.

Route 2: Duplicate SIM fraud within the same telco

The more common path now. The scammer walks into a telecom retail outlet, sometimes with insider collusion, sometimes by social engineering the agent with your stolen ID copy and address proof. They request a duplicate SIM for your existing number, citing ‘lost phone’ or ‘damaged SIM’. The agent issues a new SIM on your number. Your original SIM is deactivated. The new one is active in the scammer’s phone.

This route is harder for TRAI’s port-out rule to address, because the swap stays within the same telco. The defence here is telco-side identity verification rigour and your own monitoring. Several arrests in 2024 and 2025 in Mumbai, Hyderabad, Bengaluru, and Delhi have involved telecom retail operators or distributors selling duplicate SIMs to fraud rings.

The simpler social engineering variant: scammer calls you claiming to be an Airtel or Jio or Vi representative, says your SIM needs an upgrade to 5G or a KYC re-verification, and walks you through a sequence that ends with your existing SIM going offline. Either you handed over a UPC in the call, or you accepted a SIM swap, or you visited a retail outlet under their direction. Same end state.

Publicly reported Indian SIM swap cases

Carrying real cases from mainstream press to underline that this is not an abstract risk and that the loss numbers are significant.

Delhi, 2020 onwards (sustained pattern). Delhi Police’s cyber cell flagged a sharp rise in SIM swap complaints with average losses per victim in the lakhs of rupees, traced to a mix of MNP fraud and duplicate SIM issuance. The Special Cell arrested multiple suspects across 2024 (Indian Express coverage of Delhi cyber arrests).

Mumbai, 2024. Maharashtra cyber department reported a businessman lost more than INR 1 crore after his number was swapped overnight. The fraud was detected only when he tried to use his phone the next morning (Hindustan Times Mumbai cyber reporting).

Hyderabad, 2024 to 2025. Telangana cyber crime wing arrested a ring that included a telecom retail employee accused of issuing duplicate SIMs in exchange for a fee per swap (Telangana Today coverage of cyber arrests).

Bengaluru, 2025. A startup founder reported a six-figure UPI fraud after losing signal on the office floor for 45 minutes and finding the SIM had been ported. The bank had no immediate reversal mechanism by the time the founder reached the branch (Deccan Herald coverage of Bengaluru cyber cases).

National pattern, 2024 to 2025. I4C briefings and Parliamentary responses noted that SIM-swap-linked bank fraud forms a measurable share of UPI and net banking fraud complaints filed at cybercrime.gov.in, with average individual losses higher than most other categories because the attacker has direct OTP access (Business Today coverage of NCRP data).

What these cases share: the victim noticed the signal loss but did not initially treat it as an attack, the bank account was drained within an hour of the swap, the recovery odds depended entirely on how fast the victim reported, and several cases involved insider collusion at the telco retail layer that the victim had no way to prevent.

Red flags that say a SIM swap is in progress

Any one of these is enough to act on. Do not wait for confirmation.

1. Sudden total loss of signal in a place you usually have full coverage

If your phone shows ‘no service’ or ‘SIM not provisioned’ or ‘emergency calls only’ for more than 30 minutes in a location where other phones (yours and others) usually work fine, treat it as a swap until proven otherwise. Restart the phone once. If signal does not come back, escalate.

2. SMS or email alert about a SIM swap or porting request you did not initiate

TRAI rules require telcos to send a confirmation SMS before any port-out goes through, and most telcos send a notification before a duplicate SIM is issued. If you receive such a message and did not request it, call your telco immediately on a different phone and refuse the request. The window to cancel is short.

3. Calls or messages about unusual bank transactions when you cannot get a signal

If your spouse, family member, or office colleague mentions that your bank has called them or that they received a bank alert from your account while you cannot use your phone, that is the swap-in-progress signature.

4. An unsolicited call from a ‘telco representative’ offering a SIM upgrade, 5G upgrade, or KYC re-verification

Real telcos do not cold-call subscribers asking for UPC codes, KYC re-verification over the phone, or SIM swap consent over a call. Any such call is the scam.

5. A message saying your number is being deactivated unless you respond immediately

Real telco disconnections do not happen via WhatsApp message or SMS demanding immediate action. The threat is engineered to make you call a number controlled by the scammer or visit a fake URL.

Prevention: what to lock down today

These are habits and settings to put in place now, before anything happens. They take 30 minutes total across all your accounts.

Telco-side controls

• Set a telco account PIN or password with your operator. Most telcos let you set a PIN required for any account-level change including SIM swap or port-out. Set this in person at a service centre and write down nothing where it can be photographed.
• Enable port-out lock or SIM swap lock where your telco offers it. Some telcos in India now let you mark your number as ‘do not port’ which requires an in-person, ID-verified visit to lift.
• Register an alternate contact and email with your telco so that any SIM change attempt notifies a second channel you control.
• Know your telco’s 24x7 customer service number and save it as a contact in another family member’s phone too.

Bank-side controls

• Enable transaction alerts via email in addition to SMS. If the SIM is swapped, SMS alerts go to the attacker but email alerts still reach you.
• Set transaction limits. Lower the per-day and per-transaction limit on UPI, net banking, and mobile banking to amounts you actually transact at. You can raise temporarily when needed.
• Register at least two beneficiary cooling-off bank accounts with shorter activation windows.
• Save bank fraud reporting numbers in your phone now. Every major bank in India has a 24x7 fraud hotline.

Identity hygiene

• Remove your full date of birth, home address, and full phone number from public LinkedIn, Facebook, and Instagram profiles. These are the inputs scammers use to social engineer your telco.
• Do not share photos of your Aadhaar, PAN, or driving licence on WhatsApp, even with vendors. Use masked Aadhaar (VID) where possible.
• Use email-based or app-based two factor authentication (Google Authenticator, Microsoft Authenticator, Authy) instead of SMS OTP wherever the service supports it. Bank, broker, email, and work accounts especially. This is the single highest-impact preventive measure because it makes the SMS OTP useless to a SIM swap attacker.

What to do the moment you suspect a swap

If your phone has gone silent and your gut says something is wrong, act in this order. Do not wait to be sure.

1. Borrow a phone immediately. A family member’s, a colleague’s, a stranger’s. Call your telco customer service number and confirm SIM status. Ask them to freeze the SIM, block port-out, and flag the account.
2. Call every bank where you hold an account. Request immediate freeze on UPI, debit and credit cards, mobile banking, and net banking. Most banks have a 24x7 fraud number on the back of every card. If you cannot reach, send an email to the bank’s fraud reporting address from a separate device.
3. Change your email password from a clean device (laptop or another phone). Email is often the recovery channel for bank and UPI accounts.
4. Call 1930. This is the national cyber crime helpline operated 24x7 by I4C under MHA (I4C). They will start a complaint and coordinate with banks for mule account freeze.
5. File a formal complaint at cybercrime.gov.in within 24 hours. Provide telco SIM status confirmation, bank statements, recipient account details, timestamps, and any SMS or email notifications you received about the swap.
6. Visit your telco retail store in person with ID to request a new SIM issued to you. Bring photo ID and any proof of original number ownership. Do not let the operator delay this; cite the active fraud.
7. Notify your workplace IT or security team if your work email or VPN is linked to that number.
8. Check email for password reset notifications you did not initiate, on every account: Google, Apple, Microsoft, banking, broker, exchange, social media. Reset every one of them from a clean device.
9. File a written complaint with your bank in addition to the phone call, to trigger RBI’s customer liability framework. Time-stamped written reporting is what protects your eligibility for compensation if the matter qualifies.

What RBI’s limited customer liability rule says

RBI’s 2017 circular on customer protection in unauthorised electronic banking transactions sets out three scenarios.

• If the fraud is due to the bank’s negligence, customer liability is zero regardless of when reported.
• If the fraud is due to third party breach (which most SIM swap fraud falls under) and reported within 3 working days, customer liability is zero. Reported within 4 to 7 working days, capped liability applies depending on account type. Beyond 7 working days, the customer may bear full loss.
• If the fraud is due to customer negligence (sharing OTP, PIN, password willingly), customer bears the loss until reported.

The framework rewards fast reporting heavily. The 1930 call, the cybercrime.gov.in complaint, and the written bank complaint together create the timestamped paper trail that supports your eligibility. (RBI customer protection circular 2017).

Got a suspected SIM swap or a telco upgrade call? Send it to us, we verify free

If you received a suspicious call claiming to be from your telco, an SMS about a port-out you did not request, or you have noticed unexplained signal loss and want a sanity check, send it to us privately.

WhatsApp / Call: +91 99644 43350

Send the message screenshot, the sender number, your telco name, and what you noticed. We tell you whether the pattern matches a known SIM swap script and what to do next, free.

What we do:

• Cross-check the calling number against known telco-impersonation patterns
• Walk you through the urgent action sequence in plain language
• Help you confirm SIM status with your telco
• Help you draft the cyber crime complaint

What we do not do:

• Charge you for the verification
• Ask for your bank details, OTPs, UPI PIN, or telco PIN
• Pretend to be a telco or a bank

Verification is free. We also publish related guides on the malicious WhatsApp APK scam, WhatsApp GhostPairing, and SMS scam clusters.

Report it, and how to check something first

Report to the official channels first. They are the only ones who can freeze an account or open an investigation:

• 1930: the National Cyber Crime Helpline, 24/7. Reporting speed is the single biggest factor in getting money back, because banks can sometimes freeze a mule account within hours.
• cybercrime.gov.in: file the formal complaint.
• sancharsaathi.gov.in: report the number or sender (Chakshu).
• 112: police emergency.

Not sure yet whether it is a scam? Send it to ScamNextStep and we will tell you what it is, free:

• WhatsApp: +91 99644 43350
• Email: scamnextstep@gmail.com

What we do is check the open record and tell you what it shows: when a domain was registered, who really publishes an app, whether a company exists, where a photo came from. We are not police: we cannot compel anyone, freeze an account, or recover money that has already gone. We will never ask you for money, OTPs, documents or remote access. If money has already moved, call 1930 first, a bank freeze is faster than we are.

Corrections

• 2026-08-09: Removed the “cut the risk by 80 percent” efficacy figure for the three telco-side controls. No source supported it. The three controls, and the recommendation to enable all of them, are unchanged.