SIM swap fraud: how to spot, stop and recover

What a typical SIM swap fraud message looks like

"Your SIM will be deactivated in 24 hrs and your bank account may be blocked. Text 12345 to 121 to continue receiving OTPs." The message uses urgency and fear to make you act before you check whether it is real.

Some versions come as a call from someone claiming to be from your telecom operator, or include a fake KYC link such as simcard-kyc-update[.]top. Texting the code they give you can help them move your number to their SIM.

How the fraud works and what attackers gain

Fraudsters first gather personal data – Aadhaar, PAN, bank details – through phishing or data leaks. They then pose as a telecom-operator staff member or use forged documents to request a duplicate SIM for your number. Once the new SIM is issued, the original SIM is deactivated and all OTPs, banking alerts and account recovery codes are sent to the attacker’s device.

With control of the mobile number they can reset passwords, log into UPI, Paytm or other payment apps, and transfer money within minutes. The victim often notices the problem only after the attacker has already moved funds.

Warning signs of a SIM swap attempt

Sudden loss of network signal, missed calls or texts without a clear reason.

An SMS or voice call that claims a "SIM swap" or "number switch" and gives a short deadline (often 24 hrs).

Someone asks you to send an SMS with a code to a short number such as 121, especially when the message mentions bank account blockage or OTP issues. Calling your operator yourself on its official customer-care number is safe; sending codes on a stranger's instructions is not.

Links that ask for a "KYC update" or to "download a new banking app". RBI and banks warn that an unsolicited KYC or OTP link is a red flag.

What to do immediately if you receive such a message

Do not call the number in the message, reply with any code, or click any link. Contact your telecom provider using the official customer-care number on your bill or in the provider’s app and ask them to block any new SIM request.

Call your bank using the number printed on your debit/credit card or the official banking app. Request a temporary freeze on all transactions and ask them to verify your registered mobile number.

Report the incident to the National Cyber Crime Reporting Portal (cybercrime.gov.in) and call the national cyber fraud helpline 1930 if you lost money. Also report the fraud call and SMS on the Chakshu service at sancharsaathi.gov.in, and use the Sanchar Saathi portal/app to verify your SIM and file a complaint.

If you have already clicked, paid or shared details

Immediately block the new SIM with your telecom operator and ask them to restore service on your original number.

Change your net-banking and email passwords and your UPI PIN, and ask your bank to confirm that only your own mobile number is registered for OTPs. Switch to app-based OTPs or biometric log-ins where your bank offers them.

File a complaint with the cyber-crime portal and keep a copy of all messages, call logs and transaction records. Under the Telecommunications Act, 2023, obtaining a SIM by fraud can lead to up to three years in prison, a fine of up to ₹50 lakh, or both.