SIM Swap Fraud: How Criminals Hijack Your Phone Number

A SIM swap does not require anyone to steal your phone. It does not need a virus, a hacked app, or a cracked password. All it needs is a phone call to your carrier and a fraudster who knows enough about you to sound like you.

That is the part most people miss. The attack lives inside a process that exists for a legitimate reason, porting your number to a new SIM when you lose your phone or switch devices. Criminals have learned to abuse that process, and the results can be severe.

What Actually Happens in a SIM Swap

A SIM card is the small chip that tells a mobile network which subscriber you are. When you insert a SIM into a phone, all calls and messages meant for your number flow to that device. Swap the SIM, and the flow changes.

In a legitimate swap, you walk into a carrier store, show ID, and ask for a replacement SIM, say, because you lost your old one. The carrier deactivates the old card and activates the new one. Your number now rings on the new SIM.

In a fraudulent swap, the criminal calls customer care or visits a store and impersonates you. They provide your name, your date of birth, your address, and sometimes the last four digits of your Aadhaar or account number, details scraped from data breaches, phishing pages, or your own social media. A cooperative or deceived agent approves the request. Your SIM goes dead. Theirs comes alive with your number.

Why Your Phone Number Is Worth Stealing

Most banks, email providers, and financial apps treat your phone number as proof of identity. When you log in from a new device, or when you reset a forgotten password, the system sends a one-time password to your registered number. That OTP is the lock on almost everything.

Once a fraudster controls your number, every OTP meant for you arrives on their device. They request a password reset on your email. The OTP comes to them. They reset the password on your banking app. The OTP comes to them. Within minutes, they can move through your accounts using the same verification steps you would use yourself.

Your phone going silent, no signal, no calls, no messages, is often the first sign something is wrong. By the time you reach your carrier to report it, the window for damage is already open.

How Fraudsters Gather the Information They Need

The attack depends on reconnaissance. Carriers ask security questions before approving a SIM change, so the fraudster needs answers. They collect these from several places.

Data breaches expose names, addresses, phone numbers, and partial ID details at scale. Phishing messages, fake bank alerts, delivery notifications, KYC update requests, trick people into entering their own details on a convincing fake page. Social media fills in the gaps: a birthday post tells them your date of birth, a tagged location tells them your city, a profile photo with your ID card in frame tells them more than they should ever have.

Some attacks involve an insider at a carrier, an agent bribed or coerced into approving a fraudulent request without the usual verification. This is rarer but harder to defend against from the outside.

The Habits That Make This Attack Harder

No single habit makes a SIM swap impossible, but several raise the cost of the attack significantly.

Ask your carrier to add a SIM lock or port freeze to your account, a PIN or passphrase that must be spoken in-store or on a call before any SIM change is approved. Many carriers offer this; most customers never ask for it. This one step forces the fraudster to know something that is not in any data breach.

Move away from SMS-based OTPs wherever the service allows it. Authenticator apps, which generate codes locally on your device rather than sending them over the network, are not affected by a SIM swap because no message travels to your number. Where a bank or service insists on SMS, keep the number registered there off your public profiles.

Treat your registered mobile number as quietly as you treat your ATM PIN. It does not need to appear on business cards, social media bios, or public directories. A separate number for public use, and your registered banking number kept private, limits the surface a fraudster can research.

Watch for the silence. If your phone loses signal unexpectedly and stays that way for more than a few minutes in an area where you normally have coverage, call your carrier immediately from another phone. The earlier you report a fraudulent swap, the narrower the window stays.

What to Do If It Happens to You

Speed matters more than anything else at this point. Call your carrier's fraud line from any available phone and report that your SIM has been swapped without your authorisation. Ask them to deactivate the fraudulent SIM and restore your number to your original card or a new one issued to you in person.

While that call is in progress, or immediately after, contact your bank's 24-hour helpline and ask them to flag your account. Most banks can place a temporary hold on outgoing transactions while the situation is investigated. Change passwords on your email and financial accounts from a device that is not connected to your phone number, a laptop on a separate network is better than your phone right now.

File a complaint with your carrier in writing and keep a record of every call, every reference number, and every agent name. If money has moved, a written complaint to the carrier and a report to the cybercrime portal are both necessary for any recovery process to begin.

The attack works because it turns a safety feature, the OTP, into the vulnerability. Understanding that the phone number is not a secret the way a password is, but a public identifier that carries private privileges, is what changes how you protect it.