SIM Swap OTP Interception Fraud — How to Identify & Stay Safe

INDIA — By BharatSecure Threat Intelligence Team · Updated Aug 26, 2026

Severity: Critical | View Full Scam Details

SIM Swap OTP Interception Fraud in India (2024): How Scammers Are Emptying Bank Accounts Without Touching Your Phone

Your mobile number is the master key to your bank account — and in reported cases across India, fraudsters are stealing that key by swapping your SIM, intercepting your OTPs, and draining your savings before you notice your phone has gone silent.

What Is the SIM Swap OTP Interception Fraud?

SIM swap fraud is a critical-severity identity theft scheme (risk score: 10/10) in which fraudsters fraudulently obtain a duplicate SIM card registered to your mobile number, effectively hijacking your phone identity. Once they control your number, every OTP your bank or UPI app sends — goes to them, not you.

India's near-total reliance on SMS-based OTP authentication for UPI payments, net banking, and Aadhaar-linked services makes this attack unusually destructive here. CERT-In has issued advisories warning consumers about SIM swap as part of a broader pattern of telecom-impersonation fraud. The Ministry of Home Affairs has reported that cybercrime losses — including identity theft schemes of this type — exceeded ₹1,500 crore in 2022 alone.

The scam targets everyday users: anyone active on social media, online marketplaces like OLM or Facebook Marketplace, or even dating apps where personal details are shared casually.

Exactly How This Scam Works — Step by Step

1. Harvesting your data. Fraudsters scour social media, online marketplaces, and dating apps to collect your name, phone number, and partial Aadhaar details (such as the last four digits).

2. The impersonation call. You receive a call or WhatsApp message from someone claiming to be a customer service agent from your telecom provider — Airtel, Jio, Vi, or BSNL. They use official-sounding language and scripted responses to sound legitimate.

3. Creating urgency. The caller says something like: "There's been unusual activity on your account — we need to reissue your SIM for security reasons." This manufactured panic pushes you to comply quickly without questioning.

4. Extracting your details. They ask you to "verify" your Aadhaar number, account details, or to press 1 to confirm a SIM reissue request — handing them what they need.

5. Requesting the duplicate SIM. The fraudster then calls your actual telecom provider, impersonates you, claims a lost phone, and requests a duplicate SIM.

6. Your SIM goes dead. Once the duplicate SIM activates, your original SIM is immediately disconnected from the network. You may assume it's a network glitch.

7. OTP interception begins. With your number now on their SIM, they receive every OTP from your bank, UPI apps, and wallets. They initiate transfers, change passwords, and access linked accounts — including UPI-linked accounts at banks.

8. Account drained. By the time you realise your SIM is dead and not just losing signal, your account balance may already be depleted.

Real Warning Signs (What to Watch For)

• Your SIM suddenly shows "No Service" or "Emergency Calls Only" for an unexplained period
• You stop receiving calls and SMS without any apparent reason
• You receive an unexpected call or WhatsApp from someone claiming to be your telecom provider's customer care, asking to "verify" your details
• The caller creates unusual urgency — phrases like "your SIM will be blocked in 2 hours" or "unusual activity detected"
• You receive bank transaction alerts for payments you did not make
• You are asked to press 1, share an OTP, or confirm a SIM reissue over a call you did not initiate
• Someone contacts you through a dating app or marketplace and the conversation drifts toward your phone number or banking details

What Happens to Victims

Financially, the damage is swift and severe. UPI transactions are near-instant and reversals are not guaranteed — RBI guidelines place the burden of timely reporting on the customer, meaning delays of even a few hours can make recovery difficult. Victims have reported losing life savings, with fraudsters targeting accounts linked to UPI handles and internet banking simultaneously.

Beyond money, victims describe lasting emotional distress. Knowing that your Aadhaar-linked identity, your phone number, and your bank access were all compromised simultaneously creates a profound sense of violation. Restoring your SIM, filing complaints, coordinating with your bank, and monitoring for further misuse of your Aadhaar can take weeks.

What RBI, CERT-In, and I4C Say

CERT-In (cert-in.org.in) has flagged telecom-impersonation and SIM swap attacks in its advisories on social engineering fraud, urging users never to share OTPs, SIM details, or Aadhaar numbers over unsolicited calls.

RBI has repeatedly warned customers that no bank or legitimate telecom company will ever ask for your OTP, full Aadhaar number, or account credentials over a phone call. RBI's customer protection guidelines state that if an unauthorised transaction is reported within 3 working days, the liability may rest with the bank — making immediate reporting critical.

I4C (Indian Cybercrime Coordination Centre) operates the national cybercrime helpline: 1930. Complaints can also be filed at cybercrime.gov.in. Both channels are equipped to handle SIM swap and UPI fraud cases.

India's DPDP Act 2023 and IT Rules 2021 create a legal framework under which misuse of personal data — including Aadhaar and financial credentials obtained through deception — is a punishable offence under the Bharatiya Nyaya Sanhita (BNS) 2023.

How to Protect Yourself

1. Never share OTPs, Aadhaar digits, or account numbers over any call — even if the caller claims to be from your bank or telecom provider.
2. Call your telecom provider directly on their official number if you receive any "SIM reissue" or "account verification" call — do not use the number the caller gives you.
3. Set a SIM swap alert — ask your telecom provider if they offer SMS alerts when a SIM replacement is requested on your number.
4. Audit your social media profiles — remove your phone number, Aadhaar details, and banking information from public posts, marketplace listings, and dating app profiles.
5. Enable app-based authentication (like Google Authenticator or your bank's dedicated app login) wherever your bank offers it, reducing SMS-OTP dependency.
6. Monitor your phone signal — if your SIM goes dead unexpectedly, immediately call your telecom provider from another phone and ask if a SIM swap was requested.
7. Activate transaction alerts on all bank accounts so you are notified of every debit, even small ones.
8. Freeze your UPI temporarily via your banking app if you suspect your SIM has been compromised.

What to Do If You've Been Targeted

• Immediately call 1930 (India's cybercrime helpline) — available 24/7 to initiate a fraud alert and help freeze stolen funds before they are transferred further.
• File a complaint at cybercrime.gov.in — keep your complaint number safe for follow-up.
• Call your bank's 24-hour helpline and request an immediate freeze on all UPI transactions and internet banking access linked to your mobile number.
• Visit your nearest telecom store with valid ID to block the fraudulent duplicate SIM and restore your original number.
• File an FIR at your local police station — this is essential for any insurance claims or bank dispute resolutions.
• Check your Aadhaar authentication history at myaadhaar.uidai.gov.in to see if your Aadhaar was used without your knowledge.
• Consult a lawyer for case-specific legal guidance on pursuing recovery or damages.

Frequently Asked Questions

How do I know if a SIM swap has already happened to me? The clearest signal is your phone losing all network connectivity — calls, SMS, and mobile data stop working simultaneously. If this happens unexpectedly, immediately call your telecom provider from a different phone. Do not wait to see if connectivity "returns on its own."

Can fraudsters do a SIM swap without me doing anything wrong? In many reported cases, victims unknowingly provided partial information — through a social media profile, a marketplace listing, or a single phone call — that gave fraudsters enough to impersonate them with the telecom provider. Keeping your Aadhaar details, date of birth, and account numbers off public platforms significantly raises the difficulty for fraudsters.

Will my bank refund money lost in a SIM swap fraud? RBI guidelines state that if you report an unauthorised transaction within 3 working days and the breach was not due to your negligence, your liability may be limited or nil. However, outcomes vary by case. File complaints immediately with both your bank and the 1930 helpline, and consult a financial or legal advisor for guidance specific to your situation.

Is it safe to use UPI and mobile banking after a SIM swap is resolved? Once your original SIM is restored and you have changed all passwords and PINs linked to that number, it is generally safe to resume use — but change your UPI PIN, net banking password, and email password immediately. Also check whether any new payees or UPI handles were added to your accounts during the period your SIM was compromised.

Received a suspicious call claiming to be from your telecom provider? Scan the message or report the number at BharatSecure.app — and if you believe a SIM swap is in progress, call 1930 immediately.

Disclaimer: This article describes a pattern of fraud reported in public sources for public-safety awareness. It is not legal, financial, or medical advice. To request correction or removal of any content, write to hello@bharatsecure.app.