SIM Swapping and Porting Fraud — How to Identify & Stay Safe

INDIA — By BharatSecure Threat Intelligence Team · Updated Sep 11, 2026

Severity: Critical | View Full Scam Details

SIM Swapping and Porting Fraud in India (2026): How Scammers Steal Your Number — and Empty Your Bank Account

Your mobile number is the master key to your digital life. In reported cases across India, alleged fraudsters are exploiting that single fact to drain UPI-linked accounts, hijack WhatsApp, and steal identities — often within hours.

What Is SIM Swapping and Porting Fraud?

SIM swapping is a form of account takeover where alleged fraudsters convince your telecom provider to transfer your mobile number to a SIM card they control. Once they hold your number, every OTP — for banking, UPI, WhatsApp, email — flows to them, not you.

India's digital payments boom makes this especially dangerous. With over 300 million active UPI users, a single hijacked number can unlock bank accounts, payment apps, and identity documents in one move. Reported losses to SIM swapping and related digital fraud exceeded ₹1,000 crore in 2022 alone, according to public reporting — and the threat has only grown since.

Authorities including the Ministry of Home Affairs, the Reserve Bank of India (RBI), and CERT-In have publicly flagged SIM swap fraud as a critical-severity threat. India's cybercrime coordination body, I4C (Indian Cyber Crime Coordination Centre), continues to receive complaints involving this method via the cybercrime.gov.in portal.

Exactly How This Scam Works — Step by Step

1. Data harvesting. Alleged scammers mine your Facebook, LinkedIn, and other public profiles for your name, employer, phone number, and personal interests. Leaked Aadhaar data from prior breaches is also reportedly used to build a convincing profile.
2. Impersonation call to your telecom. Armed with your details, the caller contacts your operator's customer care, impersonating you. They claim a lost SIM or request a network port, using your personal details to pass security questions.
3. Creating urgency. Customer support staff are reportedly manipulated through psychological pressure — callers claim an active security breach or account emergency, rushing agents into approving the swap.
4. Your SIM goes dead. Your phone loses signal. You may receive a brief notification from your operator, but it's often too late before most victims notice.
5. OTP interception begins. The alleged fraudster now receives all OTPs on your number — UPI PINs, net banking logins, WhatsApp verification codes.
6. Accounts are looted. Bank accounts linked to UPI are drained. In reported cases, victims discovered their WhatsApp had also been taken over, used to solicit money from their contacts under false pretences.

Real Warning Signs (What to Watch For)

• Your phone suddenly loses all network signal with no obvious reason
• You receive an unexpected SMS about a SIM swap or port request you didn't initiate
• Calls or messages arrive that appear to be from your telecom provider, creating urgency around your account security
• You're locked out of WhatsApp or banking apps without changing your password
• Friends report receiving suspicious money requests from your WhatsApp number
• You notice unrecognised UPI transactions or receive OTPs for transactions you didn't authorise
• Someone contacts you claiming there's a security breach on your account, asking you to "confirm" personal details

What Happens to Victims

Financially, the damage can be swift and severe. UPI transactions processed before a fraud complaint is filed are difficult to reverse — RBI guidelines require victims to report unauthorised transactions to their bank within three working days to maximise chances of recovery, but SIM swap victims often discover the fraud hours after their accounts have been emptied. Aadhaar-linked services may also be misused if the fraudster has enough personal data, compounding the identity theft beyond just the bank account.

The psychological toll is equally serious. Victims report feeling deeply violated — their most personal communications, contacts, and finances were accessible to a stranger. The process of reclaiming accounts, filing police complaints, and disputing transactions can stretch over weeks, leaving victims financially frozen and emotionally exhausted during that period.

What RBI, CERT-In, and I4C Say

CERT-In (cert-in.org.in), India's nodal cybersecurity agency, has issued repeated public advisories warning users about SIM swapping as part of broader identity theft and account takeover threats. Their guidance consistently emphasises that no legitimate telecom or bank representative will ask for your OTP, Aadhaar number, or account details over a phone call.

The RBI has directed all banks to implement additional authentication layers for high-value transactions and to alert customers of any changes to registered mobile numbers. RBI's guidelines on customer liability in unauthorised electronic transactions place the burden of making victims whole on banks — provided the fraud is reported promptly.

I4C under the Ministry of Home Affairs operates the 1930 cybercrime helpline, specifically designed for rapid response to financial fraud. Reporting quickly to 1930 can trigger a temporary freeze on fraudulent transactions before funds are fully withdrawn.

Under the Bharatiya Nyaya Sanhita (BNS) 2023 and the IT Act, SIM swap fraud can attract charges including identity theft, cheating by impersonation, and computer-related offences. Telecom operators are also subject to regulatory oversight from TRAI, which has guidelines on SIM porting procedures designed to prevent unauthorised transfers.

How to Protect Yourself

1. Set a SIM lock or alternate PIN with your telecom operator — ask your provider about additional authentication for SIM swap or port requests.
2. Limit personal data on social media — remove or restrict your phone number, date of birth, and workplace from public profiles on Facebook and LinkedIn.
3. Never share OTPs with anyone, including callers claiming to be from your bank or telecom company.
4. Enable app-based two-factor authentication (2FA) (such as an authenticator app) wherever possible, rather than relying solely on SMS OTPs.
5. Register a complaint immediately if you lose signal unexpectedly — call your telecom provider at once to check for unauthorised SIM activity.
6. Regularly audit apps linked to your mobile number — UPI apps, banking apps, WhatsApp — and review active sessions.
7. Be cautious of unsolicited calls or messages creating urgency around your telecom account or a supposed security breach.
8. Store your bank's fraud helpline number offline so you can call it even if your phone loses service.

What to Do If You've Been Targeted

Act within minutes — not hours.

1. Call 1930 (the national cybercrime helpline) immediately to report the fraud and attempt a transaction freeze.
2. Contact your bank's fraud helpline directly to block your account and flag unauthorised transactions — do this even before you restore your SIM.
3. Visit your telecom store in person with valid ID to report the unauthorised SIM swap and reclaim your number.
4. File a complaint at cybercrime.gov.in with all details: your number, the time your signal dropped, and any transactions you've identified.
5. File an FIR at your nearest police station — insist on one being registered; a complaint acknowledgement alone may not suffice for bank disputes.
6. Notify WhatsApp and other platforms about the account takeover so sessions on the hijacked device can be terminated.
7. Consult a legal professional for guidance specific to your case, including pursuing bank liability under RBI's unauthorised transaction framework.

Frequently Asked Questions

Can a scammer port my number without me knowing? Yes, in cases reported to police, alleged fraudsters have exploited gaps in customer verification at telecom call centres to initiate ports or swaps using stolen personal data. You may receive only a brief SMS notification — which can be easily missed. Monitoring your signal and checking for unexpected operator messages is your first line of defence.

Will my bank refund money lost through a SIM swap? It depends on how quickly you report. Under RBI's framework on customer liability in unauthorised electronic transactions, if the fraud occurred through no fault of your own and you report it to your bank within three working days, you may be eligible for a refund. Delays significantly reduce your chances. Consult your bank and, if needed, a legal professional for case-specific advice.

What personal information do scammers need to pull off a SIM swap? Reported cases suggest that your full name, registered mobile number, date of birth, and sometimes a partial Aadhaar number — much of which may be publicly available or obtained from data breaches — can be enough to pass basic telecom verification. This is why minimising your public digital footprint matters.

Is WhatsApp takeover always part of SIM swapping? Not always, but it is a common secondary consequence. Since WhatsApp uses SMS OTP for device verification, whoever controls your number can log into WhatsApp on a new device. In multiple reported cases, the hijacked WhatsApp account was then used to solicit money from the victim's contacts, amplifying the fraud well beyond the original bank theft.

If you received a suspicious call or message about your SIM or telecom account, scan it instantly at BharatSecure.app before taking any action. If fraud has already occurred, call 1930 right now — every minute counts.

Disclaimer: This article describes a pattern of fraud reported in public sources for public-safety awareness. It is not legal, financial, or medical advice. To request correction or removal of any content, write to hello@bharatsecure.app.