What Is a SIM Swap Attack and How to Protect Yourself

You wake up, pick up your phone, and there is no signal. No bars, no 4G, nothing. Your SIM has stopped working. You rush to the carrier's office, and the person at the counter tells you your number was already ported to another SIM earlier that morning. By the time you understand what happened, money is already gone from your bank account. This is a SIM swap attack, and it is one of the fastest-growing frauds in India. Here is how it works, and exactly how to make sure it never happens to you.

What a SIM swap actually is

A SIM swap happens when someone gets your mobile carrier to activate your phone number on a SIM card they control. Once that new SIM is active, your original SIM stops working. For you, the phone looks dead. For the attacker, it means every SMS OTP sent to your number now lands on their phone.

That is the whole point of the attack. Banks, UPI apps, email providers, and social media services all use SMS one-time passwords to verify identity and reset passwords. The attacker does not need to hack your phone. They just need control of your number, and every OTP-based account becomes reachable.

How attackers get your SIM swapped

Attackers rarely do this themselves at a carrier office. They use social engineering, which is a fancy term for convincing people to hand over what they should not. The common routes in India:

• Fake ID and verification. The attacker visits a carrier store with a fake ID or a stolen copy of your documents and requests a replacement SIM, claiming their "old SIM was lost".
• Insider help. Sometimes a store employee or a dealer is bribed or involved in the fraud to approve the request without proper checks.
• Phishing your details first. Before the swap, the attacker collects your name, address, date of birth, and sometimes scanned ID proofs through phishing messages, fake loan apps, or leaked database dumps. These details make the fake request look believable.
• Job and courier scams. Attackers pose as delivery agents collecting "renewed" ID proofs, or as recruiters asking for KYC documents. Your documents are then used for the swap.

What happens after the swap

The attack follows a predictable sequence, and it is fast:

1. Number goes silent. Your SIM stops working. If you notice within minutes, you can still stop everything by calling your carrier to block the number.
2. OTPs get intercepted. The attacker triggers password resets on your email, then your bank and UPI apps. Each OTP lands on their SIM, not yours.
3. Accounts get drained. With email and banking OTPs, they move money out through UPI, transfer funds between accounts, and empty whatever they can reach quickly.
4. 1.5 lakh claims are the norm. Cyber cell reports show SIM swap frauds in India typically target amounts anywhere from a few thousand rupees to several lakh, depending on what the victim holds in linked accounts.

How to protect yourself, step by step

Most SIM swap victims never thought it could happen to them. These steps close the obvious doors:

1. Put a PIN on your SIM

Both Android and iPhone let you set a SIM PIN. When the PIN is on, anyone trying to use your SIM in a new phone has to enter it first. A stolen or fraudulently issued replacement SIM cannot be activated without it. This single setting stops most swaps cold.

2. Call your carrier and ask for a SIM lock

Indian carriers (Airtel, Jio, Vi, BSNL) offer additional verification for SIM replacement. Airtel's SIM Lock, Jio's new SIM protection, and similar options require you to approve replacements from your own registered device or through customer care verification. Enable whatever your carrier offers, even if it takes a call.

3. Stop using SMS OTPs where an app works better

For your email and your most important accounts, switch to an authenticator app (Google Authenticator, or any TOTP app) or a hardware security key. App-based codes do not go through your SIM at all, so a SIM swap cannot intercept them. Banks in India still rely on SMS, but your email is the master key to everything else, and that one you can protect.

4. Keep your documents to yourself

Never send scanned copies of your Aadhaar, PAN, or ID proofs to unknown people, no matter how official the WhatsApp message looks. Before uploading KYC documents to any app, check if the app is legitimate, and never reply to "document renewal" messages from unknown numbers. Your documents are the ammunition for the fake ID request.

5. Check your number on the government's fraud database

The Department of Telecommunications runs an official portal where you can check how many SIMs are active against your name and report numbers you never took: tafcop.sancharsaathi.gov.in. If a stranger's SIM is active on your identity, that is a red flag worth resolving.

6. Act fast if your SIM goes dead

The moment you lose signal for no reason, call your carrier immediately and ask whether a replacement SIM was issued. If yes, ask them to block the new SIM and restore your number. Then change your email and bank passwords from a different device. Minutes matter here. Delaying even an hour can cost you a lot.

Is SIM swapping legal to do?

Absolutely not. It is fraud, and in India it is prosecuted under the IT Act and related provisions. If you are curious about where the law draws the line on hacking activities in general, our guide on whether ethical hacking is legal in India explains the IT Act in plain language. Unauthorized access, identity fraud, and using someone else's SIM are all offences, not gray areas.

The 60-second summary

SIM swap happens when someone takes control of your phone number through a replacement SIM. Once they have it, your OTPs and accounts are at risk. Put a PIN on your SIM, enable carrier SIM protection, switch your email to an authenticator app, never share ID documents with strangers, and the moment your SIM dies unexpectedly, act before the money moves. It is a small checklist for an attack that removes your entire digital life in one morning.

For more everyday phone risks, our guide on protecting your phone from hackers covers the full checklist, and if you are new to security basics, common cybersecurity threats is a good place to start.