SIM Swap Fraud: What to Do When Your SIM Stops Working

"My phone suddenly showed 'no service', and an hour later I saw net banking alerts on email for transfers I never made." This is the classic pattern of a SIM swap: a fraudster gets a duplicate SIM for your number to receive your OTPs. Call your mobile operator from another phone to block the SIM, call your bank's 24x7 fraud line to freeze digital banking, and report on 1930 or cybercrime.gov.in. Fast reporting usually means you bear zero loss under RBI rules.

How SIM swap fraud works

1. Fraudsters collect your details: name, number, date of birth, sometimes an Aadhaar copy or bank login, through phishing, data leaks or a "KYC update" call.
2. They request a replacement SIM by posing as you at a retailer, with forged documents or an insider's help, often claiming the phone was lost.
3. Your SIM goes dead as the new SIM activates.
4. They use OTPs sent to your number to log in to net banking, reset UPI PINs, add payees or approve card payments.

They usually strike late in the evening or on a holiday, when you are slower to notice.

Safeguards that exist (as of October 2026)

These safeguards slow fraudsters down, but they do not replace your own speed. If money has already gone, the clock for RBI's liability rules is running.

Step-by-step: what to do

In the first hour

1. Call your mobile operator from another phone. Ask: "Has a SIM replacement been done on my number?" If yes and you did not ask for it, have the new SIM blocked and the request flagged as fraud. Note the complaint number.
2. Call your bank's 24x7 fraud number (from its official website or the back of your card). Ask the bank to block net banking, UPI and cards, and to stop any pending transfers. Ask for a complaint number and the time it was logged.
3. Report on 1930 or cybercrime.gov.in. Give the transaction details and keep the acknowledgement number. This alerts the banks where the money went so they can try to hold it.
4. Check your email. Fraudsters often change the registered email or password. Change your email password from a safe device.

On the first day

5. Get your own SIM reissued at the operator's own store with your original ID. You will face the same 24-hour SMS bar on your new SIM; plan for that.
6. Check every account linked to the number: other banks, wallets, demat, mutual fund platforms, credit cards and UPI apps. Ask each to freeze changes until your number is back.
7. Check Sanchar Saathi for other connections in your name and report any you do not recognise.
8. File a written complaint with the bank with transaction details and your operator's complaint number as proof of the swap.
9. File an FIR if asked; for larger losses, the bank and the courts will usually need it.

If unresolved

10. Follow up for the shadow reversal. Under the current framework, the bank should credit an eligible amount within 10 working days of your report.
11. Escalate to the bank's grievance or nodal officer.
12. File with the RBI Ombudsman at cms.rbi.org.in if there is no reply within 30 days or you are not satisfied. Under the Reserve Bank – Integrated Ombudsman Scheme, 2026, file within 90 days of the end of that 30-day period or the bank's last reply, whichever is later.
13. Complain to the operator's appellate authority about the wrongful SIM issue. Telecom complaints go to the operator's complaint centre first, then its appellate authority.

What you are owed

If you did not share your OTP, PIN or password, and the fraud happened because someone obtained a SIM in your name, this is generally a third-party breach.

If you shared an OTP with the caller who set up the swap, it may be treated as your negligence. From 1 January 2027, commercial banks offer a once-in-a-lifetime compensation for such cases: for a gross loss up to ₹50,000, the lesser of 85% of the net loss or ₹25,000, if you report to both 1930/NCRP and the bank within 5 calendar days. Under both frameworks, the bank must prove customer negligence.

Worked example

On the night of 14 November 2026, Kavita's SIM went dead at 9 pm. She assumed it was a network fault. The next night, once the 24-hour SMS bar had lapsed, fraudsters used OTPs on the new SIM to add a payee through net banking and transfer ₹45,000 and ₹30,000 from her savings account, a total of ₹75,000. Kavita did not share any code; the swap was done using a forged ID.

• She reports the morning after the transfers: third-party breach within 3 working days, liability ₹0, refund ₹75,000.
• She notices only after a week, on the 6th working day: liability is the lower of ₹75,000 and ₹10,000 (savings account), so ₹10,000. Refund ₹65,000.

The ₹10,000 difference comes down to how quickly she connected "no network" with "possible fraud". Had she called her operator on the first night, the fraudulent SIM could have been blocked before the SMS bar lifted, and nothing would have been lost.

Ready-to-copy complaint messages

To your bank:

Subject: Unauthorised transactions after SIM swap fraud – account [number]

Dear Sir/Madam,

On [date], my mobile number [number] registered with your bank stopped working at about [time]. My operator has confirmed that a replacement SIM was issued without my consent (operator complaint number [number]). Unauthorised transactions followed:

• [Date, time, amount, beneficiary / UTR]

I did not share any OTP, PIN or password. I reported this to you on [date and time], reference [number], and to 1930 / cybercrime.gov.in, acknowledgement [number].

As this is a third-party breach reported within RBI's time limit, please credit the amount as a shadow reversal, confirm zero liability and block further digital access until my number is restored.

Regards, [Name]

To your operator:

I did not request a SIM replacement for [number], issued on [date] at [store, if known]. Please block that SIM, share the details of the request and documents used, and reissue my SIM after verifying my original ID.

What not to do

• Do not wait for the network to "come back". A long, unexplained loss of signal is a warning sign; call your operator within minutes.
• Do not share OTPs with anyone calling about a "SIM upgrade to 5G", "KYC expiry" or "eSIM activation".
• Do not post your number, date of birth and ID images online. These are the raw material for a swap.
• Do not use the same password for email and net banking. Fraudsters change your email first.
• Do not report only to the operator. The bank and 1930 must be told separately and fast.

Lower your exposure

• Ask your bank to set a low daily net banking and UPI transfer limit, and raise it only when needed.
• Turn on email alerts as well as SMS, so you still get alerts if the SIM goes dead.
• Keep the bulk of your savings in a separate account or fixed deposit that is not set up for online transfers; our FD calculator shows what that money earns.
• If you are changing your number, update it with the bank yourself through official channels; see our guide on changing your mobile number in a bank account.

For the full liability rules across UPI, cards and net banking, see our guide on unauthorised transactions and zero liability.

Key takeaways

• A sudden, long "no service" with alerts you did not trigger is a SIM swap warning; call your operator and bank from another phone at once.
• DoT rules bar SMS for 24 hours on a new SIM after a swap, and TRAI blocks porting for 7 days after a swap; these slow fraudsters but do not stop them.
• Until 31 December 2026, a third-party breach reported within 3 working days carries zero liability; from 1 January 2027, commercial banks allow 5 calendar days.
• Report to the bank, 1930 and the operator separately, and keep every reference number.
• Escalate unresolved bank complaints to cms.rbi.org.in after 30 days.