Your SIM card could drain your money: A look at scams targeting phone numbers

Three days later, there was no SIM card. Panicked, she called her mobile provider, only to be advised to visit the nearest service centre for a duplicate SIM card. When she finally reactivated her number, she was hit with a shocking reality—messages from her bank revealed she had been scammed––her fixed deposit was gone, two of her bank accounts had been emptied, a car loan worth Rs 7.40 lakh had been taken in her name. She rushed to file a police complaint, but it was too late—her money had vanished along with the cybercriminals.

In another incident, a Monday morning turned into a nightmare for a Mumbai businessman––Rs 7.5 crore vanished from his company’s bank account and this was a SIM swap scam. Cybercriminals managed to convince his telecom provider to link his phone number to a SIM card they controlled. This gave them access to every one-time password (OTP) his bank sent, allowing them to drain his account.

However, in this case, there was a small win. The businessman immediately called 1930—the cybercrime helpline—and reported the fraud. Cybercrime officials acted swiftly, managing to freeze Rs 4.65 crore before it was transferred out of reach.

A Subscriber Identity Module (SIM) card is a tiny chip inside your phone that connects you to your mobile network. It stores your unique ID, allowing you to make calls, send texts, and use mobile data. The SIM also encrypts information, keeping your phone secure. Some newer phones use an eSIM, a digital version built right into the phone, so you don’t need a physical card. Essentially, the SIM card keeps you connected to the world, no matter where you go.

“Cybercriminals are constantly finding new ways to trick people. Awareness and caution are the best defence against SIM card scams and other frauds. By staying informed and taking proactive steps, individuals can protect their digital identity, finances, and personal information from falling into the wrong hands,” said Tushar Sharma, cyber expert and co-founder of TOFEE (The Organization For Enlightenment and Education), who helped indianexpress.com put together a guide on spotting SIM card scams and protect yourself from it.

Types of SIM card scams:

According to Sharma, the following are the different types of SIM card scams:

🎯SIM block scam: Victims receive a message claiming that their SIM will be blocked unless they verify their details or pay a fee. The message often includes a malicious link designed to steal personal information. Fraudsters use scare tactics to create panic, forcing individuals to act quickly without verifying the authenticity of the request.

🎯SIM swap fraud: Cybercriminals collect personal details through phishing, social engineering, or data breaches. Using this information, they impersonate the victim and contact their mobile service provider, requesting a SIM card replacement. Once the new SIM is activated, scammers gain access to calls, messages, and crucial OTPs for banking transactions. By the time victims realise their SIM has been deactivated, their bank accounts may have already been drained.

🎯SIM Cloning: Using advanced tools, fraudsters copy data from a victim’s SIM card to create a duplicate SIM. This allows them to make calls, send messages and intercept OTPs. A cloned SIM can also be used for illegal activities, potentially making the victim a suspect in cybercrimes they did not commit.

🎯Fake KYC verification scam: Scammers pose as representatives from telecom companies, claiming that a victim’s Aadhaar, PAN, or KYC details need updating to prevent their SIM from being blocked. If victims share this information or click on harmful links, cybercriminals can gain access to their personal and financial data, putting their digital identity and finances at risk.

How to spot SIM card scams

🎯Sudden SIM deactivation: If a phone suddenly loses network service without warning, scammers may have taken control of the number.

🎯Unexpected bank alerts: Receiving OTPs or transaction notifications for services that were never requested can indicate fraudulent activity.

🎯Suspicious calls or messages: Requests for KYC updates, Aadhaar, PAN, or OTPs from unknown numbers should be treated with caution.

🎯Duplicate social media accounts: If someone gains access to a phone number, they may attempt to log into social media accounts linked to it.

🎯Strange emails or posts: A hijacked SIM may result in unusual emails, messages, or activity on social media accounts.

How to protect yourself?

Sharma listed ways to protect yourself from SIM card scams:

🎯Enable Two-Factor Authentication (2FA): Using app-based authenticators such as Google Authenticator or Authy instead of SMS-based OTPs can enhance security for banking and emails.

🎯Avoid sharing personal information: Aadhaar, PAN, OTPs, or banking details should never be shared over calls, messages, or emails, as legitimate companies do not request them.

🎯Set a strong SIM lock code: Many telecom providers allow users to set a PIN or password for SIM swaps—activating this feature adds an extra layer of security.

🎯Verify with the telecom provider: If a SIM swap request notification is received, contacting the mobile provider immediately can help block unauthorised changes.

🎯Check mobile network regularly: If a SIM suddenly stops working, the telecom provider should be contacted immediately from another number.

🎯Use a secondary contact number: Having a backup number or email for recovery can be useful for securing important accounts such as banking and email.

🎯Report suspicious activity immediately: Call the Cyber Crime Helpline (1930) or report online at http://www.cybercrime.gov.in. Also, inform your bank’s fraud department without delay.

The Safe Side: As the world evolves, the digital landscape does too, bringing new opportunities—and new risks. Scammers are becoming more sophisticated, exploiting vulnerabilities to their advantage. In our special feature series, we delve into the latest cybercrime trends and provide practical tips to help you stay informed, secure, and vigilant online.