SIM-swap and OTP theft: how scammers steal your number, then your money

Why your number is the target

"Forgot password" flows, UPI registrations, and bank alerts all trust one thing: the phone number. Control the number and you control the resets. That is what SIM-swap attacks steal — not your phone, your number, moved to the attacker's SIM.

How it works

1. Harvest: your number, DOB, and ID details from breaches, social media, or a phishing call ("KYC verification"). Check your exposure with our breach self-check.
2. Impersonate: the scammer convinces your carrier's support (or a retail outlet) they are you — fake ID, sob story, insider help — and gets a replacement SIM or eSIM issued.
3. Drain: with OTPs now arriving on their SIM, they reset your email, then banking and UPI PINs, typically at night. By morning the accounts are emptied and the email recovery changed.

Warning signs

• Sudden loss of signal / "No Service" while dues are paid — your number may have moved.
• SMS about a SIM change, eSIM activation, or port-out request you never made.
• Login alerts and password-reset emails arriving together, late at night.

The lock-down checklist

1. Carrier protections now: set a SIM PIN on the handset, and ask your operator about port-out locks / SIM-change alerts. Any friction for attackers helps.
2. Move 2FA off SMS where possible: authenticator apps for email, banking, and social accounts. SMS OTP stays only where no alternative exists.
3. Shrink the harvest surface: stop posting full DOB, address, and ID photos; audit app permissions; check unknown callers with our phone-risk score instead of calling back.
4. If signal dies unexpectedly: call your operator immediately from another phone, then freeze UPI/banking via customer care, and report at cybercrime.gov.in / 1930.

Your OTP is a key, not a message. Anyone asking you to read it aloud — caller, "support agent", relative's new number — is holding the wrong end of it. See India's threat landscape for the OTP lures running now.