What is a SIM swap attack and how do I prevent it?

As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.

How is a SIM swap actually executed?

Three methods, in rising order of sophistication. The first is social engineering of a customer-care agent, using a fake ID or a claim about a lost phone, sometimes helped by an AI-cloned voice of a family member. The second is insider collusion at a retail outlet or a dealer, where a small payment buys a port. The third is a genuine subscriber-side compromise, where an attacker gets into your telecom account online and issues the port themselves, which is why a weak banking OTP and a weak telecom OTP are the same problem. In all three cases the operator's systems behave exactly as intended, which is why the port-out lock, not a dispute, is the control that matters.

What is the warning sign I should not ignore?

Sudden loss of mobile network on one handset while Wi-Fi continues to work, and the phone showing 'No SIM card' or 'Emergency calls only'. That is the classic indicator of a fraudulent SIM swap or a port. Second in importance: a notification that your number was ported to another operator, or a change in your plan or device registration you did not request. Third: an OTP or a login prompt arriving for a service you are not using, which means the attacker is now receiving your codes. The moment you see the first sign, call the operator and demand that the port be blocked, and call your bank, because the swap itself does not move money but it opens the door to the account takeover that does.

What is a port-out lock and why is it the best prevention?

A port-out lock, also called a port restriction, is a flag on your mobile number that tells the operator not to move the number to another operator without your specific written or in-person confirmation, sometimes with a registered mandate. It stops the most common outcome of a successful social-engineering attempt, which is the number being carried to an attacker-friendly operator. Request it in writing, ask for confirmation that it is active, and set an authorised-contact list so that only you can approve a change. India has also introduced an SBMMS, a SMS-based system that alerts customers when a new SIM is issued against their number, which is a useful second layer for detecting an unauthorised issue rather than a completed port.

Why is SMS-based OTP the weakest link?

Because it depends on one channel that an attacker can obtain by convincing one operator, one dealer or one call-centre agent, and because a cloned voice is now sufficient to pass many customer-care verification scripts. The stronger pattern is phishing-resistant authentication: an authenticator app or, better, a passkey or hardware security key for the accounts that matter, with the number used only for recovery, and for banking, transaction-level confirmation rather than a standing approval. Pair that with a dedicated banking-safe number kept on a separate handset, so a compromise of the everyday number does not move the money. This is the same control logic that stops the deepfake and voice-clone fraud that has become common in Indian BFSI.

What are the frequently asked questions?