Stop OTP theft now: Simple steps that block SIM swaps before they start

Representative image

SIM swap fraud happens when an attacker convinces a telecom operator to move your phone number to a new SIM under their control. Once the number is ported, the criminal receives the one-time passwords that banks and services send by SMS and can reset passwords, move money and take over accounts. Telecom-bank links and leaked credentials make this attack fast and effective.

What regulators and banks are doing now

Indian regulators and agencies have tightened rules because the threat surged in 2024-25. The Reserve Bank of India and the Department of Telecommunications are pressing banks and telcos to adopt stronger fraud-risk checks and move away from SMS-only authentication. CERT-IN and state cyber units have flagged waves of credential leaks and SIM-porting scams as a major vector for financial fraud.

Immediate steps to lock down your accounts today

First, stop using SMS OTP where you can. Switch critical accounts to app-based authenticators or hardware security keys; these do not rely on your phone number and are far harder to intercept. Next, set a SIM PIN and a separate account PIN with your mobile operator and ask them to add a “port out” or “number lock” on your line so no SIM reissue can happen without you in person. Finally, make the phone number on file with banks a recovery contact only for low-risk alerts, not for password resets.

If you lose service or suspect a SIM swap

If your phone suddenly loses service for no reason, treat it as an emergency. From another device call your carrier’s fraud helpline and demand an immediate reversal or lock, then call your bank’s emergency number and freeze high-value payment instruments. Change the passwords to your email and financial apps (email first) using a device you still control, because email control lets attackers reclaim other services. Security teams recommend acting in the first hour — that is when recovery chances are highest.

Hardening that prevents account takeover over the long run

Use strong unique passwords stored in a password manager and activate multifactor authentication that is app- or device-based, not SMS. Consider a hardware security key for logins to critical services and enroll in bank protections such as transaction alerts, beneficiary blocks, and whitelisting of devices. Keep your SIM PIN secret, avoid sharing personal identifiers over phone or email, and be sceptical of unsolicited calls claiming to be from your bank or telco.

When to involve police and regulators

If money is stolen or you can prove a SIM port was issued fraudulently, file a cybercrime complaint and provide copies of carrier and bank communications. In India, local cyber units and police coordinate with telcos for technical logs; public interest rulings and past judgements show telcos and banks can be held partly liable if they failed basic KYC or fraud checks. Keep screenshots, timestamps and complaint reference numbers — they matter in investigations and insurance claims.

FAQs

How quickly can a SIM-swap lead to theft?

Very fast. Once the number is ported, attackers typically use it within minutes to request OTPs, reset passwords and move funds. Acting within the first hour improves recovery odds.

Is SMS OTP still safe for small payments?

SMS is increasingly fragile. Regulators are pushing the ecosystem away from SMS for authentication because of SIM-port and credential-leak risks. For any account you value, prefer an authenticator app or hardware key.

Which single change gives the best protection?

Move your critical accounts off SMS-based 2FA and enable an authenticator app or a hardware security key. That breaks the SIM swap attack chain at its weakest link.