SIM Swap or eSIM Hijack: Signs Your Number Has Been Taken Over, What to Do in the First 30 Minutes and the Law That Protects You

Your phone suddenly shows “No Service.” Calls stop connecting. Banking OTPs no longer arrive. Then you discover a transaction you never authorised.

These could be signs that someone has taken control of your mobile number through a SIM swap, fraudulent SIM replacement or eSIM takeover. If your number receives banking OTPs, password-reset codes or account-recovery messages, a takeover can put more than your phone service at risk.

The first 30 minutes matter. Contact your telecom operator immediately, secure your bank accounts through another device and report any financial fraud without delay.

This guide explains the warning signs, the immediate response, the Indian laws and telecom safeguards that may apply, and where to complain.

What Is a SIM Swap or eSIM Hijack?

A SIM swap occurs when a telecom operator activates a replacement SIM for your number. This is legitimate when you request a replacement because your SIM is lost or damaged. It becomes fraud when someone obtains a replacement without your authorisation.

An eSIM is a digital SIM profile installed on a compatible device. If a criminal fraudulently transfers or activates your number on another device, your original phone may lose network access while the attacker receives calls or messages intended for you.

The objective may be to intercept OTPs, reset passwords, take over messaging accounts or attempt unauthorised financial transactions.

There are several ways this can happen:

  • Fraudulent SIM replacement: Someone impersonates you or abuses the replacement process.
  • eSIM transfer fraud: An attacker tricks a telecom provider or exploits an account-recovery process to move your number.
  • Mobile-number porting fraud: Someone attempts to move your number to another operator without your permission.
  • Account takeover using stolen personal information: Criminals use leaked identity details, phishing or social engineering to support a fraudulent request.

A SIM swap does not automatically give someone access to every account on your phone. However, it can undermine account security when services rely on your mobile number for verification or recovery.

Seven Warning Signs Your Number May Have Been Taken Over

1. Your phone suddenly loses network service

If your phone unexpectedly displays “No Service,” “Emergency calls only” or cannot register on the network, investigate promptly.

A network outage, damaged SIM or device problem can cause the same symptoms. The warning becomes more serious if the outage persists while other customers using the same operator have service.

2. You receive a SIM replacement or eSIM activation message you did not request

Treat an unexpected message about a SIM change, eSIM activation or replacement request as a potential security incident.

Do not click unfamiliar links or call a number supplied in a suspicious message. Contact your operator through its official app, website, customer-care channel or service centre.

3. Banking OTPs and account alerts stop arriving

If your phone loses service and expected banking messages suddenly disappear, someone may be attempting to take control of your number.

Do not wait for a fraudulent debit to appear before acting.

4. Your bank reports unfamiliar transactions

Unexpected UPI transfers, card transactions, net-banking activity or password-reset notifications require immediate attention.

Contact your bank using its official number or app. Ask it to secure affected channels and investigate the activity.

5. You receive unexpected password-reset or login alerts

Messages from email providers, social networks, payment apps or messaging platforms may indicate that someone is trying to access your accounts.

If you still have access through a trusted device, secure your primary email account and review active sessions.

6. Your messaging account is logged out unexpectedly

If WhatsApp or another messaging service suddenly asks you to register your number again, check whether your mobile service is working and whether an unfamiliar device or login attempt is involved.

Use the service's official recovery process. Warn close contacts through another channel if your account may be sending fraudulent messages.

7. Your operator confirms a change you never authorised

If customer care confirms that a replacement SIM, eSIM activation or porting request was submitted without your permission, treat the matter as urgent.

Ask the operator to secure the number, investigate the request and provide a complaint reference.

Important: One symptom alone does not prove a SIM takeover. Several symptoms occurring together—particularly loss of network service, unexpected SIM-change messages and suspicious financial activity—justify immediate action.

The First 30 Minutes: What to Do

Do not spend this time trying to identify the attacker. Focus on stopping further access and preserving evidence.

Minutes 0–5: Contact your telecom operator

Use another phone if your own number has stopped working.

Contact your mobile operator through a verified customer-care channel or visit an authorised service centre. Explain that you suspect an unauthorised SIM replacement or eSIM transfer.

Ask the operator to:

  • Check whether a SIM replacement, eSIM activation or porting request was made.
  • Suspend or reverse unauthorised changes where possible.
  • Restore control of your number after verifying your identity.
  • Record a formal fraud complaint and provide a reference number.
  • Preserve relevant request, verification and activation records for investigation.

Do not assume that simply restarting your phone will solve the problem.

Minutes 5–10: Contact your bank

If your number is linked to banking, UPI, cards or investment accounts, contact your bank using its official number or app on a trusted device.

Tell the bank that your mobile number may have been compromised.

Ask it to assess whether your accounts, payment channels or credentials need to be temporarily secured. If unauthorised transactions have occurred, report each transaction and follow the bank's instructions.

If you use multiple banks or payment services, secure the affected ones rather than assuming that one bank's action protects every account.

Minutes 10–15: Report financial fraud immediately

If money has been transferred without your authorisation, call 1930, India's national cybercrime helpline for immediate reporting of financial cyber fraud.

Also file a complaint through the official National Cyber Crime Reporting Portal.

Keep the following ready:

  • Transaction amount and date.
  • Bank or payment-service details.
  • Transaction reference or UTR number, if available.
  • Your telecom operator's complaint reference.
  • Relevant SMS messages, emails and screenshots.

Follow the instructions given during the call and complete the online reporting process as directed.

Do not delay reporting while trying to gather every possible document. Provide the available details first and preserve additional evidence as you obtain it.

Minutes 15–20: Secure your primary email and important accounts

If you can access your accounts through a trusted device, prioritise the email account used for password recovery.

  • Change passwords if you suspect unauthorised access.
  • Use a strong, unique password for your email account.
  • Review recent logins and active sessions.
  • Sign out unfamiliar devices.
  • Check recovery email addresses and phone numbers.
  • Review banking and payment-app activity.
  • Secure messaging accounts through their official recovery settings.

If you suspect that your phone itself is compromised, use a separate trusted device instead.

Minutes 20–25: Preserve evidence

Keep records of what happened and when.

Save screenshots of network-status messages, SIM-change alerts, bank notifications and suspicious login messages. Record the times when service stopped, when you contacted the operator and when you reported any transactions.

Keep copies of complaint acknowledgements and transaction references.

Do not delete messages that may help an investigation. Avoid publicly posting your full phone number, bank details, Aadhaar details or OTPs.

Minutes 25–30: Escalate and alert people you trust

If the operator has not secured your number, escalate the complaint through its official grievance process and ask for the next escalation authority.

If your messaging account may be compromised, contact close family members or colleagues through another channel. Tell them not to trust payment requests, links or OTP requests sent from your number until you confirm that the account is secure.

If there is evidence of criminal activity, submit or update your police or cybercrime complaint and retain the acknowledgement.

Do not treat 30 minutes as a deadline after which action is pointless. These steps are an emergency sequence, not a guarantee that every account can be secured within half an hour.

The Law That Protects You in India

SIM swap fraud may involve identity theft, cheating, unauthorised access and misuse of telecom services. The exact offences depend on what the person did, the evidence and the circumstances.

Several legal provisions and regulatory safeguards may be relevant.

1. Information Technology Act, 2000: Sections 66C and 66D

The Information Technology Act, 2000 contains provisions that may apply when a SIM takeover is used to commit further digital offences.

Section 66C — Identity theft

This provision addresses fraudulent or dishonest use of another person's electronic signature, password or other unique identification feature. It may apply where the facts establish the required elements of identity theft.

Section 66D — Cheating by personation using a computer resource

This provision may apply when a person cheats by impersonating someone through a communication device or computer resource.

These provisions do not mean that every SIM replacement dispute automatically constitutes an offence under both sections. Investigators must assess the conduct and evidence.

2. Bharatiya Nyaya Sanhita, 2023: Cheating and personation

The Bharatiya Nyaya Sanhita, 2023 also contains provisions that may apply to fraudulent conduct.

  • Section 318 deals with cheating.
  • Section 319 deals with cheating by personation.

Depending on the facts, these provisions may be relevant where an offender impersonates a subscriber, deceives a service provider or victim, or obtains money through fraudulent conduct.

The appropriate charges depend on the facts and the investigating authority's assessment.

3. Department of Telecommunications safeguards for SIM replacement

The Department of Telecommunications (DoT) has issued instructions governing SIM swap and replacement procedures.

These include identity-verification requirements and measures designed to reduce fraudulent replacement. DoT instructions also provide for a 24-hour restriction on incoming and outgoing SMS on a newly activated replacement SIM under the relevant process.

This is a safeguard, not a guarantee that fraud is impossible. A person who loses network access should still contact the operator immediately.

Read the relevant DoT instructions through the Department of Telecommunications website.

4. TRAI rules on mobile-number porting

The Telecom Regulatory Authority of India (TRAI) introduced an additional safeguard to prevent fraudulent porting after a SIM swap or replacement.

Under the amendment effective from 1 July 2024, a Unique Porting Code (UPC) is not to be allocated if the request is made before seven days have elapsed from the date of the SIM swap or replacement.

The rule is intended to make it harder for criminals to take over a number and immediately port it to another operator.

Read the official TRAI Mobile Number Portability FAQ and the Press Information Bureau announcement.

5. Telecommunications (Telecom Cyber Security) Rules, 2024

The Telecom Cyber Security Rules, notified under the Telecommunications Act, 2023, establish a framework for protecting telecom networks and services against misuse.

The framework includes measures concerning fraudulent use of telecom identifiers and the ability to take action against identifiers involved in specified security risks.

Read the official Department of Telecommunications telecom cyber security information.

What these laws mean for a victim: You can report the incident to your telecom operator, bank, cybercrime authorities and police. The applicable legal provisions and any liability of a service provider depend on the facts, the investigation and the relevant legal requirements. No single provision guarantees automatic reimbursement or a particular prosecution outcome.

Where to Complain About SIM Swap or eSIM Fraud

Use the channel that matches the problem. If money has been lost, report the financial fraud immediately while also addressing the telecom takeover.

National Cyber Crime Reporting Portal

Website: cybercrime.gov.in

Use the portal to report cybercrime, including mobile-related crime and online financial fraud. Provide the relevant transaction details and evidence.

Cyber financial fraud helpline: 1930

Call 1930 as soon as you discover an unauthorised financial transaction. Follow the reporting instructions and complete any required online complaint steps.

Your telecom operator

Report the unauthorised SIM replacement, eSIM activation or porting request through the operator's official customer-care and grievance channels.

Ask for a complaint reference and the process for escalating an unresolved complaint.

Your bank or payment service

Report unauthorised transactions and ask the institution to secure affected services. Keep the complaint number and transaction references.

If your bank does not resolve a complaint through its prescribed process, you may be able to approach the RBI Complaint Management System for an eligible complaint against a regulated entity. RBI's complaint mechanism is not a substitute for reporting the criminal act to cybercrime authorities.

Local police

You can report suspected criminal activity to the police and provide your cybercrime complaint reference, telecom complaint, transaction details and available evidence.

If money has been stolen, do not wait for the telecom operator's investigation to finish before reporting the financial fraud.

What Evidence Should You Keep?

A well-documented complaint helps the relevant authority understand the sequence of events.

Keep copies of:

  • SMS or email notifications about a SIM change or eSIM activation.
  • Screenshots showing the loss of network service.
  • Bank statements and unauthorised transaction alerts.
  • Transaction IDs, UTR numbers and amounts.
  • Telecom operator complaint numbers.
  • Cybercrime portal acknowledgement details.
  • Emails or messages about password resets and unfamiliar logins.
  • A timeline of when the incident began and what actions you took.

Do not alter screenshots or delete original messages. Keep copies in a secure location that is not dependent solely on the compromised phone number.

How to Reduce the Risk of a Future SIM Takeover

You cannot eliminate every risk, but a few precautions can make account takeover harder.

Protect your telecom account

Use the operator's available account-security features. Keep your customer-care PIN or account credentials private where supported. Never disclose an OTP to a caller claiming to be from your operator.

Protect your primary email account

Use a unique password and enable a strong second authentication method where available. Review recovery details and active sessions periodically.

Do not rely exclusively on SMS for account security

Where a service offers stronger authentication options, consider using an authenticator app, passkey or hardware security key, depending on the service and your needs.

SMS-based verification remains useful, but a compromised mobile number can weaken it.

Keep bank alerts enabled

Review account activity regularly. Enable available transaction notifications and know how to contact your bank quickly.

Be careful with personal information

Fraudsters may use information obtained through phishing, data leaks or social engineering to impersonate subscribers. Avoid sharing identity documents, account details or verification codes with unverified contacts.

Treat unexpected network loss seriously

A temporary outage does not necessarily mean fraud. But if your phone loses service without explanation—particularly alongside unexpected SIM-change messages or account alerts—verify the situation with your operator promptly.

Frequently Asked Questions

Can a SIM swap empty my bank account?

A SIM swap does not automatically give an attacker access to your bank account. However, it may help an attacker intercept SMS-based verification or reset access to services. The risk depends on the bank's security controls, the attacker's other information and whether additional authentication is required.

Is an eSIM safer than a physical SIM?

An eSIM avoids handling a removable physical card, but it can still be vulnerable to fraudulent account changes or transfer requests. Both physical SIM and eSIM users should secure their telecom accounts and investigate unexpected service loss.

Does “No Service” mean my SIM has been hacked?

No. Network outages, damaged SIM cards, handset issues and account problems can also cause service loss. Check with your operator, especially if you receive an unexpected SIM-change message or notice suspicious account activity.

What is the first number I should call if money is stolen?

Call 1930 immediately for cyber financial fraud. Contact your bank at the same time through its official channel, and report the incident through the National Cyber Crime Reporting Portal.

Can I get my money back?

Recovery depends on the transaction, how quickly it is reported, the available evidence and the decisions of the bank and relevant authorities. Report the fraud immediately, request that the bank investigate and preserve every acknowledgement. A complaint does not guarantee reimbursement.

Is fraudulent SIM replacement illegal?

Fraudulent replacement may form part of identity theft, cheating, personation or other offences, depending on the conduct and evidence. The applicable provisions should be assessed by the investigating authority.

Does the 24-hour SMS restriction prevent all SIM swap fraud?

No. The restriction is one safeguard in the replacement process. It does not remove every risk, and it does not mean you should wait 24 hours before contacting your operator if you suspect a takeover.

Final Takeaway: Protect the Number, Then Protect the Accounts

Your mobile number can be a gateway to banking, email and messaging accounts. If you suspect a SIM swap or eSIM hijack, contact your telecom operator immediately, secure your bank and email accounts through a trusted device, and preserve the evidence.

If money has been stolen, call 1930 without delay and file a report through the official cybercrime portal.

India's IT Act, criminal law provisions and telecom safeguards provide mechanisms that may apply to SIM-related fraud. Acting quickly, documenting the incident and using official complaint channels gives investigators the information they need to respond.

Official resources