Hack of the day: How to block SIM-Swap fraud even before it happens

'The Times of India' brings you 'Hack of the Day'—a new weekday series of quick, practical solutions to everyday hassles. Each hack is designed to save you time, money or stress, using tools and features within your reach—from government websites to everyday apps. In simple terms, it's simple fixes for smarter living.'There is a particular kind of financial crime that requires no hacking skills, no malware, and no access to your phone. The attacker never needs to touch your device. All they need is your mobile number, a few personal details sourced from a data breach or social media, and a convincing story told to a telecom customer service representative.

Within hours, your number is transferred to a SIM card they control, and every OTP your bank sends goes straight to them.SIM-swap fraud is one of the fastest-growing forms of financial crime in India and globally, and it is particularly dangerous because the victim typically has no idea it is happening until their phone loses network signal and their bank account has already been emptied. The good news is that a few straightforward steps, taken before anything suspicious happens, make this attack significantly harder to pull off.

Start with a SIM PIN

Many of the users don’t know that the SIM card inside their phone can be locked with its own separate PIN, entirely independent of the screen lock. When a SIM PIN set, anyone who removes your SIM and inserts another it into any other device, then it will be prompted for that PIN before the card works. Without it, the SIM is useless. This single privacy step prevents the most basic version of physical SIM theft from that being immediately exploitable.

In order to set it up the SIM PIN on Android, head to Settings and then Security. After this, enter the SIM card lock and enable the option to lock your SIM. You will be asked to a set a PIN. It is important to note that don’t use your birth year, phone number digits, or anything that could be guessed from publicly available information about you. On the other hand, the iPhone users can set the SIM PIN by going to Settings, and then SIM PIN and toggle it on.

The default SIM PIN for most carriers in India is 1234 or 0000. If you have never changed it, change it now, because those defaults are the first thing anyone will try.

Make sure your bank alerts reach you on email too

The central problem with SIM-swap fraud is that once your number is ported, you lose access to SMS entirely. Every OTP, every transaction alert, every bank notification goes to the attacker's device. If your bank alerts only come via SMS, you will have no idea a transaction is happening until it is too late.Log into your internet banking or mobile banking app and ensure that transaction alerts are also sent to your registered email address. Email sits on a different infrastructure from your phone number and cannot be hijacked through a SIM swap. Even a small transaction alert arriving in your inbox while your phone shows no signal is enough of a warning to act immediately.

Treat sudden network loss as a red flag

If your phone unexpectedly loses all network signal and shows no service, do not assume it is a tower issue and wait for it to resolve.

A SIM-swap attack in progress looks exactly like this from your end. Your number has been moved, the old SIM goes dead, and you are left with a phone that cannot make calls or receive messages.The moment this happens, call your telecom operator immediately from a different phone, whether a family member's device, a landline, or a colleague's phone. Report that you may be a victim of unauthorised porting and ask them to freeze your number.

Simultaneously, call your bank's helpline and ask them to temporarily block OTP-based transactions on your account. Acting within the first hour dramatically increases the chances of preventing financial loss.

Report suspicious porting alerts without delay

In India the TRAI regulations need the telecom operators to send a notification before a number is ported out. In case you receive an unsolicited porting messaging or a verification code you never requested, treat it is as an emergency.

So, it’s important that you don’t ignore it or assume it is spam. Call your operator immediately and then reject the porting request. Blocking SIM-swap fraud is less about technology and more about preparation. Set the SIM PIN today, add your email to bank alerts, and know exactly who to call if your signal disappears without explanation. Thirty minutes of setup now is worth considerably more than several hours of damage control later.