Skills books › Staying Safe Online

SIM swap fraud: the warning signs and what to do

In a fraudulent SIM swap, a criminal pretends to be you and gets your phone number moved to their SIM card. From then on, your calls, SMSes and one-time PINs go to them. They reset your passwords and empty your bank account. Fast action can stop it.

The warning signs

• Your phone suddenly shows no signal, "SIM not registered" or "emergency calls only", while other phones nearby have signal.
• You cannot make calls or send SMSes.
• You get an SMS from your network about a SIM swap that you did not ask for.
• You stop receiving one-time PINs, or get emails about password changes that you did not make.

What to do at once

1. Phone your bank's fraud line immediately, from another phone, and ask them to block your accounts and banking app. Minutes matter.
2. Phone your network from another phone and say that your number has been swapped without your permission.
3. Change your email password from another device.
4. Report it to the police and get a case number.

Call the bank first, then the network.

Making a SIM swap harder

• Keep your ID number, date of birth and account details private.
• Ask your network what extra protection it offers, such as a password or PIN on your account.
• Check that your bank sends SIM swap alerts.
• Where an account allows it, use an authenticator app for one-time PINs, not SMS.

Never let someone register a SIM in your name for them, and never use a SIM registered to someone else. Crimes committed with a SIM are traced to the registered person.

Lock the phone itself

A phone with no lock is an open wallet.

• Use a PIN of at least six digits, or a password. Avoid birthdays and 123456.
• Fingerprint and face unlock are convenient, but keep the PIN behind them strong.
• Set the phone to lock after 30 seconds or a minute.
• Hide message contents on the lock screen, so that a thief cannot read your one-time PINs.
• Set a SIM PIN, so that your SIM cannot be used in another phone.

Keep it updated

Updates close the weaknesses that criminals use. Switch on automatic updates for the system and for apps. A very old phone that no longer gets security updates is riskier for banking.

Be careful with apps

• Install apps only from the phone's official app store. Apps sent as files by WhatsApp, SMS or a website can be malware.
• Check the developer's name. A banking app should come from the bank itself.
• Be very careful with apps that ask to read your SMSes or to control the screen.
• Never install a remote access app because someone asked you to. No bank will ever ask you to install an app so that it can help you.

Before you lose your phone

• Switch on automatic backup, including the chat backup in WhatsApp.
• Switch on the find-my-phone service.
• Dial *#06# to see the phone's IMEI number, and keep it at home.
• Know your bank's fraud number and your network's customer service number.

If the phone is lost or stolen

1. Phone your bank from another phone and ask them to block banking on the lost phone.
2. Phone your network to block the SIM.
3. Use find-my-phone to lock the phone and, if it is not coming back, erase it.
4. Change the passwords of your email and important accounts from another device.
5. Report a theft to the police, with the IMEI number, and get a case number.

This guide is based on Chapter 2 of Staying Safe Online.