Chapter 1 · The scenario
Example: A withdrawal held in Indore
An investment app in Indore sends withdrawal OTPs as WhatsApp authentication templates. One Saturday night a customer's number is SIM-swapped, but her WhatsApp has two-step verification, so the attacker cannot re-register it and the OTP still arrives on her own phone over Wi-Fi. The attacker, logged in through a phished web session, taps "Send code by SMS instead". Before any SMS fallback, the app runs a SIM-change check, which reports a swap in the last 72 hours; the withdrawal is held and the request routed to video verification. When she restores her number on Monday, support releases the hold.
Chapter 2 · What is SIM swap fraud?
SIM swap fraud (also called SIM swapping or SIM hijacking) is an attack on a phone number rather than a phone. The criminal persuades or bribes a mobile operator to issue a replacement SIM for the victim's number — using a forged ID, a story about a lost handset, or personal details harvested by phishing — and the moment the new SIM is activated the victim's own SIM goes dead. Calls and SMS for that number now reach the attacker.
The number is the prize because so much security is built on it: SMS one-time passwords for banking and payments, password-reset codes for email, and the registration of messaging apps. A SIM swapper can request a WhatsApp registration code for the hijacked number and activate the victim's WhatsApp on their own phone — unless the account has two-step verification turned on — then message the victim's contacts or receive any authentication template a business sends there.
India has added friction. Since a Department of Telecommunications instruction of September 2022, operators bar incoming and outgoing SMS on a replacement SIM for 24 hours after activation, and since 1 July 2024 TRAI's number-portability rules refuse a porting code within seven days of a SIM swap or replacement. Businesses add their own layers: checking whether a number's SIM changed recently before trusting an OTP, binding sessions to known devices, and the WhatsApp Cloud API's identity change check. SIM swap fraud is one specific route to account takeover, which also covers phishing, credential stuffing and malware.
Key takeaways
- SIM swap fraud moves a victim's number to an attacker's SIM, so SMS one-time passwords and recovery codes reach the attacker.
- In India, a replacement SIM cannot send or receive SMS for its first 24 hours, and the number cannot be ported for 7 days after a swap.
- Moving OTPs from SMS to WhatsApp helps only if the user's WhatsApp has two-step verification; otherwise the attacker can re-register it.
- Businesses can check operator data for a recent SIM change, and the Cloud API withholds delivery after an identity change with error 137000.
- SIM swap is one route to account takeover; phishing, credential stuffing and malware are others.
Chapter 3 · How it unfolds
How does SIM swap fraud work?
The attacker gathers details
Name, date of birth, address and sometimes a photo of an ID come from phishing calls, leaked databases or social media — enough to pass an operator's identity checks.
A replacement SIM is issued
At a store, through a support line or with an insider's help, the operator activates a new SIM for the victim's number. The victim's phone drops to "No service".
OTPs start flowing to the attacker
The attacker triggers password resets and payment OTPs. In India the new SIM cannot receive SMS for 24 hours, so attacks are often timed for nights and weekends, when the victim is slow to notice.
Accounts are re-registered
Email, banking apps and WhatsApp are moved to the attacker's device. WhatsApp two-step verification stops that step: re-registering the account needs the owner's six-digit PIN.
Businesses detect and step up
A SIM-change check before high-risk actions, device binding and the Cloud API's identity change check flag the swap, so the business asks for stronger verification instead of trusting the OTP.
Chapter 4 · Why it matters
Why does SIM swap fraud matter?
When a SIM swap succeeds, a business usually pays: a fraudulent transfer approved with an OTP the bank sent, a loyalty balance drained, or a customer's WhatsApp hijacked and used to scam their contacts under a trusted name. Because the attacker passes the OTP check legitimately, the fraud looks like normal use. Businesses that send OTPs over SMS or WhatsApp need a signal that the number changed hands recently, and support teams need to recognise the pattern when a customer says their phone suddenly lost signal.
Chapter 5 · In code
SIM swap fraud in code
# 1. Turn on the identity change check for a business phone numbercurl -X POST "https://graph.facebook.com/v26.0/{PHONE_NUMBER_ID}/settings" \-H "Authorization: Bearer {ACCESS_TOKEN}" \-H "Content-Type: application/json" \-d '{ "user_identity_change": { "enable_identity_key_check": true } }'# 2. Send the OTP with the hash stored from this customer's last webhookcurl -X POST "https://graph.facebook.com/v26.0/{PHONE_NUMBER_ID}/messages" \-H "Authorization: Bearer {ACCESS_TOKEN}" \-H "Content-Type: application/json" \-d '{"messaging_product": "whatsapp","recipient_type": "individual","to": "919812345678","recipient_identity_key_hash": "{STORED_IDENTITY_KEY_HASH}","type": "template","template": {"name": "withdrawal_otp","language": { "code": "en" },"components": [{ "type": "body", "parameters": [{ "type": "text", "text": "482917" }] },{ "type": "button", "sub_type": "url", "index": "0","parameters": [{ "type": "text", "text": "482917" }] }]}}'# If the customer's identity changed, the message is not delivered and a# status webhook arrives with error code 137000: re-verify through another channel.
Store `identity_key_hash` from inbound-message webhooks (or `recipient_identity_key_hash` from status webhooks) once the check is on.
Chapter 6 · The facts
SIM swap fraud: key facts and limits
| India: SMS on a replacement SIM | Barred for 24 hours after activation (DoT, 2022) |
|---|---|
| India: porting after a swap | No porting code for 7 days (TRAI, since 1 July 2024) |
| WhatsApp two-step PIN | 6 digits, needed to re-register the account |
| Cloud API identity mismatch | Not delivered; status webhook error 137000 |
| Operator SIM-change check | CAMARA SIM Swap API: swapped within maxAge hours |
| India digital payments | RBI: two factors, one dynamic, since 1 April 2026 |
Chapter 7 · Where it goes wrong
Common mistakes with SIM swap fraud
Treating a correct OTP as proof of identity
An OTP proves control of the number right now, which is exactly what a SIM swapper has. For payouts, password changes and new-device logins, combine it with a SIM-change or device check.
Falling back to SMS without checking
Attackers deliberately make the WhatsApp route fail so the business falls back to SMS. Before an SMS fallback on a high-risk action, check for a recent SIM change.
Assuming WhatsApp OTPs are immune
If the user has not set a two-step verification PIN, the attacker can register WhatsApp on their own phone with the hijacked number. Encourage customers to set a PIN and use the identity change check for sensitive messages.
Support scripts that unlock accounts by phone number
A caller who has "lost their phone" and knows the number and date of birth may be the attacker. Train agents to verify through a second channel before resetting anything.
Chapter 8 · What good teams do
Best practices for SIM swap fraud
- Hold high-value actions for a few hours after a detected SIM change rather than blocking the account outright.
- Ask customers in onboarding messages to turn on WhatsApp two-step verification.
- Store the identity key hash from webhooks and alert support when a high-value customer's hash changes.
- Watch for clusters: many recent SIM changes hitting one flow is a campaign, not a coincidence.
Chapter 9 · SIM Swap Fraud FAQs