SIM-swap fraud: A new way of stealing money

Fraudsters duplicating SIM cards to hack into bank accounts

With mobile phones becoming a convenient tool for banking, fraudsters have begun to use SIM-swap.

The modus operandi: A fraudster obtains your bank account details and registers your mobile phone number through phishing or malware. He approaches your mobile service provider with your fake identity proof and, claiming loss of handset or SIM damage, seeks a duplicate SIM card. Following verification, the original SIM is deactivated and a new one is issued to the fraudster. He then initiates financial transactions from your bank account, details of which he had earlier stolen, and receives payment confirmation requests on the duplicate SIM. Since the original SIM has been deactivated, you remain unaware about the fraudulent transactions he makes.

“This is basically the second phase of a fraud attack. First, your banking information is stolen; and then, your SIM card is cloned to access transaction confirmation messages. It is not yet common in India. There have been a few stray incidents in past one year, though. With mobile handsets being used more frequently for banking transactions, the number of such fraud attacks could increase,” said a senior executive of a foreign bank in India.

A few private banks have started educating their customers on ways to prevent a SIM-swap fraud. ICICI Bank, for instance, sent a mail to its internet banking customers last week, detailing tips to safeguard themselves against such frauds.

Bankers are advising customers to enquire with their mobile operators if they do not have network connectivity and are not receiving calls or text messages for unusually long periods.

It is also recommended that you do not switch off your mobile handset if you are receiving numerous unknown calls. “It could be a ploy to make you turn your phone off and prevent you from noticing a tampered network connection,” ICICI Bank wrote in its email to internet banking customers.

Bankers maintain that India has one of the most secured payment systems globally and most online frauds can be prevented if the customer is more vigilant. It is estimated that the average card fraud loss rate globally is six basis points, while it is only one basis point in India.

“India’s payment infrastructure is one of the most secured in the world. Fraudsters will always try to invent new techniques but banks also continue to devise new defence mechanisms. It is an ongoing process. We have had one or two odd instances of SIM-swap frauds but it is not yet common,” said Jairam Sridharan, president (retail lending & payments), Axis Bank.