SIM swap fraud how to recover money: what to do first

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 3 Nov 2026 · Cyber crime

SIM swap fraud works by moving your number onto a SIM the fraudster controls, then intercepting the OTPs that protect your bank and wallet accounts. The recovery clock starts the moment you lose signal. This guide sets out what to do in the first hour, how the law treats the offence, and how bank liability is decided.

A SIM swap happens when someone obtains a duplicate SIM for your mobile number, usually by impersonating you at a telecom point of sale. Your phone loses signal, and while you assume it is a network problem, the fraudster receives your calls and messages, including one-time passwords. The accounts drained are almost always your bank account, a UPI handle linked to the number or an e-wallet. Recovering the money depends on how fast you react, because the freeze that saves a claim is the one sought while the funds are still in the beneficiary account.

Legally, the conduct is cheating and identity fraud with a telecom twist. Sections 66C and 66D of the Information Technology Act 2000 cover identity misuse and cheating by personation using a computer resource, section 66 covers computer-related offences, section 318(4) of the Bharatiya Nyaya Sanhita 2023 covers the cheating itself, and section 336 BNS covers the forged documents used to obtain the duplicate SIM. RBI's directions on unauthorised electronic transactions decide who ultimately bears the loss.

The first hour: do these before anything else

Minutes matter, and the order of your actions matters almost as much. Telecom first, bank second, reporting third is the sequence that keeps the trail intact.

Call your telecom operator and block the number. Report the unauthorised duplicate SIM and ask for it to be cancelled immediately. Ask for a complaint reference and the time of the block. Without the block, the fraudster keeps receiving OTPs.
Call your bank's 24-hour helpline and the mobile banking and UPI channels. Ask for the account and the linked UPI handle to be frozen or blocked for debits. Get a complaint number and the name of the person who took your call.
Change the passwords and PINs on your bank login, UPI app, email and e-wallet, and enable any two-factor option that does not depend solely on SMS.
Call 1930 and file on cybercrime.gov.in. The national helpline issues a time-stamped acknowledgement that supports the freeze request you have already made with the bank.
Preserve the evidence. Save the loss-of-signal record, the telecom complaint, the bank statement showing the debits and the UPI transaction references.
File a written police complaint. Ask for registration under section 173 BNSS for a cognizable offence, or a written complaint if registration is declined, and secure a receipt.

How the swap is carried out

The most common method is a forged application at a telecom outlet, in which the fraudster presents identity documents resembling yours and requests a replacement SIM for a lost phone. In some cases an insider at the point of sale is involved. A second method uses your personal data, gathered from a data leak or social engineering, to answer the verification questions set by the operator. Once the duplicate SIM is active, the original SIM is deactivated, which is why victims discover the fraud only when the money is already gone.

A third, less discussed route is the so-called remote swap, where the fraudster convinces the telecom service to activate a new eSIM through a call centre by answering verification questions from leaked data. Because no physical visit occurs, the paper trail is thinner, and establishing that the activation was unauthorised becomes entirely dependent on the telecom operator's own records of the request and the identity checks performed.

Why OTP-based security fails here

An OTP proves only that the message reached the number you registered, not that you are holding the phone. When the number itself is under the fraudster's control, every SMS-based wall falls. Banks and regulators have moved towards app-based and other authentication, but legacy SMS reliance still makes the swap effective against accounts where the number is the primary factor.

What counts as customer negligence

Most contested SIM swap claims turn on negligence. Sharing an OTP, writing a PIN on the SIM sleeve, using the same password across services, or ignoring repeated warnings of a takeover can all be treated as negligence. What is not negligence is that the number was replaced through forged documents, or that the fraudster answered your operator's verification questions using data you never disclosed. The distinction decides whether liability is placed on the bank or shared with you.

Negligence indicators: OTP or PIN shared, credentials reused, takeover warnings ignored.
Non-negligence indicators: forged documents at the outlet, leaked data used for verification, immediate reporting.
Contested ground: whether the customer's choice of SMS authentication counts against them when the bank offered an alternative.

What the law says

The IT Act provisions fit because the fraud is committed through a computer resource using your stolen identity. Section 66C punishes dishonest use of another's electronic signature, password or unique identification feature, and section 66D punishes cheating by personation using a computer resource. On the criminal side, section 318(4) BNS covers the dishonest inducement and section 336 BNS covers the forged or false documents used at the telecom counter; where the documents were entrusted and misused, section 316 BNS can also be considered.

On procedure, an FIR is registered under section 173 of the Bharatiya Nagarik Suraksha Sanhita 2023, and section 35 permits a zero FIR at any station because the telecom counter, the beneficiary bank and the victim may be in three different places. If the police decline to register, section 175(3) BNSS enables an application to the magistrate for a direction to investigate. Electronic records, including bank statements and UPI logs, are proved under section 63 of the Bharatiya Sakshya Adhiniyam 2023 with the required certificate. RBI's unauthorised-transaction directions set the framework within which the bank must assess and settle your claim.

Who bears the loss

The bank's liability is not automatic. It is assessed against how the unauthorised transaction occurred and whether either side was negligent. The table below summarises the broad positions, though each case turns on its facts and the bank's own findings.

Situation	General position on liability
Fraud traced to a deficiency in the bank or in a third party on its side	Customer is generally not liable
Fraud caused by customer negligence, such as sharing an OTP or PIN	Liability may be shared, within limits set by regulation
Customer reports promptly and the bank fails to freeze the beneficiary account	Bank's delay can weigh against it
Customer reports after a long delay with no explanation	Claim weakens considerably

In a SIM swap the key argument is usually that the fraud occurred despite the customer's reasonable care: the number was taken over without consent and through forged documents, so the customer was not negligent in the ordinary sense. That argument is stronger when the complaint to the telecom operator and the bank is immediate and documented.

The complaint trail that supports recovery

One complaint is rarely enough. You are building a record for the bank's dispute process, for the police and for any later claim or suit.

Telecom complaint: duplicate SIM cancelled, with reference and time.
Bank complaint: debits flagged as unauthorised, beneficiary account freeze requested.
1930 and portal complaint: national acknowledgement number.
Police complaint or FIR: receipt or FIR copy under section 173 BNSS.
Nodal officer escalation: a written complaint when the branch or helpline does not resolve it within a reasonable time.
Evidence index: a dated list of every document, so that the record is easy for an investigator to follow.

Recovering through the bank and through the court

There are two distinct routes and they run on different logic. The bank route is a liability assessment under RBI's unauthorised-transaction directions: you submit the complaint, the bank investigates, and it either refunds, shares or rejects the claim. The court route is the criminal case against the persons who forged the documents and received the money, together with a restitution claim wherever the accused are traced and funds are recovered. A civil suit against identifiable recipients is a third route where they can be shown to have received your money without a lawful basis.

In practice the routes support one another. A police complaint strengthens the bank claim because it shows the transaction was disputed at the earliest opportunity, and a bank liability finding can inform the criminal case. Keeping a single, consistent timeline across all three keeps them from working against each other.

What decides the outcome

Three things usually decide whether the money comes back. The first is the freeze: if the beneficiary account is blocked while it still holds your funds, return is realistic; if the funds have been layered or cashed out, the claim shifts to the bank's liability framework and to the prosecution. The second is the clarity of your evidence that the number was taken over without your involvement. The third is the consistency of your statements to the telecom operator, the bank and the police.

Speed of the SIM block and of the freeze request.
Proof of unauthorised takeover rather than of shared credentials.
Precise transaction details for every debit, including UPI reference numbers.
Whether the bank followed its own complaint-handling timeline.
Whether the beneficiary accounts were already flagged as mules.

Mistakes to avoid

Do not wait to see whether the signal returns before calling the operator; the swap is not a network fault. Do not give the bank a casual account such as that your phone was briefly off, when what occurred was an unauthorised SIM replacement. Do not accept a verbal refusal and stop there; ask for the decision in writing. Do not let a second caller posing as a recovery agent persuade you to pay to unlock funds.

One more trap deserves mention. After a swap, fraudsters sometimes call the victim pretending to be the bank and ask for the new OTP or PIN, on the pretext of securing the account. No genuine bank asks for an OTP or a PIN, in this situation or any other; treat such a call as an attempted second fraud and report it.

Treating loss of signal as a network problem instead of a takeover.
Filing only a telecom complaint and leaving the bank and police uninformed.
Missing the freeze window by waiting for the bank to volunteer a solution.
Sharing OTPs with a caller who claims to be from the operator or bank after the swap.
Discarding the old SIM, the device or the messages before the case is complete.

When to involve a lawyer

A lawyer becomes necessary when the bank rejects the claim, when the loss is large enough to justify pursuing recovery through several forums, or when the police are slow to act. A cyber crime lawyer in Kolkata can assemble the liability argument, draft the section 175(3) BNSS application and correspond with the bank's nodal officer. Where an accused person seeks release in such a case, the route is through bail; victims rarely need it. For a first assessment of a SIM swap claim, use the contact page and bring every acknowledgement you have received.

Need help with a cyber crime matter?

Tell me what happened and I will tell you what to file, where, and by when. First conversation is free.

Call +91-9007000603 WhatsApp

Frequently asked questions

How do I recover money lost to SIM swap fraud in India?

Block the duplicate SIM with your telecom operator, then tell your bank to flag the debits as unauthorised and freeze the beneficiary account. Call 1930 and file on cybercrime.gov.in, then file a police complaint. Recovery depends on how quickly the freeze is sought and on RBI's liability framework for unauthorised electronic transactions.

Is SIM swap fraud covered by the IT Act?

Yes. Sections 66C and 66D of the IT Act 2000 cover identity misuse and cheating by personation using a computer resource, and section 66 covers computer-related offences. The underlying cheating is charged under section 318(4) BNS, and forged documents used to obtain the duplicate SIM fall under section 336 BNS.

Who is liable for money lost in a SIM swap, the bank or the customer?

It depends on how the transaction occurred and whether either side was negligent. RBI's directions on unauthorised electronic transactions govern the assessment. Where the takeover happened through forged documents and the customer reported promptly, the bank's liability argument is stronger; where the customer shared an OTP or PIN, liability may be shared.

My phone lost signal and money left my account. What does that mean?

It usually means your number was duplicated onto a SIM controlled by a fraudster, who then received your one-time passwords. Treat it as an emergency: block the SIM with your operator, freeze your bank and UPI access, and report to 1930 immediately, before the funds can be withdrawn or layered away.

Can the police register a SIM swap case if the telecom outlet is in another state?

Yes. Section 35 of the BNSS 2023 allows a zero FIR at any police station, which is later transferred to the station with jurisdiction. The investigating officer can seek assistance from units in the other state, so the victim is not required to travel or to choose the correct station in advance.

What evidence should I keep after a SIM swap?

Keep the telecom complaint reference showing the duplicate SIM was blocked, the bank statement and UPI references for every debit, the 1930 acknowledgement and the police receipt or FIR copy. Preserve the old SIM, the device and any messages. Electronic records are proved under section 63 of the Bharatiya Sakshya Adhiniyam 2023.

Does reporting late ruin a SIM swap claim?

Delay weakens the claim but does not destroy the criminal case. The bank may argue that a prompt complaint would have allowed a freeze, and may reduce or reject the liability claim on that basis. The offence can still be prosecuted, and the earlier you report, the stronger both the freeze request and the liability argument become.

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Cyber crime lawyer in your city · Bank account freeze help · Contact