Fraud Anatomy
SIM swap fraud
and mobile banking
In a SIM swap the fraudster moves the victim's phone number to a SIM they control. Every SMS one-time password then goes to the attacker, so the number itself becomes the key to the account.
What is SIM swap fraud?
The fraudster collects personal details, then persuades a mobile operator, or someone inside it, to issue a replacement SIM for the victim's number. The victim's phone loses signal. The attacker's SIM now receives calls and SMS, including the one-time passwords a bank sends to confirm a login or a payment.
No link is clicked and no call is answered by the victim, which is why these cases surprise people. The weak point is not the customer's behaviour, it is the assumption that a phone number proves a person.
A 2026 case in Bengaluru
In June 2026 a Bengaluru resident lost ₹7.2 lakh after fraudsters moved his number onto a different SIM without his knowledge. Experts confirmed the swap, and the one-time passwords his bank sent went to the attacker.
Source: Business Today
Why SMS one-time passwords are not enough
An SMS passcode is only as trustworthy as the SIM it lands on. After a swap it is a valid code arriving on the wrong device. Any control that treats "I received the SMS" as proof of identity fails.
How banking apps defend against it
- Bind the account to the phone. A signing key held in the device's secure hardware does not move to a new SIM or a new phone. See device binding.
- Notice the change. A first login from a new device, a new network or a new place right after a SIM change triggers a step-up check.
- Look at the session, not only the code. Behaviour, location and device signals are scored together before money moves.
- Keep evidence. A signed record of the decision supports the dispute process afterwards.
NonaShield combines hardware-backed possession proof, location checks and a risk engine, so a SIM swap gets the attacker the SMS channel but not the key.
Frequently asked questions
What is a SIM swap?
Moving a phone number to a new SIM, usually by deceiving the mobile operator, so that calls and SMS, including one-time passwords, reach the attacker.
How can I tell if my SIM was swapped?
Sudden loss of mobile signal with no explanation, plus unexpected bank or account alerts, is the usual sign. Contact the operator and the bank at once.
Does a device-bound key stop SIM swap fraud?
It stops the attacker from approving transactions as the customer, because the signing key stays in the original phone's secure hardware. The app should still step up risky sessions.
Does NonaShield replace SMS OTP?
It can reduce reliance on it. Transactions can be authorised by a hardware-backed signature from the enrolled device, with SMS kept only as a fallback.
See it on your app.
Book a free 30-day shadow pilot, or download the platform brochure.