SIM-swap fraud: man gets missed calls, loses ₹50 lakh 

A South Delhi-based businessman was duped of more than Rs 50 lakh by some unknown scammers through a

A South Delhi-based businessman was duped of more than Rs 50 lakh by some unknown scammers through a series of missed calls, the police said on Tuesday, adding that the victim had not shared any OTP or personal details with the accused.

The man, in his complaint, said he had received several missed calls and when he picked up one of the calls, there was no response from the caller’s side. Later, he found out that multiple transactions were made from his bank account and he lost nearly Rs 50 lakh.

A case has been registered at the Delhi Police’s cyber crime unit. According to a senior police officer, initial inquiry suggested the victim was duped using a SIM-swap technique.

A SIM-swap fraud is an account takeover scam in which criminals gain access to a victim’s phone. They manage to get personal information of a potential target through phishing (fake mails), vishing (fraudulent phone calls), smishing (fake text messages), etc. They then use all personal information to create a fake ID, impersonate the victim, and trick the telecom service provider to issue a duplicate SIM card – mostly on the pretext of losing the phone, or the old SIM card getting damaged. Once the duplicate SIM starts functioning, the original SIM gets blocked, the officer said.

With the help of the duplicate SIM, they can get a one-time password (OTP) and other alerts required to carry out financial transactions through the victim’s bank account.

While banks say that SIM swap is possible because of a weak two-factor authentication that enables scammers to access details from telecom providers. According to the police, one should alert them and the mobile service provider if there is no service or signal, bulk notifications that look suspicious, or one is unable to access personal accounts.

The Officer added that one shouldn’t share OTPs or personal details and should use stronger passwords. Also, any text, weblink, and email received should be thoroughly checked.