Dealing with a SIM swapping attack
A SIM card allows your mobile device to make and receive calls, send and receive SMS messages, and access mobile data.
A SIM swapping attack occurs when a criminal fraudulently gains control of your mobile phone number by convincing your mobile network provider to transfer your number to a SIM card under their control. Once the transfer is complete, your phone will usually lose signal and you may no longer be able to make calls or receive SMS messages.
The primary objective of a SIM swap attack is often to gain access to online accounts by intercepting one-time PINs (OTPs), banking verification codes and password reset messages. Victims may experience financial fraud, email account compromise, cryptocurrency theft, or unauthorised access to social media and other online services.
In South Africa, this may involve a fraudulent SIM replacement, SIM swap, SIM migration or number porting request with a mobile network provider.
We want to better understand the impact of you experiencing this issue, can you share your experience by filling in this online form? This will help us better protect future victims.
How do I know if I have been the victim of a SIM swap?
Common indicators include:
Your mobile phone suddenly loses signal while other people on the same network nearby remain connected.
You cannot make or receive calls or SMS messages.
You receive a notification that your SIM card, mobile number or account has been activated, replaced or migrated without your knowledge.
You are unexpectedly locked out of your email, banking, social media or other online accounts.
You notice unauthorised banking, cryptocurrency or other financial transactions.
Your contacts receive WhatsApp messages or SMS messages that appear to come from you.
Your social media accounts show activity that you did not perform.
You receive an unusual increase in calls or SMS messages immediately before losing service, which may be used as a distraction by criminals.
What to do if you have been the victim of a SIM swap
Time is critical. The sooner you act, the greater the chance of limiting financial loss and preventing further account compromise.
Contact your mobile network provider immediately Contact your mobile network provider using the official fraud, customer support or emergency contact details available on its official website or mobile application.
Examples include:
Vodacom
MTN
Cell C
Telkom
Rain
Other licensed South African mobile providers
Ask them to:
Immediately suspend or reverse the fraudulent SIM swap, if possible.
Secure your mobile account.
Investigate how the SIM swap occurred.
Prevent further SIM replacements until your identity has been verified.
Provide a reference number and, where available, written confirmation of the incident.
Contact your bank immediately – If you use your mobile number for banking or financial services, contact your bank's fraud department immediately.
Ask them to:
Secure or temporarily freeze online and mobile banking where appropriate.
Block or replace affected cards if necessary.
Remove unknown or unauthorised devices linked to your banking profile.
Review recent transactions.
Investigate any suspicious activity.
Provide a case or reference number.
If you use cryptocurrency exchanges or digital wallets linked to your mobile number, contact those providers immediately as well.
Change passwords on important accounts – Once you have regained control of your phone number, immediately change the passwords for:
Email accounts.
Banking services.
Social media accounts.
Cloud storage accounts.
Online shopping accounts.
Any other important online services.
Use strong, unique passwords and enable Multi-Factor Authentication (MFA) where available.
Where possible, use an authentication app or passkey rather than SMS-based verification.
Keep detailed records - Maintain a record of:
Who you contacted.
Dates and times.
Reference numbers.
Actions agreed upon.
Copies of emails or SMS messages.
Screenshots of suspicious activity.
These records may assist if disputes arise or if further investigation is required.
Follow up – Stay in contact with both your mobile provider and your bank until the incident has been resolved.
Confirm that:
The incident has been recorded as suspected SIM swap fraud.
Your mobile number has been secured.
Any unauthorised transactions are being investigated.
Additional security measures have been added to your account.
If your mobile network provider does not resolve your complaint after you have followed its internal complaints process, you may be able to escalate the matter to the Independent Communications Authority of South Africa (ICASA).
If you are dissatisfied with how your bank handled the incident, you may be able to escalate your complaint to the National Financial Ombud Scheme South Africa (NFO) after completing the bank's complaints process.
Report the crime
Report the incident to the South African Police Service (SAPS) by visiting your nearest police station.
Ask for:
A case number.
A copy of your statement, if available.
If your identity or personal information may have been misused, you may also wish to contact the Southern African Fraud Prevention Service (SAFPS) for guidance on protecting yourself against identity fraud.
How do SIM swapping attacks happen?
Although every case is different, SIM swapping attacks commonly follow this pattern:
Criminals gather personal information about you from social media, phishing attacks, previous data breaches or other publicly available sources.
They use this information to impersonate you when contacting your mobile network provider.
They fraudulently request a SIM replacement, SIM swap or number port to a SIM card under their control.
Once your phone number has been transferred, they intercept one-time PINs (OTPs), verification codes and password reset messages.
They reset passwords and gain access to your banking, email, social media and other online accounts.
How can I reduce the risk of another SIM swap?
While no solution can completely eliminate the risk, the following measures can reduce your chances of becoming a victim.
Secure your mobile account - Ask your mobile provider whether they offer:
An account PIN or passphrase.
Additional identity verification before SIM replacements.
SIM swap notifications.
Other account security protections.
Reduce reliance on SMS based verification - Where available, use authentication apps or passkeys instead of SMS verification codes. SMS-based authentication is more vulnerable to SIM swapping attacks.
Protect your device - Secure your mobile phone with:
A screen lock.
A SIM PIN.
Device encryption where available.
This provides additional protection if your phone is lost or stolen.
Limit the personal information you share - Review your social media accounts and consider whether information such as:
Your date of birth.
Mobile number.
Address.
Family relationships.
Employer.
could help criminals impersonate you.
Strengthen your overall cyber security- Many SIM swap victims may first have personal information stolen through phishing emails, messages or malware.
Reduce your risk by:
Keeping your devices updated.
Using reputable antivirus software.
Being cautious of unexpected emails, SMS messages and phone calls requesting personal information.
Using strong, unique passwords for every online account.
Enabling Multi-Factor Authentication (MFA) wherever possible.
Donate
Your generosity makes our free support possible. Please consider giving today.
Without donations, we cannot keep our service free or provide help to the most vulnerable victims of cybercrime when they need it most. As a not-for-profit organisation, every donation goes directly towards keeping The Cyber Helpline up and running. Donate now and help us support victims of cybercrime.