Your mobile number is more than a way to receive calls. It is often the key that unlocks your bank, your email and your social media. That is exactly why sim swap fraud singapore residents should understand has become a favourite tactic for criminals. In a SIM-swap attack, a fraudster convinces your telco to move your number onto a SIM card they control. Once they hold your number, they can intercept one-time passwords (OTPs), reset your passwords and drain accounts, sometimes within minutes.
The good news is that a SIM-swap is not magic. It relies on a handful of predictable steps, and each of those steps gives you a chance to notice and react. This guide explains how the scam works, the signs to watch for, and the calm, practical actions that keep your accounts safe without leaving you anxious every time your phone loses signal.
How a SIM-Swap Actually Works
A SIM-swap usually begins long before your signal drops. The criminal first gathers enough personal information to impersonate you. They might collect your full name, NRIC details, date of birth or answers to security questions. This information often comes from earlier phishing messages, leaked data from a breach, or oversharing on social media. None of it requires access to your phone yet.
With that information in hand, the fraudster contacts your telco, or uses an online porting process, and requests that your number be transferred to a new SIM. If they pass the identity checks, the telco activates the new SIM and deactivates yours. From that moment, your handset shows no service, and every call and SMS meant for you goes to the criminal instead.
The final stage is the payoff. The attacker heads to your bank app, email or e-wallet and triggers a password reset or a login that sends an OTP by SMS. Because they now receive your messages, they capture the code, complete the login and take control. Many victims only realise what happened when they see transactions they did not make.
The important insight is that the criminal needs two things: your personal details and a successful port request. You cannot always control what a company leaks, but you can make yourself a harder target and you can react quickly when something looks wrong.
Warning Signs and Safe Actions
The most obvious red flag is a sudden, unexplained loss of mobile signal when everyone around you still has coverage. If your phone shows “No Service” or “SOS only” and a restart does not fix it, treat it seriously rather than assuming it is a network glitch. Other signs include being unable to make calls or send texts, receiving unexpected notifications about a SIM change or porting request, or suddenly being logged out of apps.
The table below pairs common warning signs with the safe action to take for each one.
| Warning sign | Safe action to take |
|---|---|
| Sudden loss of signal while others have coverage | Contact your telco immediately using an official number or app |
| A message about a SIM change you did not request | Report it to your telco and ask to freeze any porting |
| OTPs arriving for logins you did not start | Change affected passwords from a trusted device |
| Being logged out of banking or email without reason | Sign in from another device and enable non-SMS 2FA |
| Emails confirming a password reset you never made | Reset the password again and review recent account activity |
If you suspect a SIM-swap is under way, contact your telco straight away. Look up the official hotline or use the telco’s own app rather than trusting any number sent to you in a message. Ask them to secure your account and reverse any unauthorised port. Then move to protect the accounts that matter most, starting with your bank and primary email, because email is often the master key to everything else.
Protect Yourself Before It Happens
Prevention is far easier than recovery, and most of it takes only an afternoon. The single most valuable step is to reduce your reliance on SMS for security. Where a service offers it, switch from SMS OTPs to an authenticator app or a physical security key. These methods stay on your device and are not affected if your number is ported, so a criminal holding your SIM still cannot log in.
Ask your telco what extra protections they offer. Many allow you to set a port-out PIN, a passphrase, or an in-person or in-app verification requirement before any SIM change is approved. Enabling these makes it much harder for someone to impersonate you over the phone. It is worth calling the official line and asking specifically what account locks are available.
Guard the personal information that makes impersonation possible. Be cautious about sharing your NRIC, date of birth or address, and think twice before posting details that double as security answers, such as your mother’s maiden name, your first school or your pet’s name. Treat unexpected calls or messages asking to “verify” your identity with suspicion, and never read out an OTP, password, 2FA code, SingPass credential or bank detail to anyone, no matter how official they sound.
Finally, build a simple monitoring habit. Turn on transaction alerts for your bank and e-wallet so any unusual activity reaches you quickly, ideally through email or push notifications rather than SMS alone. Review your statements regularly. The sooner you catch an unauthorised transaction, the more likely it can be stopped or reversed.
If You Have Already Been Hit
Discovering a SIM-swap in progress is stressful, but a clear order of actions limits the damage. First, contact your telco to regain control of your number and stop further interception. Second, from a device you trust, change the passwords on your email and bank accounts and switch on non-SMS two-factor authentication. Third, contact your bank through its official channel to flag any suspicious transactions and, if needed, freeze cards or accounts.
Report the incident to the Police through the official i-report channel or the anti-scam helpline, and register the details with ScamShield. Look up these official contacts yourself rather than using any number in a suspicious message. Keep a record of what happened, including dates, times and any reference numbers, as this helps with investigations and any bank disputes.
A SIM-swap can feel like a violation, but it is recoverable. By understanding how the scam works, watching for that tell-tale loss of signal, and moving your security away from SMS, you turn your mobile number from a weak point into a well-defended one.
Explore more
Two-Factor Authentication Guide
Using ScamShield and Singapore’s Anti-Scam Tools
Recovering a Hacked Account
Cybersecurity Basics
Frequently Asked Questions
Can someone do a SIM swap with only my phone number? A phone number alone is not enough. Criminals usually need personal details such as your name, NRIC details and date of birth to pass identity checks. That is why guarding that information, and being wary of phishing, makes you a much harder target.
How do I know if my number has been ported without my consent? The usual sign is sudden loss of signal while others nearby still have coverage, often with no calls or texts getting through. You might also get a message about a SIM change you did not request. Contact your telco through an official channel straight away.
Is an authenticator app safer than SMS OTP? Generally yes. An authenticator app generates codes on your own device, so a criminal who takes over your number still cannot read them. SMS codes travel through your number, which is exactly what a SIM-swap hijacks. Use the app wherever a service offers it.
Will my bank refund me if I lose money to a SIM swap? There is no guarantee. Whether you are reimbursed depends on your bank’s assessment of what happened and its terms. Report to the bank immediately through its official channel, keep records of times and reference numbers, and ask the bank what its process is.
What should I do first if my phone suddenly shows no service? Restart the phone, then check whether people nearby on your network have signal. If you are the only one without service, call your telco on its official number or use another device to reach it, and then secure your bank and email passwords.