My SIM was swapped without my knowledge and my bank account was emptied, what now?

Question

My phone suddenly lost network, and I later found out someone had my SIM swapped/duplicated and used it to access my bank account. I have been reading conflicting things online and I would like to understand what Indian law actually says about this, which Act and Section applies, what the realistic timelines and costs are, and what I should be doing right now to protect my position. If the matter can be resolved without litigation I would prefer that route, but I want to know what my rights are before I agree to anything or sign any document.

MyVakeel Legal Desk · Accepted Answer

My SIM was swapped without my knowledge and my bank account was emptied, what now? is governed in India primarily by Information Technology Act, 2000 – Section 66C, Information Technology Act, 2000 – Section 66D, RBI Circular on Customer Liability, 2017 and Telecommunications Act, 2023. The short answer is set out below, followed by the practical steps most people in this situation need to take. Read it alongside the specific provisions named, because the exact relief available to you turns on the facts you can prove on paper.

SIM swap fraud typically involves a fraudster obtaining a duplicate SIM through social engineering of the telecom operator, then using OTPs sent to that SIM to access your bank account — this is identity theft under Section 66C and cheating by personation under Section 66D of the IT Act.

Telecom operators are required under DoT/TRAI guidelines and now the Telecommunications Act, 2023 framework to verify identity strictly before issuing duplicate SIMs, and a lapse on their part can be flagged to TRAI/DoT separately from the criminal complaint.

Since you did not authorise the SIM swap or the resulting transactions, the RBI's zero-liability circular should apply if you report the unauthorised transactions to your bank within 3 working days of noticing them (typically from when you realise your SIM has stopped working).

File a complaint with your telecom operator to immediately block/deactivate the fraudulent duplicate SIM and preserve their KYC records used for the swap, since this evidence identifies who requested the duplicate.

Report at cybercrime.gov.in/1930 immediately, and separately lodge a complaint with the telecom ombudsman/DoT if the operator was negligent in verification.

What to do next: 1) Contact your telecom operator immediately to block the fraudulent SIM and restore yours; 2) Report to your bank in writing within 3 working days citing the RBI zero-liability circular; 3) File a complaint at cybercrime.gov.in or call 1930; 4) Complain to TRAI/DoT if the operator issued the duplicate SIM without proper verification.

If the other side has already issued a notice, filed a case or set a deadline, treat the matter as time-sensitive — most remedies under Information Technology Act, 2000 – Section 66C carry limitation periods, and a delay you cannot explain weakens an otherwise strong case. You can post the details on the MyVakeel forum for a practising advocate to review, or book a paid consultation with a Bar Council verified lawyer in this practice area.