My SIM was swapped without my knowledge and my bank account was emptied, what now?

Question

My phone suddenly lost network, and I later found out someone had my SIM swapped/duplicated and used it to access my bank account. Specifically, I want to know how Information Technology Act, 2000 – Section 66C applies to a situation like mine and what the cyber law position in India actually is. If there is a deadline I should be aware of, I need to know that now.

MyVakeel Legal Desk · Accepted Answer

My SIM was swapped without my knowledge and my bank account was emptied, what now? is governed in India primarily by Information Technology Act, 2000 – Section 66C, Information Technology Act, 2000 – Section 66D, RBI Circular on Customer Liability, 2017 and Telecommunications Act, 2023. Outcomes in sim swap fraud disputes depend heavily on documentation, so check what you can actually evidence as you read.

SIM swap fraud typically involves a fraudster obtaining a duplicate SIM through social engineering of the telecom operator, then using OTPs sent to that SIM to access your bank account — this is identity theft under Section 66C and cheating by personation under Section 66D of the IT Act.

Telecom operators are required under DoT/TRAI guidelines and now the Telecommunications Act, 2023 framework to verify identity strictly before issuing duplicate SIMs, and a lapse on their part can be flagged to TRAI/DoT separately from the criminal complaint.

Since you did not authorise the SIM swap or the resulting transactions, the RBI's zero-liability circular should apply if you report the unauthorised transactions to your bank within 3 working days of noticing them (typically from when you realise your SIM has stopped working).

File a complaint with your telecom operator to immediately block/deactivate the fraudulent duplicate SIM and preserve their KYC records used for the swap, since this evidence identifies who requested the duplicate.

Report at cybercrime.gov.in/1930 immediately, and separately lodge a complaint with the telecom ombudsman/DoT if the operator was negligent in verification.

What to do next: 1) Contact your telecom operator immediately to block the fraudulent SIM and restore yours; 2) Report to your bank in writing within 3 working days citing the RBI zero-liability circular; 3) File a complaint at cybercrime.gov.in or call 1930; 4) Complain to TRAI/DoT if the operator issued the duplicate SIM without proper verification.

If you are unsure whether your facts fall inside Information Technology Act, 2000 – Section 66C, that is worth checking with an advocate before you commit to a route, because switching later costs time. You can post the details on the MyVakeel forum for a practising advocate to review, or book a paid consultation with a Bar Council verified lawyer in cyber law.