SIM Bank Fraud Guide: First Hour Steps [2026]

sim swap fraud empties a bank account in minutes: a duplicate SIM goes live in a fraudster’s phone, your SIM dies, and your OTPs start arriving in the wrong hands. The first hour decides what can still be caught.

The Signs: Is This a Swap?

The first sign is visible: your phone shows no service while nearby phones on the same network still have signal. A duplicate SIM is live somewhere else; the SIM in your hand is dead. Calls and SMS stop arriving, including the OTPs and bank alerts you depend on.

Then the aftershocks: the app logs you out, an alert reports a password or limit change you never made, or money moves; one Karachi case saw over 100 unauthorised transactions overnight. Use a second phone. Behind it sits a defeated biometric step (harvested fingerprints, a bribed retailer, leaked records), or a spoofed bank UAN call: PTA warned in January 2026 that official UANs are never used for outgoing calls.

The First Hour, In Order

1. Freeze the money first. Call your provider: JazzCash on 4444 (111-124-444 from other networks), Easypaisa on 3737 (or 111-003-737). Ask for channels blocked, a fraud dispute raised, and the complaint number (the dispute clock starts here). For a bank, use only the number on your card, in the app or on the bank’s website, never one from an SMS.
2. Block the SIM in parallel: have the operator kill the duplicate and take the number back. Jazz gives *8822# or 111 from any Jazz number, free; a replacement (Rs 550) needs your fingerprint in person, and no ownership change for 30 days after a duplicate. Report it for blocking within 24 hours.
3. Lock down. From a safe device, change banking and email passwords, turn on app based two factor, and warn close contacts. Screenshot every alert, SMS, call log and transaction ID.
4. Report to NCCIA the same day. Reported channels: portal complaint.nccia.gov.pk, helpline 1799, helpdesk@nccia.gov.pk. Filing generates the reference number.
5. Complain to PTA. The swap itself broke issuance rules: file at complaint.pta.gov.pk or on 0800-55055 (RAABTA WhatsApp 0315-0055055).

Refund Rules: What SBP Actually Says

SBP’s BPRD Circular No. 04 of 2023 is the framework: a bank or microfinance bank that failed the security controls must compensate victims within 3 working days of the report. Its controls include immediate FTDH dispute raising and a 2 hour hold on cash out from incoming wallet transfers.

The annexes add the clocks, as published: dispute and lien within 30 minutes, investigation inside 10 days, reversal within 3 days once fraud is established. SBP’s FAQ states the no weakness rule: no shared credential, no self-performed transaction, no liability. Sharing an OTP weakens a claim but not automatically: the President upheld the Banking Mohtasib against UBL (Rs 79,500 plus profit) where the bank activated IBFT without consent. No promise attaches.

Escalation: Mohtasib, Sunwai, and the Wallet Trap

If the bank’s answer fails, escalate in writing. Under section 82D of the Banking Companies Ordinance (SBP’s Sunwai page), the bank gets 45 days to respond; you then have 45 more to file with the Banking Mohtasib, free, no lawyer needed. A claimed cut to 30 days circulates online; both sources still say 45, so treat it as unverified.

Now the trap. Microfinance banks sit outside the Mohtasib’s jurisdiction per SBP, and JazzCash (Mobilink Microfinance Bank) and Easypaisa run on microfinance licences. Wallet users escalate to SBP through Sunwai (sunwai.sbp.org.pk), not the Mohtasib. For covered banks the route delivers: 27,753 complaints disposed of in 2024, Rs 1.65 billion in relief.

The October 2026 Cases (and Prevention That Works)

The October 2026 cases: MNA Farhan Chishti (Rs 1.5 million), MNA Shaharyar Mahar (Rs 2 million) and Sunny Kumar (about Rs 8.5 million) lost money to unauthorised duplicates. PTA fined the operator Rs 77.8 million per case under SAV Regulation 4(4), rejected the retailer was deceived defence, and banks were ordered to reimburse.

Prevention: banks state they never ask for an OTP, and staff must not ask you to say one aloud; any caller who does is a fraudster. Take helpline numbers only from your card, app or the bank’s site, and keep transaction alerts on. One honest negative: SIM lock services and swap delay periods exist in no operator’s published material.

FAQs

How do you tell if your SIM has been swapped?

No service while nearby phones have signal; calls, SMS and OTPs stop.

Can someone swap my SIM without my fingerprint?

Not legitimately: replacement needs your live fingerprint in person. Fraud uses harvested prints or leaked records.

How do I block a Jazz number that has been swapped?

Dial *8822# or call 111 from any Jazz number: free and immediate.

Can I get my money back after SIM swap fraud?

Sometimes, where the bank failed SBP’s controls and fraud is established. Cashed out money usually cannot be reversed.

How fast must my bank raise a fraud dispute in Pakistan?

Immediately; the annexes put dispute and lien at 30 minutes each.

Can my bank refuse a refund if I shared my OTP?

It can resist, and most are. Report anyway: a bank’s own breach has carried cases (UBL).

Does this cover JazzCash and Easypaisa wallets?

Yes, but wallets escalate to SBP Sunwai, not the Mohtasib: microfinance banks sit outside it.

What if the money was already cashed out?

Usually: reversal fails once cash is withdrawn; only the liability route remains.

Which authority handles SIM swap fraud in Pakistan: PTA, NCCIA, or police?

NCCIA the crime, PTA the operator’s failure, your provider the money. No FIR first.

SIM swap fraud ho jaye to sab se pehla step kya hai?

Dusre phone se provider ko call karke freeze karwayein: JazzCash 4444, Easypaisa 3737. Phir SIM block, NCCIA aur PTA report.

Conclusion

Freeze, kill the SIM, build the record, and let SBP’s framework allocate the loss. Unknown SIMs on your CNIC are next: run the 668 check, disown what you do not recognise. This page is general information about rules and processes, not financial or legal advice for a specific case.