SIM swap fraud occurs when someone fraudulently takes control of your mobile phone number by having it transferred to another SIM or eSIM. If that number is linked to mobile banking, the attacker may receive SMS verification codes, password-reset messages or account-recovery calls. They could use that access alongside stolen credentials or weaknesses in account recovery to attempt unauthorised transactions.
In Nigeria, where phone numbers are frequently linked to bank alerts, USSD services, wallets and online accounts, the risk can extend well beyond missed calls. But SIM swapping does not automatically unlock every banking app: many financial institutions use additional device, PIN or authentication controls. The danger depends on how a particular service verifies identity.
This guide explains how the attack works at a high level, warning signs, Nigeria's SIM-replacement protections, steps to take if your line suddenly stops working, and the role of the Nigerian Communications Commission (NCC), Central Bank of Nigeria (CBN) and police in complaints. Research verified on 3 November 2026.
What is SIM swapping, and why does mobile banking matter?
A legitimate SIM replacement allows you to keep your number after losing a phone, damaging a card or changing devices. A fraudulent SIM swap happens when the process is initiated without the real subscriber's permission. The phone number then becomes active on a SIM or eSIM controlled by somebody else, and the original SIM may stop receiving normal mobile service.
The NCC's August 2026 consumer guidance identifies unauthorised SIM swaps as a risk because phone numbers are tied to banking, email and other digital services. The FBI's account-takeover advisory similarly explains how criminals may impersonate subscribers to obtain control of their numbers and then target verification systems.
A number can be used to receive transaction alerts, identify a customer during support calls, reset an account password, or authorise certain actions through SMS. Those functions are convenient, but they create risk if control of the number is mistaken for proof that the genuine customer is present.
How SIM swap fraud targets bank accounts
SIM swap attacks often involve more than one weakness. The following is a simplified defensive explanation, not a set of instructions for carrying out an attack:
- Information about the subscriber is exposed. A criminal may gather personal details through phishing, impersonation, breached records or conversations.
- The number is transferred without proper authorisation. The attacker deceives or compromises a process intended for legitimate SIM replacement or subscriber-account changes.
- The victim's original line may lose service. Voice calls and SMS linked to the number may begin arriving on the attacker-controlled SIM.
- Other online accounts are targeted. The attacker may attempt password recovery, access to previously stolen credentials or approval of actions that depend on SMS codes.
- Financial harm may follow. If other security controls fail, a criminal may initiate or facilitate unauthorised transactions.
The important qualification is that possession of a mobile number alone may be insufficient. An attacker might still need a password, an app PIN, access to a registered device or to overcome other checks. Good banking security should not rely solely on possession of an SMS-receiving number.
Phishing is frequently part of the broader problem. FlyingEze previously covered a CBN warning about fake emails and links targeting bank customers . A suspicious text may be an attempt to obtain confidential data even when no SIM swap has occurred.
Seven warning signs you should investigate
One warning sign is not proof of fraud. A local outage, device setting, damaged SIM or network-maintenance event can produce similar symptoms. But several indicators together deserve immediate attention.
| Warning sign | Why it matters | What to check |
|---|---|---|
| Your phone unexpectedly shows “No Service” | Your original SIM may have lost network registration | Check other phones on the same network, then contact the operator |
| Calls and SMS stop arriving | Your number may no longer be active on your SIM | Ask the operator whether a SIM replacement or porting action occurred |
| Unexpected SIM activation notice | Some providers notify users about sensitive account changes | Use the provider's official contact channel, not a link in the message |
| Bank OTPs or recovery attempts you did not request | Someone may be attempting account access | Notify the affected bank; do not share or approve codes |
| Unknown password-reset emails | Linked email or financial accounts may be targeted | Inspect account sessions and recovery settings from a trusted device |
| Unauthorised transactions or new beneficiaries | Financial access may already be compromised | Contact the fraud team immediately and request account safeguards |
| A carrier says your number was replaced without your request | This is substantial evidence of an account change requiring investigation | Obtain a complaint reference and request urgent restoration |
The US Federal Trade Commission's SIM-swap consumer alert also identifies unexpected service loss and notice of activation on another device as possible indicators. Do not dismiss unexplained loss of service when a banking or account-recovery warning appears around the same time.
What to do immediately if you suspect a SIM swap
Contact your telecom operator and your financial institutions as parallel priorities. Do not wait to regain mobile service before protecting money. The order below is a practical emergency workflow, not a guarantee of recovery within a specific number of minutes.
- Use a trusted alternative connection. Borrow a trusted phone to call official support, or use a secure device and Wi-Fi. Avoid unknown recovery links and random social-media numbers.
- Alert your mobile operator. Report a suspected unauthorised SIM replacement or port-out, ask whether the number has been moved, request appropriate suspension or protection, and obtain a case number.
- Contact each affected bank or wallet. State that your registered mobile number may be compromised. Ask for immediate fraud-risk controls, review of recent activity and restrictions appropriate to the account.
- Secure your primary email. On a trusted device, change a compromised password, remove unfamiliar sessions, review recovery methods and enable stronger authentication.
- Protect other linked accounts. Review messaging apps, e-commerce accounts, social-media profiles and other financial services for unexpected sign-ins or recovery changes.
- Preserve evidence. Keep carrier notices, service-loss times, account alerts, transactions, complaint numbers and communications. Record the full timeline.
- Report suspected criminal activity. If identity theft or financial loss occurred, submit an appropriate complaint to law enforcement and continue pursuing the banking and telecom investigations.
Ask your bank whether it can apply a temporary transaction restriction or other controls suited to your circumstances. Do not assume that removing SMS verification from one account automatically protects all linked accounts.
How to regain control of your Nigerian phone number
Start with the operator's legitimate customer-care service or an authorised service centre. Tell them that you did not authorise a SIM replacement, if accurate, and request investigation and restoration of the line. Ask the operator to preserve records relevant to the disputed SIM change and provide a complaint ticket.
Nigeria's SIM-replacement policy requires presentation of a National Identification Number (NIN), effective NIN verification through NIMC and compliance with applicable NCC guidelines. These safeguards are intended to reduce unauthorised replacement, but a NIN-linked SIM should not be described as impossible to compromise.
Only submit identity information through an authentic operator service point or approved portal. Do not send a photo of your NIN slip, bank details or biometric information to someone offering to “restore your line” on an unrelated WhatsApp account.
If your dispute is not resolved by the telecom provider, the NCC consumer complaints procedure directs subscribers to escalate through the NCC, including its 622 toll-free line or consumer portal. The operator's ticket number and your records will be useful.
What Nigeria's 2026 TIRMS initiative changes—and what it does not
A significant development is the NCC's Telecommunications Identity Risk Management System (TIRMS). In guidance published on 31 August 2026, the NCC described a system that allows authorised telecommunications and other approved service providers to check information about a phone number's status, including whether it has been swapped, churned, blacklisted or reassigned.
The purpose is to help organisations, including eligible banks and fintechs, identify elevated risk before sensitive account activities. For example, a financial service may use an available, authorised number-status check to decide that it should perform further verification after a recent SIM change. Read the NCC's TIRMS explanation .
Consumers should understand three limits. First, TIRMS is described as a service for authorised organisations, not a public website where everyone can look up another person's swap history. Second, the official guidance describes a preventive risk-management capability; it does not establish that every Nigerian bank uses it for every transaction. Third, detecting a recently swapped number does not automatically recover stolen funds or resolve who was responsible.
In short, TIRMS can support safer identity checks, but individuals still need to protect their accounts and report suspicious changes promptly.
SIM swap versus other mobile-number threats
Not every phone-related attack is a SIM swap. Distinguishing them helps consumers describe the incident accurately and helps providers investigate the correct system.
| Threat | What changes | Typical defensive focus |
|---|---|---|
| Unauthorised SIM swap | The number is moved to another SIM or eSIM | Carrier account controls, change verification and rapid reporting |
| Port-out fraud | The number is fraudulently transferred to another operator | Porting safeguards and identity verification |
| Phone theft | The physical device is taken | Device lock, remote account protection and SIM blocking |
| Phishing or fake bank support | Passwords, codes or personal information are disclosed | Independent verification and stronger authentication |
| Recycled-number risk | A previously used number is legitimately reassigned | Keeping recovery details current and account re-verification |
| Rogue mobile-network interception | Communications may be intercepted without a legitimate SIM transfer | Network and account security; do not assume a SIM swap occurred |
The NCC issued a separate 2026 advisory concerning rogue cellular networks and SMS-based banking fraud . Such attacks are distinct from a fraudulent SIM replacement, even though both highlight why SMS alone is a weak foundation for sensitive account security.
How to reduce the risk of SIM swap fraud
1. Ask your operator about subscriber-account protection
Use only your operator's official app, website or authorised centre to review account security. Ask whether an additional account PIN, replacement notification or verification process is available, and ensure registration details are accurate. A phone's screen-lock PIN or SIM-card PIN is not the same as a carrier account PIN; it may not prevent a fraudulent replacement performed through the operator.
2. Use stronger authentication where services support it
For important email and online accounts, prefer passkeys or hardware security keys when supported. Authenticator apps are generally less vulnerable to SIM-swap interception than SMS codes, although authenticator codes can still be phished. The FTC's two-factor-authentication guidance explains these differences.
Some Nigerian banking services still require SMS for particular workflows. Do not disable an essential recovery route without setting up a supported replacement. Review all fallback and recovery settings; moving normal sign-in to a stronger method may not remove an SMS-based recovery weakness.
3. Secure your primary email and device
Email often controls password recovery for several other accounts. Give it a strong, unique password, secure recovery methods and updated device protections. Keep your phone operating system and apps updated, install apps from trusted sources and avoid giving strangers remote access to your screen.
4. Limit avoidable exposure of sensitive details
Be wary of unsolicited calls claiming to be from a mobile operator, bank or identity agency. Do not disclose OTPs, bank PINs, account passwords or identity documents through unverified conversations. A person knowing your name or phone number does not prove they represent an institution.
5. Monitor financial activity independently of SMS
Check balances and transactions inside official bank apps or verified web services, not solely through messages sent to your phone number. Enable in-app or email alerts where trustworthy options exist. Consider suitable transaction limits and ask your bank about controls for unusually large payments or new beneficiaries.
6. Keep recovery information current
When changing numbers, update financial institutions and other important services promptly. An old number that is later reassigned can create a different form of account-recovery risk. The NCC's TIRMS guidance specifically addresses number reassignment and recommends promptly updating service providers.
Who should handle each part of a SIM swap complaint?
| Organisation | Main responsibility | First action |
|---|---|---|
| Mobile network operator | Investigate line replacement and restore subscriber control | Report unauthorised SIM change and get a ticket |
| Bank or licensed wallet provider | Investigate account access, payments and financial fraud | Request urgent fraud review and account protection |
| NCC | Telecom consumer complaints and operator oversight | Escalate after contacting the operator, using 622 or the official portal |
| CBN | Complaints about regulated financial institutions | Escalate unresolved bank/provider complaints under applicable rules |
| Nigerian Police cybercrime unit | Investigate suspected cybercrime and identity fraud | File a report with evidence and reference numbers |
The NCC's legal and regulatory FAQ is unusually explicit about the division: the regulator handles the telecommunications side of an unauthorised SIM swap, while CBN-regulated institutions handle the financial fraud dispute. The NCC also cautions that the allocation of liability in these cases can be contentious. Do not assume the mobile operator or the bank is automatically liable for every loss without an investigation.
For an unresolved complaint against a financial institution, the CBN complaint guide directs consumers to report to the institution first and, in the ordinary process, allows escalation after the relevant complaint-resolution period. This is not a reason to wait before alerting the bank to an active fraud risk. The official CBN complaint portal requires a bank complaint reference for case tracking.
Suspected criminal conduct may also be reported to the Nigeria Police Force National Cybercrime Centre . Provide the evidence you have, including the number involved, time of lost service, operator complaint, unauthorised account changes and disputed transactions. Recovery or criminal investigation outcomes cannot be guaranteed.
What evidence should you preserve?
Make a short, chronological incident record. Include when network service stopped; whether friends on the same operator also lost service; the last successful call or text; any unauthorised SIM-change notification; bank or email recovery messages; suspicious transfers; and the time you first contacted support.
Save the carrier complaint number, bank case number, statements, screenshots and relevant correspondence. Avoid altering timestamps or forwarding private financial records to an unofficial “SIM recovery specialist”. If an investigator requests original documents, provide them through verified channels.
When speaking with support, use precise language: “My registered phone number stopped working unexpectedly, and I did not request a SIM replacement. Please check whether a SIM or eSIM change occurred, secure the line and issue a complaint reference.” This is more useful than claiming a confirmed swap before the operator checks.
Frequently asked questions
Can someone steal my money with only my phone number?
Knowing a number alone is generally not sufficient to access a properly protected banking account. The concern is that a fraudulently controlled number can be combined with stolen login details, weak recovery procedures or other compromised factors.
Does “No Service” mean my SIM has been swapped?
No. A network outage, faulty SIM, coverage issue or device configuration can also cause service loss. Investigate quickly, especially if banking or account-recovery warnings appear, but ask the operator to verify whether an unauthorised change occurred.
Will linking my SIM to NIN completely stop fraud?
No. NIN verification is an important safeguard in Nigerian SIM replacement policy, but it does not eliminate all risks from deception, compromised processes or weak controls in connected accounts.
Can an eSIM be targeted?
Yes. The security issue is unauthorised control of the subscriber's mobile number, which may occur through physical SIM replacement or an improper eSIM/account transfer. Technical procedures vary by operator.
Is SIM swap fraud the same as a scammer asking me to send a bank transfer?
No. A SIM swap is a phone-number takeover. A scam-induced payment is a transfer the victim approves because of deception. They require overlapping but different reporting details, and neither automatically entitles a victim to a refund.
Should I report to the NCC or the bank first?
Contact the mobile operator and bank immediately when both the number and money are at risk. The NCC provides escalation for an unresolved telecom complaint; the CBN provides escalation concerning regulated financial institutions. Criminal reports can proceed in parallel.
Conclusion: Treat your mobile number as a valuable account credential
SIM swap fraud matters because the mobile number connected to a Nigerian bank account can influence SMS verification, alerts and account recovery. A fraudulent transfer of that number may create an opening for account takeover, especially when other credentials or security processes are weak.
The strongest response is layered: secure your telecom account, strengthen email and financial authentication, monitor transactions independently of SMS, and act quickly when unexpected service loss coincides with suspicious account activity. Nigeria's TIRMS initiative gives authorised service providers an additional way to assess number-related risk, but consumers still need to report incidents and keep recovery information current.
If you suspect a swap now, do not wait for a confirmed financial loss: report the unexplained number change to your operator and alert your bank through genuine contact channels.
