Your phone drops to "No service" at 2 p.m. You assume it's the network, as usual. By evening, your account is empty, and the person who emptied it never touched your phone. That is the typical shape of a SIM swap attack, and the first clue is often a dead signal that you ignore.
This guide explains how SIM swap fraud works, the warning signs, and a practical lockdown routine you can finish in about an hour. It is general information. Procedures differ by bank and network, so confirm details with your own provider.
What a SIM swap is and why it works
A SIM swap happens when someone gets your phone number moved onto a SIM card they control. Telcos do this legitimately when you lose a phone. Fraudsters do it by tricking an agent, bribing an insider, or using personal details they have already collected about you.
Once they own your number, they receive your calls and SMS. That includes one-time passwords (OTPs), "forgot PIN" codes and bank alerts. Many Nigerian bank apps, wallets and email accounts still treat your phone number as proof that you are you. The fraudster doesn't need to hack the bank. They only need your number plus a few details.
Those details usually come from somewhere ordinary: a phishing link, a fake "update your BVN" call, a leaked document, or things you posted publicly, such as your birthday and full name.
Warning signs that you may be a target
- Sudden loss of network while others around you on the same line still have signal. Your phone shows "Emergency calls only" or "No service" for no clear reason.
- Calls or messages from "your bank" or "your network" asking you to confirm your date of birth, BVN, mother's maiden name or an OTP "to avoid deactivation".
- Unexpected SMS saying a SIM replacement or number porting request is in progress.
- Password reset emails you didn't request, for your email, social media, or fintech apps.
- Repeated missed calls or silent calls that seem designed to make you switch off or answer something.
- Bank alerts stop arriving even though you know you've had transactions.
No single sign proves a swap. But no service plus any other sign on this list means you should act immediately, not wait to see if it fixes itself.
What to do in the first hour if you think it's happening
- Borrow a phone and call your bank. Use the number printed on your card or on the bank's official website, not one sent by SMS or found in a random post. Ask them to freeze or restrict your account and block transfers.
- Contact your network provider from a shop or another phone. Ask whether a SIM replacement was done on your line, and ask them to block the new SIM.
- Change your email password first, from a safe device, then the passwords for banking, fintech and exchange apps. Email is the master key for resets.
- Log out of all sessions on email and social accounts if the option exists.
- Write down times and details: when service dropped, which transactions happened, and who you spoke to.
- Report formally. Our guide on how to report a scam in Nigeria covers the steps and the records to keep.
Speed matters because money moved through instant transfers is hard to pull back. Banks can sometimes act faster if the receiving account is still holding funds.
A lockdown routine for your accounts
1. Add protection that doesn't depend on SMS
Where an app offers it, use an authenticator app or the bank's in-app token instead of SMS codes. Turn on biometric login on your phone. If your bank only supports SMS OTP, ask whether it offers a hardware or app token.
2. Secure your email like it's your bank
Use a long, unique password and two-step verification that is not SMS if possible. Check recovery options and remove old phone numbers or emails you no longer control.
3. Set transaction limits
Most banks let you cap daily transfers in the app or by request. If you usually move ₦50,000 a day, a ₦100,000 limit means a thief can't clear a ₦2 million balance in one go. You can raise it temporarily when you need to pay for something big.
4. Separate your savings from your spending account
Keep your day-to-day money in one account with a modest balance. Keep savings in another account, ideally one not linked to the same phone number or app. Even a well-prepared attacker then reaches only part of your money.
5. Ask your telco about SIM protection
Ask whether your network lets you add a PIN or passcode to SIM replacement requests and what ID is required. Policies change, so ask for the current procedure rather than relying on what a friend heard.
6. Reduce what strangers can learn about you
Remove your birthday, phone number and bank details from public profiles. Never post pictures of your NIN slip, BVN or ID card.
Worked example (hypothetical)
Ada, a freelance designer in Lagos, keeps ₦900,000 in one bank account and receives a daily limit of ₦1,000,000 by default. One morning her signal disappears. She assumes it's the network and goes back to work.
Meanwhile, a fraudster who got her BVN and birthday through a fake "verification" call has moved her number to a new SIM. They reset her banking app PIN through SMS and send out ₦900,000 in several transfers.
Now compare a second version. Ada keeps ₦100,000 in her spending account, has a ₦150,000 daily limit, and her savings sit in another bank. She also notices the signal loss, borrows a neighbour's phone and calls her bank within 20 minutes. The worst case is ₦150,000 gone, and the bank has a fair chance of catching it. Same attack, very different outcome, mostly because of preparation.
Common mistakes
- Giving an OTP to "customer care". Real bank staff don't need your OTP, PIN, or full card details. Hang up and call the official number.
- Waiting for the network to "come back". Check with a second phone within minutes.
- Calling numbers from social media comments. Fake support accounts reply to complaints and offer "help". See how this ties into fake recovery agents who target victims twice.
- Using one password everywhere. One leak then opens everything.
- Linking every account to one number. If that number is taken, everything falls together.
- Sharing a screenshot of a bank alert with strangers. It can contain balance and account details.
How the advice differs by country
In Nigeria, SIMs are tied to NIN and your network's records, and bank apps often rely on SMS OTP. In Ghana and Kenya, mobile money wallets such as MoMo or M-Pesa are tied to your number, so a swap can put your wallet at risk as well as your bank account. Set a wallet PIN you never share and ask your provider about SIM replacement safeguards. In South Africa, banks commonly use in-app approvals, but SIM swap is still a known risk, so keep your app approvals tied to a device you control. Always check with your own bank and telco for current rules.
Frequently asked questions
Can someone swap my SIM without my NIN?
Not legitimately, but fraudsters can use insiders, forged requests or personal data they've gathered. Don't assume ID rules alone protect you.
Will my bank refund me?
It depends on the facts, the bank's investigation and any regulator rules. Report immediately, keep records, and escalate in writing if you get no response.
Should I keep my main number private?
Yes, where possible. Use a separate number for banking and don't use it for social media or sign-ups.
Is a dual-SIM phone riskier?
Not by itself. The risk lies in what each number is connected to.
Your next step today
Open your main bank app now and check your daily transfer limit. Then log in to your email and confirm that the recovery phone number and backup email are ones you still control. Those two checks take ten minutes and close the biggest gaps.
This article is for general information only and is not financial, legal, or tax advice. Prices, rates and rules change quickly, so check current details before making money decisions.