Account Takeover and SIM-Swap Fraud: Detection and Response for Indian Businesses

Account takeover (ATO) fraud occurs when a criminal gains control of a genuine account, such as a bank login, email mailbox, payment app or vendor portal, and uses it as if they were the owner. SIM-swap fraud is one of the most effective ways to achieve this in India, because it lets the fraudster receive the one-time passwords (OTPs) that are meant to stop them. For businesses, the answer lies in spotting the early signals and responding within hours, not days.

This guide covers how ATO and SIM swaps work, the signals that reveal them, the RBI rules on who bears the loss, and the legal provisions that apply.

What is account takeover fraud?

Account takeover is a family of attacks rather than a single technique. The criminal's aim is to pass as the legitimate user, which means defeating whatever proves identity: a password, an OTP, a device check or a security question.

Common routes include:

• Credential theft through phishing pages, fake KYC-update messages or malicious apps.
• Credential stuffing, where passwords leaked from one service are tried on others.
• Malware and remote-access tools that let the attacker operate the victim's own device.
• SIM swap, which redirects the victim's mobile number to a SIM the fraudster controls.
• Insider assistance, where an employee at a bank, telecom outlet or the victim organisation leaks data or approves changes. This overlaps with insider threat.

Once inside, attackers typically change contact details first, so alerts go to them, then add beneficiaries, raise limits and move money. In corporate settings, a taken-over email account is the starting point for business email compromise.

How does a SIM-swap fraud work?

A SIM swap exploits the trust placed in a mobile number.

1. The fraudster gathers personal data about the target, often from earlier phishing, data leaks or social media.
2. Using forged identity documents or a complicit insider, they obtain a replacement SIM for the victim's number.
3. The victim's phone loses signal. Many people assume it is a network fault.
4. The fraudster now receives SMS OTPs and calls, resets banking and email passwords, and authorises transactions.

What protections have telecom regulators added?

Indian regulators have narrowed the window for this attack. The Department of Telecommunications instructed operators in September 2022 that, after a SIM swap or replacement, incoming and outgoing SMS on the new SIM are barred for 24 hours. TRAI's Mobile Number Portability (Ninth Amendment) Regulations, 2024, effective 1 July 2024, prevent a unique porting code being generated within seven days of a SIM swap or replacement, which blocks quick porting of a hijacked number to another operator.

These rules help, but they do not remove the risk. A fraudster who has planned ahead can still act after the barring period, and many attacks bypass SIMs entirely.

What signals help detect account takeover?

No single signal proves ATO. Detection works by correlating several weak signals quickly.

For banks and payment businesses, these signals belong in transaction-monitoring rules. For other companies, the most practical controls sit in finance and IT: alerts on changes to bank details, alerts on new mailbox rules, and a simple rule that anyone whose phone suddenly loses signal tells IT at once.

Who bears the loss: RBI customer-liability rules

Liability for unauthorised electronic banking transactions in India has been governed by RBI's circular of 6 July 2017, “Customer Protection – Limiting Liability of Customers in Unauthorised Electronic Banking Transactions”. On 24 June 2026 RBI issued new Directions for commercial banks, which apply to transactions on or after 1 January 2027.

The 2026 Directions also introduce a small-value fraud compensation for gross losses up to INR 50,000 reported within five days, paying the lower of 85% of net loss or INR 25,000, once in a lifetime. They make SMS alerts mandatory for electronic banking transactions above INR 500 and encourage customers to report both to the bank and to the national cybercrime helpline 1930. The new Directions apply to commercial banks other than small finance banks, payments banks, regional rural banks and local area banks.

Two practical points follow for businesses. First, reporting speed directly affects who bears the loss, so the internal path from “something is wrong” to “bank notified” must be short. Second, a customer who shared an OTP or password is likely to bear the loss, which is why credential hygiene training matters. Liability in a specific case depends on the facts and the bank's policy, and may need legal advice.

What does Indian law say about account takeover?

The Information Technology Act 2000 contains the main offences:

• s. 66C (identity theft): fraudulently or dishonestly using another person's electronic signature, password or other unique identification feature. Up to three years' imprisonment and a fine of up to INR 1 lakh.
• s. 66D (cheating by personation using a computer resource): up to three years and a fine of up to INR 1 lakh.
• s. 66 read with s. 43: dishonest or fraudulent unauthorised access, data copying or damage.

Depending on the facts, prosecutors may also use cheating and forgery provisions of the Bharatiya Nyaya Sanhita 2023, which replaced the Indian Penal Code on 1 July 2024.

Organisations covered by CERT-In's Directions of 28 April 2022 must report listed incidents, which include identity theft, spoofing and phishing attacks and unauthorised access to social media accounts, to CERT-In within six hours of noticing them. Those Directions also require ICT logs to be retained securely for a rolling 180 days within India, which is essential for any later investigation.

How should a business respond to a suspected takeover?

The first hours determine both recovery and evidence. A workable sequence:

1. Contain. Freeze affected accounts, revoke sessions and tokens, reset credentials from a clean device, and contact the mobile operator if a SIM swap is suspected.
2. Notify the bank and report. Ask the bank to stop or recall payments and flag beneficiary accounts. Report on 1930 or cybercrime.gov.in.
3. Preserve evidence. Export authentication logs, mailbox audit logs, device records and transaction trails before they roll over. Maintain a chain of custody record for anything collected.
4. Assess regulatory duties. Check CERT-In reporting, sectoral rules and contractual notice obligations to customers or partners.
5. Investigate root cause. Establish how credentials were obtained, whether an insider was involved and whether other accounts are exposed.
6. Fix and verify. Replace SMS OTPs for high-value approvals with stronger authentication, tighten change-of-details controls and test them.

Digital forensics helps answer the questions that matter later: which device was used, when access began, what was changed and whether data was taken. Our guide to preserving digital evidence in internal investigations explains imaging and hashing, and our post on business email compromise response covers payment-redirection cases in detail. For the rules banks must follow on fraud, see RBI's fraud risk management directions.

How Spectra Forensics can help

Spectra Forensics brings 19+ years of investigative work and experience across 10+ countries to cyber-enabled fraud. Our digital forensics and eDiscovery service covers evidence preservation, log and device analysis and reconstruction of how an account was compromised. Our forensic accounting and data analytics service covers tracing the flow of funds and testing the controls that were bypassed. To discuss a suspected incident, contact us.