← BACK TO INSIGHTS HUB CASE FILE // IDENTITY HIJACKING

eSIM Swap & Telecom Upgrade Fraud: How Attackers Hijack Bank Accounts Without Physical SIM Theft

Omkar Tanaji More

Founder, ShadowX Technologies • CEH v13 • ISO 27001 Lead Auditor

PUBLISHED: 2026-09-01 • 7 MIN READ • TELECOM SECURITY

$ case_file --id=TELCO-ESIM-SWAP-HIJACK --type=CREDENTIAL_TAKEOVER ✓ ADVISORY

VECTOR: REMOTE ESIM PROVISIONING | TARGET: 2FA MOBILE OTP INTERCEPTION

1. The Shift from Physical to Digital SIM Swapping

Historically, SIM swapping required forging identity documents at retail telecom stores. With the widespread adoption of eSIM technology and 5G upgrades in India (Jio, Airtel, Vi), cyber criminals have transitioned to fully remote digital hijacking techniques that require zero physical contact.

2. The Attack Sequence

1. The "Mandatory 5G Upgrade" Call

The scammer impersonates customer support from the victim's mobile carrier, claiming their SIM card must be upgraded to 5G to prevent service deactivation. The victim is instructed to send an SMS in a specific carrier format (e.g. 121 eSIM victim_email@gmail.com or SIMREQ 20-digit-EID).

2. QR Code Interception & Transfer

The telecom provider automatically dispatches an eSIM activation QR code to the email address supplied by the attacker. The attacker scans the QR code onto a burner phone, immediately activating the cellular profile.

3. The Cellular Blackout & Rapid Bank Draining

The victim's physical SIM instantly loses signal ("No Service"). Believing it to be a temporary network glitch, the victim does not immediately panic. During this crucial 2-hour window, the attacker resets Net Banking passwords, receives incoming OTPs, and empties linked bank accounts.

3. Critical Prevention Protocol

Immediate Action on Unexpected "No Service": If your mobile signal unexpectedly disappears while others nearby have full reception, contact your carrier from another phone immediately to verify if a SIM swap request was initiated.
Never Forward Telecom Verification SMS: Mobile carriers never ask customers to forward SMS codes containing eSIM or 19-digit numbers.
Use Authenticator Apps Instead of SMS 2FA: Transition critical email and banking logins to Time-Based One-Time Password (TOTP) apps (Google Authenticator, Microsoft Authenticator) instead of SMS.

🛡️ Share This Cyber Defense Investigation

Help protect family, senior citizens, and colleague networks across India by sharing verified forensic case files.

💬 SHARE ON WHATSAPP →