Behind Every Scam Call: The Hidden Business of Fraudulent SIM Cards
Introduction
Recently, the Delhi Police arrested a licensed telecom PoS agent, who identified himself as “Shivam Telecom," from a roadside kiosk adjacent to Hindu Rao Hospital. On the face of it, the headline may have simply read, “One man, one arrest." However, beneath that arrest is the unsettling story of a fully legitimate retail shop actively forging other people’s identification documents into weapons, one SIM card at a time, for as little as ₹500-600 each. This is not an account of an isolated offender; it is a peek into the vulnerability of SIM card security for typical end-users and the reasons why every mobile phone subscriber must pay attention to the unseen journey of his number.
Why SIM Security Matters Now
Erstwhile, a SIM card was only a simple device for sending text messages and making calls. Today, however, it’s also a direct link to most of our lives online, be it online banking to verify it through one-time passwords (OTP) or Unified Payments Interface (UPI); social media platforms; or email accounts to reset a forgotten password, two-factor authentications (2FA), or even numerous other online services. Therefore, losing a SIM card and getting it fraudulently issued under your name, or criminals accessing your identity to buy a SIM, can be a serious cause of concern, as they can then impersonate you, conduct various frauds, bypass checks, or commit acts that can lead to you being wrongly implicated.
According to the investigation, criminals were procuring SIM cards through the authorized outlets of telecom companies, not unlicensed dealers. This clearly proves a deficiency in the Know Your Customer (KYC) process for the SIM card activation. The situation, however, is worse and is also highlighted by the fact that more than 21 lakh mobile numbers from the more than 114 crore mobile numbers reviewed under the Sanchar Saathi initiative launched by the department of telecommunications (DoT) were associated with fake or invalid identity documents. A state police chief of Tamil Nadu claims that 90% of the cyber fraud cases involved SIM cards obtained through misused identity documents.
How Illegally Activated SIMs Fuel Everyday Scams?
Once a SIM is activated using someone else's identity documents or biometric data, without their knowledge, it becomes a disposable, hard-to-trace tool for criminals. Here's how that plays out in practice:
- Phishing and impersonation calls: Using an honest person’s details for a SIM registration allows the scammer to have a “clean” number that won’t tip off victims about a potential scam immediately when carrying out a fake bank call, fake delivery scam, or fake impersonation of an officer.
- OTP and account-takeover fraud: Since the SIM card is used as the anchor to OTP verification, an unauthorized SIM can be used to capture one-time passwords to activate new digital payments, create a new digital payments account, or use other personal information linked to your phone number to reset your service passwords.
- Financial fraud and money mule networks: According to the investigators, such SIMs were extensively being used to open digital payment accounts as well as to flow money across a number of fraud chains, thus enabling the fraudsters to build a layer of financial infrastructure that is not linked with their actual identities.
- Identity theft with real-world consequences: The identity of the Aadhaar holder (whose document was used to activate the SIM card) might be unaware that a SIM exists under his name until the fraud is uncovered during a loan default or a criminal investigation where he is forced to justify a crime committed using “his” number that he is oblivious to.
That is the anonymity that SIM-card fraud has: the fact that the SIM on the face of it seems genuine, but the one operating it and the registered owner have absolutely no relationship whatsoever.
Red Flags Every Mobile User Should Watch For
Most people won't know their identity has been misused until something goes visibly wrong. A few warning signs are worth taking seriously:
- Your SIM suddenly loses network connectivity or displays "No Service" for an extended period without any known outage, SIM replacement request, or billing issue.
- You stop receiving OTPs or verification messages for banking, UPI, or other online services, particularly if login attempts continue to occur on your accounts.
- You receive unexpected OTPs, verification codes, or account alerts for services you never signed up for, indicating that someone may be attempting to use your mobile number.
- You receive calls or messages intended for someone else or asking you to confirm activities you never performed, which may suggest your number has been misused or duplicated.
- Your bank or telecom provider notifies you of unusual account activity, failed identity verification, or changes that you did not authorize.
- You discover multiple mobile connections registered in your name that you never requested, a risk that often remains unnoticed unless you proactively check through the Department of Telecommunications' Sanchar Saathi portal.
None of these guarantee fraud, but any of them is a reason to check further rather than assume it's a glitch.
Practical Steps to Protect Yourself
The good news is that Indian users now have direct tools to check and control this exposure:
- Identify your SIMs: Via the Department of Telecom’s Sanchar Saathi website, you can access a list of all mobile numbers registered in your name. Report and get any SIMs you do not recognize deactivated promptly.
- Safeguard your identity documents and biometrics: Do not disclose your Aadhaar information, OTPs, or biometrics to unofficial persons or retail agents. Ensure your SIM is activated in your presence by an official dealer of the telecom company.
- Tighten the security of your accounts: Wherever possible, use the most secure multi-factor authentication methods; an authenticator app, rather than just SMS, would be ideal. Consider enabling account change or SIM swap notifications from your telecom provider.
- Stay vigilant about your bank accounts and financial activities. Watch for unusual OTP requests, password change requests, login notifications, and unrecognized devices being logged into your online accounts. Being observant early on helps minimize losses.
- Take swift action if a SIM stops working: Contact your telecom provider and report the misuse to the Sanchar Saathi website as well as your nearest cyber station, or file a complaint through the cybercrime helpline number.
A Shared Responsibility
Consumer vigilance is not enough to save the system. Telecom providers must verify customer authenticity and check their retail points sufficiently so that a roadside vendor of the likes of “Shivam Telecom” cannot have their retail outlet anywhere the retail outlets may not need to be established and can be run even from an abandoned car body on the street for weeks. Authorities are ensuring this by making all franchisees and PoS agents and distributors register, such that the individual activating each SIM is perfectly identifiable. Consumers should take precautions and report suspicious patterns and be vigilant for fraud detection and protect themselves by knowing the system, like the use of the Sanchar Saathi platform.
Conclusion
The Delhi fake SIM case proves that even sophisticated technologies are not enough to protect India’s telecom ecosystem. No amount of biometric validation, AI fraud prevention tools, or rigid KYC compliance can offset a single corrupt agent selling SIM cards over the counter. While law enforcement works to clamp down, the responsibility also falls upon consumers, who need to regularly monitor their SIM registrations, safeguard their identity, and report any suspicious transactions in time to minimize the threat of identity theft and SIM-based cybercrime.
Sources
- https://www.prokerala.com/news/articles/a1784141.html
- https://the420.in/dots-sanchar-saathi-initiative-exposes-21-lakh-sim-cards-activated-illegally
- https://www.sancharsaathi.gov.in/
- https://www.pib.gov.in/PressReleasePage.aspx?PRID=2113857
- https://www.business-standard.com/amp/industry/news/nearly-4-million-sims-deactivated-as-govt-cracks-down-on-digital-fraud-125080500300_1.html
- https://www.digit.in/news/telecom/here-are-5-new-sim-card-rules-implemented-by-dot-amid-rising-scams-and-frauds.html
Related Blogs
Introduction
Data protection has been a critical aspect of advocacy and governance all across the world. Data fuels our cyber-ecosystem and strengthens the era of emerging technologies. All industries and sectors are now dependent upon the data of the user. The governments across the world have been deliberating internally to address the issue and legality of Data protection and privacy. The Indian government has witnessed various draft bills and policies focusing on Data protection over the years, and the contemporary bill is the Digital Personal Data Protection Bill, 2023, which was tabled at the Lok Sabha (Lower House of Parliament) on 03 August for discussions and parliamentary assent.
What is DPDP, 2023?
The goal of the complete and comprehensive Digital Personal Data Protection Bill of 2023 is to establish a framework for the protection of personal data in India. The measure acknowledges the significance of protecting personal data and seeks to strike a balance between the necessity to process personal data for legitimate purposes and the right of individuals to do so. The bill establishes a number of crucial expressions and ideas associated with the protection of personal data, including “data fiduciary,” “data principal,” and “sensitive personal data.” It also emphasises the duties of data fiduciaries, including the need to establish suitable security measures to preserve personal data and the need to secure data principals’ consent before processing their personal information. The measure also creates the Data Protection Board of India, which would implement its requirements and guarantee data fiduciaries’ compliance. The board will have the authority to look into grievances, give directives, and impose sanctions for non-compliance.
Key Features of the Bill
The bill tabled at the parliament has the following key features:
- The 2023 bill imposes reasonable obligations on data fiduciaries and data processors to safeguard digital personal data.
- Under the 2023 bill, a new Data Protection Board is established, which will ensure compliance, remedies and penalties.
- Under the new bill, the Board has been entrusted with the power equivalent to a civil court, such as the power to take cognisance in response to personal data breaches, investigate complaints, imposing penalties. Additionally, the Board can issue directions to ensure compliance with the act.
- The 2023 bill also secures more rights of Individuals and establishes a balance between user protection and growing innovations.
- The bill creates a transparent and accountable data governance framework by giving more rights to individuals.
- There is an Incorporation of Business-friendly provisions by removing criminal penalties for non-compliance and facilitating international data transfers.
- The new 2023 bill balances out fundamental privacy rights and puts reasonable limitations on those rights.
- The new data protection board will carefully examine the instance of non-compliance by imposing penalties on non-compiler.
- The bill does not provide any express clarity in regards to compensation to be granted to the Data Principal in case of a Data Breach.
- Under 2023 Deemed consent is there in its new form as ‘Legitimate Users’ pertaining to the conditions in regard to Sovernity and Intergrity of India.
- There is an introduction of the negative list, which restricts cross-data transfer.
Additionally, the measure makes special provisions for the processing of children’s personal data and acknowledges the significance of protecting children’s privacy. Additionally, it highlights the rights of the data subjects, including their right to access their personal information, their right to have wrong information corrected, and their right to be forgotten.
Drive4CyberPeace
A campaign was undertaken by CyberPeace to gain a critical understanding of what people understand about Data privacy and protection in India. The 4-month long campaign led to a pan-India interaction with netizens from different areas and backgrounds. The thoughts and opinions of the netizens were understood and collated in the form of a whitepaper which was, in turn, presented to Parliamentarians and government officials. The whitepaper laid the foundation of the recommendations submitted to the Ministry of Electronics and Information Technology as part of the stakeholder consultation.
Conclusion
Overall, the Digital Personal Data Protection Bill of 2023 is an important step towards safeguarding Indian citizens’ privacy and personal data. It creates a regulatory agency to guarantee compliance and enforcement and offers a thorough framework for data protection. The law includes special measures for the protection of sensitive personal data and the personal data of children and acknowledges the significance of striking a balance between the right to privacy and the necessity of data processing.
Introduction
India is making strides in developing its own quantum communication capabilities, despite being a latecomer compared to nations like China and the US. In the digital age, quantum communication is gradually becoming one of the most important technologies for national security. It promises to transform secure data exchange across government, financial, and military systems by enabling unhackable communication channels through quantum concepts like entanglement and superposition. Scientists from the Defence Research and Development Organisation (DRDO) and IIT Delhi recently demonstrated quantum communication over a distance of over one kilometre in free space. One significant step at a time, India's quantum roadmap is beginning to take shape thanks to strategic partnerships between top research institutes and defence organisations.
Recent Developments
- In February 2022, by DRDO and IIT Delhi, a 100 km Quantum Key Distribution (QKD) link was established between Prayagraj and Vindhyachal using pre-existing commercial-grade optical fibre, with secure key rates of up to 10 kHz. This proved that using India's current telecom infrastructure to implement quantum-secure communication is feasible.
- Scientists at DRDO finished testing a 6-qubit superconducting quantum processor in August 2024, showing complete system integration by submitting quantum circuits through a cloud interface, running them on quantum hardware, and updating the results.
- A free-space QKD demonstration over over 1 km was conducted in June 2025, with a secure key rate of approximately 240 bits/s and a Quantum Bit Error Rate (QBER) of less than 7%. A crucial step towards satellite-based and defence-grade secure networks, this successful outdoor trial demonstrates that quantum-secure communication is now feasible in actual atmospheric conditions.
- India is looking to space as well. Since 2017, the Raman Research Institute (RRI) and ISRO have been collaborating on satellite-based QKD, with funding totalling more than ₹15 crore. In 2025, a specialised QKD-enabled satellite called SAQTI (Secured Applications using Quantum and optical Technologies by ISRO) is anticipated to go into orbit. The initiative's foundation has already been established by ground-based quantum encryption trials up to 300 meters.
- In India, private companies such as QNu Labs are assisting in the commercialisation of quantum communication. QNu, which was founded at IIT Madras, has created the plug-and-play QKD module Armos, the quantum random number generator (QRNG)Tropos, and the integrated platform QShield, which combines QKD, QRNG, and post-quantum cryptography (PQC).
Where India Stands Globally
India is still in its infancy when compared to China's 2,000 km Beijing–Shanghai QKD network and its satellite-based communication accomplishments. Leading nations like the US, UK, and Singapore are also ahead of the curve, concentrating on operationalising QKD trials for government systems and incorporating post-quantum cryptography (PQC) into national infrastructure.
However, considering the nation's limited prior exposure to quantum technologies, India's progress is noteworthy for its rapid pace and indigenous innovation.
Policy Challenges and Priorities
- Strong policy support is required to match India's efforts in quantum communication. The standardisation of PQC algorithms and their incorporation into digital public infrastructure have to be major priorities.
- Scaling innovation from lab to deployment through public-private partnership
- Accelerating satellite QKD to establish a secure communications ecosystem owned by India.
- International standards compliance and worldwide interoperability for secure quantum protocols.
Conclusion
India has made timely strides in quantum communication, spearheaded by DRDO, IITs, and ISRO. Establishing unbreakable communication systems will be essential to national security as digital infrastructure becomes more and more integrated into governance and economic life. India can establish itself as a significant player in the developing quantum-secure world with consistent investment, well-coordinated policy, and international collaboration.
References
- https://www.thehindu.com/sci-tech/science/quantum-communication-iit-delhi-drdo-entanglement-qkd-explained/article69705017.ece
- https://drdo.gov.in/drdo/quantum-technologies
- https://www.indiatoday.in/science/story/the-end-of-hacking-how-isro-and-drdo-are-building-an-unhackable-quantum-future-2743715-2025-06-22
- https://www.pib.gov.in/PressReleasePage.aspx?PRID=2136702
- https://www.pib.gov.in/PressReleasePage.aspx?PRID=1800648
- https://thequantuminsider.com/2024/08/29/indias-drdo-scientists-complete-testing-of-6-qubit-superconducting-quantum-processor/
- https://www.pib.gov.in/PressReleasePage.aspx?PRID=2077600
- https://www.pib.gov.in/PressReleasePage.aspx?PRID=2121617
- https://www.rri.res.in/news/quic-lab-achieves-next-step-towards-realising-secure-satellite-based-quantum-communication#:~:text=QuIC%20lab%20achieves%20the%20next,transactions%2Dsafe%2D2561836.html
- https://www.gsma.com/newsroom/post-quantum-government-initiatives-by-country-and-region/
- https://tech.hindustantimes.com/tech/news/rri-demonstrates-secure-satellite-based-quantum-communication-in-collaboration-with-isro-71680375748247.html
Introduction:
The G7 Summit is an international forum that includes member states from France, the United States, the United Kingdom, Germany, Japan, Italy, Canada and the European Union (EU). The annual G7 meeting that is held every year was hosted by Japan this year in May 2023. It took place in Hiroshima. Artificial Intelligence (AI) was the major theme of this G7 summit. Key takeaways from this G7 summit highlight that leaders together focused on escalating the adoption of AI for beneficial use cases across the economy and the government and improving the governing structure to mitigate the potential risks of AI.
Need for fair and responsible use of AI:
The G7 recognises that they really need to work together to ensure the responsible and fair use of AI to help establish technical standards for the same. Members of the G7 countries agreed to adopt an open and enabling environment for the development of AI technologies. They also emphasized that AI regulations should be based on democratic values. G7 summit calls for the responsible use of AI. The ministers discussed the risks involved in AI technology programs like ChatGPT. They came up with an action plan for promoting responsible use of AI with human beings leading the efforts.
Further Ministers from the Group of Seven (G7) countries (Canada, France, Germany, Italy, Japan, the UK, the US, and the EU) met virtually on 7 September 2023 and committed to creating ‘international guiding principles applicable for all AI actors’, and a code of conduct for organisations developing ‘advanced’ AI systems.
What is HAP (Hiroshima AI Process)
Hiroshima AI Process (HAP) aims to establish trustworthy AI technical standards at the international level. The G7 agreed on creating a ministerial forum to prompt the fair use of AI. Hiroshima AI Process (HAP) is an effort by G7 to determine a way forward to regulate AI. The HAP establishes a forum for international discussions on inclusive AI governance and interoperability to achieve a common vision and goal of trustworthy AI at the global level.
The HAP will be operating in close connection with organisations including the Organisation for Economic Co-operation and Development (OECD) and the Global Partnership on AI (GPAI).
This Hiroshima AI Process (HAP) initiated at the Annual G7 Summit held in Hiroshima, Japan is a significant step towards regulating AI and the Hiroshima AI Process (HAP) is likely to conclude by December 2023.
G7 leaders emphasized fostering an environment where trustworthy AI systems are designed, developed and deployed for the common good worldwide. They advocated for international standards and interoperable tools for trustworthy AI that enable Innovation by creating a comprehensive policy framework, including overall guiding principles for all AI actors in the AI ecosystem.
Stressing upon fair use of advanced technologies:
The impact and misuse of generative AI was also discussed by the G7 leaders. The G7 members also stressed misinformation and disinformation in the realm of generative AI models. As they are capable of creating synthetic content such as deepfakes. In particular, they noted that the next generation of interactive generative media will leverage targeted influence content that is highly personalized, localized, and conversational.
In the digital landscape, there is a rapid advancement of technologies such as generative
Artificial Intelligence (AI), deepfake, machine learning, etc. Such technologies offer convenience to users in performing several tasks and are capable of assisting individuals and business entities. Since these technologies are easily accessible, cyber-criminals leverage AI tools and technologies for malicious activities, hence certain regulatory mechanisms at the global level will ensure and advocate for the ethical, reasonable and fair use of such advanced technologies.
Conclusion:
The G7 summit held in May 2023 focused on advanced international discussions on inclusive AI governance and interoperability to achieve a common vision and goal of trustworthy AI, in line with shared democratic values. AI governance has become a global issue, countries around the world are coming forward and advocating for the responsible and fair use of AI and influence on global AI governance and standards. It is significant to establish a regulatory framework that defines AI capabilities and identifies areas prone to misuse. And set forth reasonable technical standards while also fostering innovations. Hence overall prioritizing data privacy, integrity, and security in the evolving nature of advanced technologies.
References:
- https://www.politico.eu/wp-content/uploads/2023/09/07/3e39b82d-464d-403a-b6cb-dc0e1bdec642-230906_Ministerial-clean-Draft-Hiroshima-Ministers-Statement68.pdf
- https://www.g7hiroshima.go.jp/en/summit/about/
- https://www.drishtiias.com/daily-updates/daily-news-analysis/the-hiroshima-ai-process-for-global-ai-governance
- https://www.businesstoday.in/technology/news/story/hiroshima-ai-process-g7-calls-for-adoption-of-international-technical-standards-for-ai-382121-2023-05-20
