Most account takeovers do not begin with a clever hack. They begin with a phone call that sounds helpful, a message that looks official, and a code you read out because you were told to. SIM swap fraud in Nigeria works the same way every time: the attacker convinces your carrier to move your number to a new SIM, then uses the OTPs that arrive on it to reset your accounts.
Your OTP, your PIN and your SIM are three different locks on the same door. This guide shows how each one is attacked, what the attacker needs from you, and the habits that make the whole chain fail.
What account takeover looks like from the inside
Account takeover is not one event. It is a short sequence, and each step makes the next one easier. First the attacker learns who you are and which bank or app you use. Then they get control of the number tied to those accounts. Then they ask for a password reset, and the OTP arrives on the number they now control.
From the inside, it feels like nothing at first. Your phone loses service. You assume the network is down. By the time service returns, or by the time you notice it does not, the accounts are already being emptied or the PIN has already been changed.
That is why prevention is worth more here than recovery. Once the number has moved and the OTP has been read, the bank sees a legitimate login from a legitimate number. The strongest defence is to make sure the number never moves and the OTP never leaves your screen.
How SIM swap fraud works
A SIM swap is exactly what it sounds like: your phone number is moved from your SIM card to another one. The carrier does this legitimately when you lose a phone or change networks. The fraud version does it with someone else’s identity and your number.
The attacker needs three things: your phone number, enough personal details to pass the carrier’s verification, and a reason that sounds ordinary. Those details are easier to collect than people think — a data breach, a leaked form, a social media profile, or a conversation where you volunteer your date of birth and mother’s maiden name.
Then they visit or call the carrier, claim to have lost the SIM, and ask for a replacement or a swap. If the verification is weak, the number moves. Your phone drops to “no service” and the attacker’s phone starts receiving your calls and your OTPs. This is the point where most people are already too late, which is why the warning signs matter so much.
Why SIM swap fraud needs your silence
The swap itself is quiet. Your carrier does not call you to say “someone is moving your number” — the whole point is that the request looks routine. Your phone simply stops working. If you are asleep, in a meeting, or not looking at your phone, the silence lasts long enough for the attacker to reset a password and read the code.
This is why speed of noticing is a security control. A person who calls the carrier within minutes of losing service may interrupt the swap before the attacker uses it. A person who waits until the next morning gives the attacker hours. The attacker is not only stealing a number; they are stealing a window of time.
The phone call that starts it
Most social engineering calls follow a script. Someone introduces themselves as a bank officer, a network engineer or a support agent. They mention a problem you did not know you had — suspicious activity, a failed upgrade, a blocked line. They are calm and helpful, and they create a reason for you to act now.
Then they ask for information. Sometimes it is a “verification” detail. Sometimes it is the OTP that just arrived, framed as proof that you are the real customer. Sometimes it is your PIN, described as a temporary code. The request always sounds procedural, and the urgency always discourages you from hanging up and calling back.
The rule is simple and it has no exceptions: no legitimate bank, network or app will ask you for your OTP, your card PIN or your app PIN over a call, a message or a chat. If someone does, the call is the attack. Hang up and dial the number on your bank’s own app or website.
OTP phishing: the message that asks for the code
OTP phishing does not need a SIM swap at all. It needs you to hand over the code. A message claims your account is about to be locked, your delivery is pending, or a payment needs confirmation. A link opens a page that looks like your bank and asks you to log in — and then asks for the OTP “to verify”.
The page is fake. The OTP you type goes straight to the attacker, who uses it on the real site within seconds. The same trick arrives as a chat message from a “support agent”, a voice note, or a call. The code is the key; the phishing is just the hand that asks for it.
Remember what an OTP is for. It proves that whoever is logging in has access to your phone. The moment you read it to someone else, you have proven that they have access to your phone. There is no legitimate reason to share it, and no exception for “verification”, “refunds” or “unlocking”.
PIN hygiene that actually matters
- Use a different PIN for each important account. A single PIN reused across a bank app, a wallet and a phone lock is one guess away from everything.
- Avoid obvious patterns. Birth years, repeated digits and the last four of your phone number are the first combinations anyone tries.
- Never share a PIN with anyone, including “support”. Not by voice, not by text, not by entering it into a page someone sent you.
- Change a PIN you have typed in front of someone. A shoulder, a camera or a shared screen is enough.
- Do not save PINs in notes or chats. A PIN written next to an account name is a PIN already compromised if the phone is lost or the chat is synced.
- Use biometrics where they replace typing, but keep the PIN strong. A fingerprint is convenient; the PIN is the fallback an attacker will target.
Reading the warning signs early
SIM swap fraud has a few observable signals, and catching one early can save the account. The most common is a sudden loss of network on a number that normally works — no signal, “no service”, or an inability to make calls while other phones on the same network are fine. A second signal is an unexpected “welcome” or “SIM registration” message, or a carrier notification about a swap you did not request.
Other signs are quieter. Your bank app logs you out and will not accept your PIN. You stop receiving OTPs you requested. You get a password reset email you did not ask for. A caller already knows details about you that you did not give them. Each of these is a reason to act immediately, not to wait and see.
What your bank or app will never ask
| They will ask | They will never ask |
|---|---|
| For a password you type into their official app | For your OTP over a call or chat |
| For identity documents through a secure channel | For your card PIN or app PIN |
| For you to use the number on their website | For you to install a remote-access app |
| For you to confirm a transaction in the app | For you to send money to “unlock” an account |
If a request falls in the right-hand column, it is not your bank. It is someone pretending to be, and the correct response is to end the conversation and verify through a channel you chose.
The same code protects more than your bank
Bank apps are the obvious target, but the OTP on your phone guards a lot more. A wallet, a data purchase, a gift card sale, an airtime conversion — each can be triggered from an account that a stolen code can open. Attackers do not always go for the biggest balance first; they go for the account with the weakest recovery.
That is why PIN and OTP hygiene has to apply everywhere, not only at the bank. If you buy airtime or a data bundle with a saved card, that account is worth protecting. If you sell gift cards or convert airtime to cash, the payout goes to a wallet that a reset can reach — the mechanics are covered in this guide to airtime-to-cash. And if you sell USDT or Bitcoin to turn crypto into naira, the withdrawal account behind the wallet is the prize.
The rule does not change with the service: the code stays on your screen, the PIN stays in your head, and the SIM stays in your phone. A verified wallet reduces the number of people who can ask you for those details, because the payout goes to an account in your name and the support channel sits inside the app.
The first hour after you suspect a takeover
- Call your carrier from another phone. Report the loss of service and ask whether a swap or replacement was requested on your number. Ask them to block it.
- Call your bank’s fraud line. Use the number on your card or the bank’s official app, not a number from a message. Ask them to freeze the account and flag any recent transactions.
- Change the password on your email first. Email is the reset route for almost everything else. If the attacker controls it, every other reset is theirs.
- Change passwords on your bank, wallet and social accounts from a device you trust, not from a link you were sent.
- Check for unfamiliar devices and sessions and sign them out. Look at recent login locations.
- Report to the police cybercrime unit and keep the reference. Report to the platform as well.
Do these in parallel where you can. The attacker is working on a clock too, and every minute you delay is a minute they use.
Getting your number back from the carrier
Recovering a swapped number is a carrier process, not a bank process. Go to the carrier’s own office with identification, explain that the number was swapped without your consent, and ask for the number to be restored to a SIM you control. Ask for a written reference for the complaint.
Expect the carrier to investigate. Bring the details of when service stopped and any messages about a swap or replacement. Once the number is restored, treat every account that used it as compromised until you have changed its password and checked its sessions. The number coming back does not undo the logins the attacker already made.
Rebuilding the accounts behind the number
Start with email, then banking, then wallets, then social. Email is first because it is the master key: a password reset for anything else lands there. Change the password, turn on two-factor authentication, and check the recovery options — an attacker often adds their own phone or email as a backup before you notice.
For each account, review the security settings rather than only the password. Remove devices you do not recognise, revoke app permissions you did not grant, and check the recovery questions. If an account allows it, add a second factor that is not SMS — an authenticator app or a hardware key is harder to hijack than a text message.
Finally, tell your bank what happened and ask them to note it on your file. If fraudulent transactions went through, you will need that note when you dispute them.
Device and email: the locks people forget
The phone is only one door. If your email is compromised, the attacker can reset most accounts without ever touching your SIM. If your device is compromised, they can read your OTPs as they arrive. Protect all three:
- Lock the phone with a PIN or biometrics, and set a short auto-lock.
- Turn on two-factor authentication on email, bank and wallet accounts.
- Prefer an authenticator app over SMS where the service allows it.
- Keep the phone’s operating system updated — many takeovers start with an unpatched device.
- Do not install apps from links or from outside the official store.
- Review app permissions and remove anything that can read messages or control the screen.
A short case
A customer receives a call from someone claiming to be from their network, warning about a “SIM upgrade”. They are asked to confirm a few details and then to read a code that “confirms the upgrade”. They do. Within minutes, their bank sends a password reset, and the code is routed to the attacker. The bank app is opened on a new device and the wallet is emptied.
Nothing in the call sounded like a robbery. It sounded like customer service. The single failure was reading the code. Everything else — the swap, the reset, the transfer — depended on that one sentence. This is why OTP hygiene is not a small habit; it is the lock the whole system hangs on.
Habits that hold
- Never share an OTP, PIN or SIM-swap code with anyone.
- Hang up and call back on a number you looked up yourself.
- Treat a sudden loss of network as a possible swap and act within minutes.
- Use a different PIN for each important account.
- Make email the most protected account you own.
- Review devices and sessions monthly, not after an incident.
- Keep your carrier’s and bank’s official numbers saved, so you never search for them under pressure.
Why the code is the whole game
Banks and apps have spent years making logins harder to guess. Passwords are longer, devices are recognised, and unusual logins are challenged. The OTP is the one control that still depends on a person doing the right thing in a stressful moment, which is exactly why attackers aim at it.
You cannot make the attacker stop calling. You can make the call useless by never reading the code, never sharing the PIN, and never trusting a number that arrived in the same message it is promoting. Every layer — carrier, bank, email, device — is there to buy time. The OTP is where you spend it.
The attacker only has to succeed once. You have to succeed every time a code arrives. That asymmetry is why habits beat vigilance: a rule you follow without thinking is more reliable than a judgement you make while a stranger is talking.
What to do with a suspicious message
Do not reply, do not click, and do not forward it to friends as a warning until you have removed any personal details. Screenshot it for evidence, report it to your bank or the platform it imitates, then delete it. If you already clicked a link, change the password for that account from a trusted device and check for new sessions.
If you already entered a code, treat the account as compromised even if nothing has happened yet. Change the password, sign out all devices, and call the bank. Attackers often wait a day or two before using access, so a fast response can still win.
Frequently asked questions
What is a SIM swap?
It is the movement of your phone number from your SIM to another SIM. It is legitimate when you request it and fraudulent when someone else does, using your details to pass the carrier’s checks.
Can a SIM swap happen without my phone?
Yes. The attacker deals with the carrier, not your handset. Your phone only shows the result: a sudden loss of service.
Will I know if my SIM is being swapped?
Often only after it happens, when the network drops. Some carriers send a notification, but do not rely on it. Treat unexplained loss of service as urgent.
Do banks ever ask for an OTP?
They may ask you to enter an OTP in their own app or on a verified call flow you initiated. They will not ask you to read it to a person, send it in a chat, or type it into a page someone sent you.
Is it safe to read an OTP to someone who says they are from my bank?
No. Not under any circumstances. That request is the fraud, regardless of how official the caller sounds or what number appears on the screen.
What is OTP phishing?
A fake page, message or call that persuades you to enter or reveal your one-time code. The attacker uses it immediately on the real service before it expires.
How do I set a strong PIN?
Use six digits you do not use anywhere else, avoid birth dates and repeated patterns, and never store it in a note or chat. Change it if anyone has seen you type it.
What if my phone loses network suddenly?
Call your carrier from another phone and ask whether a swap or replacement was requested. Do it immediately; the first few minutes are the difference between a blocked swap and a drained account.
What should I do first if my account is taken over?
Secure your email, then call your bank’s fraud line and your carrier. Email first because it controls the reset routes for everything else.
How do I get my number back?
Go to the carrier’s office with identification and ask for the number to be restored. Get a written reference, then change the passwords on every account that used the number.
Can a swapped SIM affect my bank app?
Yes. The attacker can receive the OTPs needed to reset the app password and log in on a new device. That is the usual reason the app suddenly rejects your PIN.
Does two-factor authentication help?
Yes, especially when the second factor is an authenticator app rather than SMS. It removes the attacker’s easiest route, which is the code arriving on the number they now control.
Are USSD codes safe?
USSD is only as safe as the phone holding the SIM. If the SIM is swapped, the attacker can use USSD too. The protections are the SIM and the PIN, not the menu itself.
What if the attacker changes my email first?
Contact the email provider’s recovery team immediately, and use another device to secure your bank and wallet. Tell your bank the email was compromised so they can watch for resets.
Want a wallet that never asks for a code in a chat? Open a verified Mabro wallet, or see how airtime-to-cash keeps the PIN on your own line.