Context: SIM swap is a fraud that starts at a telecom shop, not at the bank: the criminal reissues the victim’s SIM, receives every OTP code, and from there every SMS-based protection layer collapses within minutes.
Legal Basis and How It Applies
A SIM-swap attack chain has three links in three different industries: the criminal collects the victim’s personal information, uses forged documents or a process loophole to have the carrier reissue the SIM, then uses the received OTPs to reset bank passwords and move money. Telecom law places subscriber-information registration and verification duties on carriers, and where a procedurally wrongful SIM reissue causes loss, the carrier is not outside responsibility. The bank sits at the last link: its system sees only ‘right phone number, right OTP’, so SIM-swap disputes always turn on whose link broke first.
The industry’s risk-reduction direction is to depend less on SMS OTP: Decision 2345/QD-NHNN pushes biometric authentication for high-value transactions and important changes, and many banks add device authentication and warnings when an account logs in from a new device or a newly changed SIM. On allocating responsibility when an incident occurs, three files must be compared: the carrier’s SIM-reissue file (who requested, what documents, was procedure followed), the bank’s authentication log (device or location anomalies, warnings given), and the customer’s conduct (where personal information was exposed). The compensation outcome in practice is the sum of these three comparisons, with no template answer for every case.
Application in Practice and Common Pitfalls
The most effective prevention sits outside the bank: set a SIM PIN, ask the carrier to lock remote SIM-reissue for the phone number tied to banking, and use authenticator apps or biometrics instead of SMS OTP wherever services allow. When a phone suddenly loses signal for no clear reason, treat it as an emergency signal: call the bank to lock the account before calling the carrier to ask why.
Action Checklist
The steps below turn the analysis above into concrete work:
- First, test your own situation against this ground: A SIM-swap attack chain has three links in three different industries: the criminal collects the victim’s personal information, uses forged documents or a process loophole to have the carrier reissue the SIM, then uses the received OTPs to reset bank passwords and move money.
- Record the application point specific to this case instead of copying conclusions from another case: The bank sits at the last link: its system sees only ‘right phone number, right OTP’, so SIM-swap disputes always turn on whose link broke first.
- Prepare the evidence and file relating to the following point before dealing with authorities or partners: The most effective prevention sits outside the bank: set a SIM PIN, ask the carrier to lock remote SIM-reissue for the phone number tied to banking, and use authenticator apps or biometrics instead of SMS OTP wherever services allow. When a phone suddenly loses signal for no clear reason, treat it as an emergency signal: call the bank to lock the account before calling the carrier to ask why.
- Answer the question clients ask most directly with this conclusion, and keep it on file: Responsibility allocates by the broken link after comparing the carrier’s SIM-reissue file, the bank’s authentication log and the customer’s conduct. A carrier that reissued the SIM off-procedure bears its share; a bank with authentication faults or missing anomaly warnings bears its corresponding share — no single party defaults to paying everything.
Frequently Asked Questions
If my SIM is reissued and OTP stolen, who compensates?
Responsibility allocates by the broken link after comparing the carrier’s SIM-reissue file, the bank’s authentication log and the customer’s conduct. A carrier that reissued the SIM off-procedure bears its share; a bank with authentication faults or missing anomaly warnings bears its corresponding share — no single party defaults to paying everything.
Bank or carrier — who is responsible?
Both can be liable, for different parts: the carrier for subscriber registration and SIM reissue, the bank for transaction authentication and anomaly detection. The customer should complain to both in parallel and report to the police so both systems’ files are officially extracted and compared.
How to prevent SIM swap?
Reduce SMS-OTP dependence with biometrics and device authentication in the direction of Decision 2345/QD-NHNN, set a SIM PIN and lock remote SIM reissue with the carrier, and do not publish the banking phone number together with personal details on social media. Sudden unexplained signal loss is a sign to lock the bank account immediately.
This article has been quality-reviewed by the FLAW AI Legal Council