Марія Бровінська 20 May 2026, 12:40

SIM-swap: how scammers steal your phone number — and with it access to your bank. What to do to protect yourself

Losses from payment card fraud in Ukraine increased by 24% and reached UAH 1.4 billion in 2025. SIM-swap is one of the key schemes. Here’s how it works and what to do right now.

What is SIM swap?

SIM swap is a scam in which criminals gain control of your mobile number: by reissuing a SIM card, replacing a physical SIM with an eSIM, or hacking your operator’s account. After that, all SMS with confirmation codes from banks go to the scammers, not to you.

According to the NBU, losses from payment card fraud increased by 24% in 2025 and reached UAH 1.4 billion. Separately, the National Bank highlights SIM-swap as one of the key schemes used by criminals, writes «Economic Truth».

Having control over the number, attackers can log into online banking, change the password, withdraw money, or apply for a loan. In October 2025, one of the schemes allowed fraudsters to open accounts in the name of 286 citizens and apply for loans for over UAH 4 million.

How does this happen?

The classic scheme is «ringing.» Fraudsters call the victim several times from different numbers, then provide these numbers to the operator as «identity verification» when reissuing a SIM card. If you see a series of incomprehensible calls, this may be the beginning of an attack.

Social engineering. You are called «on behalf of the operator» or «from the bank» and asked to provide a code from SMS, PUK code or passport data. According to operators, this method accounts for 99.9% of cases. In April 2026, a group was exposed in the Dnipro region that reissued SIM cards and withdrew money in this way — the total losses amounted to about 1 million UAH .

Replacement with eSIM. Through phishing or hacking of the personal account on the operator’s website, scammers initiate the porting of the number to their smartphone. The victim learns about the problem only when the connection disappears completely.

Inactive numbers. The NBU separately warns: if you have gone abroad and have not used the number for a long time, the operator may transfer it to a new subscriber. If you have not untied this number from your bank accounts, fraudsters may try to restore access to your online banking through it.

What to do right now

Block remote SIM reissue. In your operator’s application or through the contact center, set a ban on replacing the SIM without a personal visit to the store with a passport. Vodafone allows you to do this through «MyVodafone» with authentication through «Diya». lifecell — through the «My lifecell» application with a secret word.
Register or transfer the number to a contract. Most SIM cards in Ukraine are anonymous prepaid. This makes it easier for fraudsters to reissue. If the number is tied to a passport, any actions with it will require confirmation of identity. Identification can be done remotely via BankID.
Use a separate number for banks. Cyberpolice recommends having a separate number exclusively for financial transactions — one that is not listed publicly anywhere: not in ads, not on social networks, not in messengers.
Enable two-factor authentication in your carrier and bank apps. Even if a fraudster gets your password, they won’t be able to log in without a second confirmation.
Break the suspicious chain of calls. If you receive calls from unknown numbers in a row, immediately call someone close to you. This breaks the «ringing» scheme by which scammers create a «call history» for reissuing SIM cards.
Never give out the code from an SMS. Not to the «bank,» not to the «operator,» not to the «security service.» If something seems suspicious, hang up and call the company’s official number yourself.

Ukraine wants to create a database of restored numbers to reduce SIM card fraud. However, NKEC considers this "inexpedient" for a number of reasons