A changed number, then a new phone
Takeovers often begin with a recovery that changes the registered number, followed by a login from a new phone. The code goes to the new SIM, so the change itself has to be checked.
In this advisory
What is happening
Takeovers often start with a change rather than a login. A caller with leaked details passes the security questions, has the password reset and the registered number changed, and a new phone signs in. A one-time code proves only that someone received it, and after the change it goes to the new number.
What the numbers themselves say
India now gives banks two views of the number. DoT’s Mobile Number Revocation List, on its Digital Intelligence Platform, lists numbers disconnected for fraud or misuse; in January 2025 RBI directed banks and other regulated entities to use it to clean their customer records and to watch accounts linked to revoked numbers1. DoT’s Financial Fraud Risk Indicator, introduced in May 2025, rates a number as a medium, high or very high risk of financial fraud and shares the rating with banks and UPI providers2.
Neither tells a bank whether the person on the new phone is the customer. That is a question for the change itself.
Where it shows
At the moment of change: a SIM that is not the one bound at sign-up, a phone the account has never seen, a recovery that changes the number and the device in the same session, and a first payment to a new payee soon after.
What to check
- Treat a recovery as a new-phone event
A number or device change should need the customer’s face from sign-up to hold before anything is re-bound.
- Read the SIM against the one bound at sign-up
A swapped SIM passes a network check; it does not match the binding.
- Cool off after a change
Lower limits for new payees for a period your policy sets, for the risky session only.
- Put the number’s own ratings beside the decision
Revoked numbers and FRI ratings, where your bank receives them, weighed with the session.
Sources
Secondary sources are news or trade reporting of a rule or figure. Check the regulator’s own text before relying on them. Nothing here is legal advice.
- RBI (opens in a new tab), Jan 2025Circular on preventing financial frauds through voice calls and SMS: use of DoT’s Mobile Number Revocation List on the Digital Intelligence Platform
- PIB (opens in a new tab), May 2025DoT introduces the Financial Fraud Risk Indicator (FRI) to strengthen cyber-fraud prevention