The SIM card / phone shop SIM swap
A shop selling tourist SIMs makes a copy and uses it for SMS-based authentication fraud later. Most-documented in India, Thailand, Turkey, Morocco. Field guide: how the scam works, how to spot it in five seconds, and what to do if you fall for it.
Also called: SIM cloning, SMS interception scam.
How the scam works
You buy a tourist SIM at a small shop or kiosk. The shopkeeper takes your passport, registers the SIM in your name, but also clones a duplicate. After you leave, the duplicate is used for SIM-swap attacks: intercepting SMS codes for banking, two-factor authentication, and email password resets. The pattern accelerated 2023-2025 across Asia.
How to spot it in 5 seconds
- Shop demands to hold your passport for "processing" longer than 30 seconds
- No formal receipt or registration paperwork given to you
- Shop is not branded as an official outlet (look for Vodafone, Airtel, AIS, dtac, Viettel, Mobifone signs)
- Shopkeeper installs the SIM in your phone "to test" without asking
- Repeated 2FA codes arrive on your phone in the hours after activation
What to do if you fall for it
- Only buy SIMs at official airport counters or branded retail outlets
- Never let the shopkeeper handle your phone
- Switch banking 2FA from SMS to an authenticator app (Google Authenticator, Authy) — SMS is the vulnerable channel
- Block the SIM via the carrier app the moment you leave the country
Frequently asked questions
Where is the The SIM card / phone shop SIM swap most common?
The The SIM card / phone shop SIM swap is most-documented in India, Thailand, Turkey, Morocco, Vietnam. Reports come from FCDO and US State Department advisories, embassy briefings, and Warnely's editorial team. The scam can happen anywhere these patterns repeat — watch for the warning signs above regardless of country.
Is this scam dangerous or just annoying?
This scam is high-risk: it can involve significant financial loss, drugged drinks, or physical intimidation. Take the recovery steps above seriously and report to local police and your embassy.
What should I do if I am being scammed right now?
Step away from the situation if safe. Walk to a busier, public, well-lit area. If you have been robbed: block bank cards via your banking app within minutes. If you have been physically threatened: call the local emergency number (varies by country — see the country guide) and your embassy. Most embassies operate 24/7 emergency lines.
Will my travel insurance cover this?
Most travel insurance policies cover theft and fraud if you file a police report within 24 hours and provide the report number when claiming. Card fraud is usually reversed by your bank if reported promptly. Spiked-drink medical costs are typically covered as medical emergencies. Always check your specific policy before travel.