TL;DR: A stolen phone’s screen lock doesn’t protect your SIM. Thieves can put the SIM into any basic phone and use *99#, NPCI’s USSD service that offers UPI without internet, to try to reset your UPI PIN and send money. In the first hour: block the SIM, call your bank, block the handset on Sanchar Saathi, and report on 1930.
How the fraud works
Maharashtra Cyber has published an advisory on exactly this. The phone is often just the delivery vehicle; the real prize is the SIM inside it.
- The SIM comes out. Your fingerprint lock protects the phone, not the SIM. Put into another handset, even a cheap feature phone, it receives your SMS and calls.
- They dial *99#. *99# is NPCI’s USSD service for UPI. As Indian Bank’s *99# guide notes, it supports fund transfers and setting or changing a UPI PIN. It works on any phone with no internet, and is linked to your bank through your mobile number.
- They reset the UPI PIN. A reset needs debit card details. Thieves look for them in the phone’s photo gallery, notes, email or from leaked data. The OTP for the reset arrives on your SIM, which they now hold.
- They send money before you’ve even reported the theft.
The same SIM can receive OTPs for net banking and WhatsApp, which is why a stolen phone can turn into UPI fraud within hours.
What to do in the first hour
- Block your SIM. Call your operator from another phone. This stops OTPs reaching the thief, and it’s the single most important step.
- Call your bank. Ask them to block UPI, mobile banking and your debit card. Ask for a complaint reference number.
- Block the handset on Sanchar Saathi. The government’s Sanchar Saathi portal lets you block a lost or stolen phone using its IMEI. You’ll need a police complaint number.
- Report on 1930 or cybercrime.gov.in if any money has moved. See why the first hour matters.
- Change passwords for email, net banking and payment apps from a safe device.
Why reporting fast protects your money
Under the RBI’s customer liability rules, if fraud happens through a third-party breach and you report it to your bank within three working days, your liability is zero. Delays shift the risk onto you. Our bank dispute guide explains the process.
Set this up today, before anything happens
- Turn on a SIM PIN in your phone’s settings. A thief who removes the SIM can’t use it in another phone without the PIN.
- Don’t keep photos of your debit card, Aadhaar or PAN in the gallery or notes.
- Turn on Find My Device (Android) or Find My (iPhone) so you can lock or wipe the phone remotely.
- Save your operator’s and bank’s helpline numbers somewhere you can reach without your phone.
Frequently Asked Questions
Can someone use UPI from my stolen SIM without internet?
Yes. *99# is NPCI's USSD service for UPI and works on any phone without internet, using the mobile number linked to your bank.
What is the first thing to do if my phone is stolen?
Block your SIM by calling your operator from another phone. That stops OTPs reaching the thief.
How do I block a stolen phone in India?
Use the Sanchar Saathi portal to block the handset by IMEI. You'll need a police complaint number.
Will I get my money back after UPI fraud from a stolen phone?
Under RBI rules, if the fraud comes from a third-party breach and you report it to your bank within three working days, your liability is zero.
What is a SIM PIN?
A code your phone asks for when the SIM is put into a device or restarted. It stops a thief using your SIM in another phone.
Sources
- Pune Now: SIM-based UPI fraud advisory (Maharashtra Cyber)
- Indian Bank: *99# USSD service SOP
- Sanchar Saathi (DoT)
- RBI: Limiting liability of customers in unauthorised electronic banking transactions
- National Cyber Crime Reporting Portal