How do banks and fintechs stop SIM-swap and OTP fraud?
Short answer
SIM-swap and OTP fraud work by getting control of a customer's phone number or tricking them into sharing a one-time PIN. Relying on the SMS code alone is not enough. Stronger defences combine signals at the moment of the transaction, such as a recent SIM change, a new device, or an OTP being entered while the customer is on a call, and hold or block the payment before money moves.
How the attacks work
In a SIM swap, a fraudster gets a victim's number moved to a SIM they control, so one-time PINs sent by SMS go to the fraudster. In OTP phishing or vishing, the fraudster calls the victim, pretends to be the bank, and talks them into reading out or entering the code.
The US National Institute of Standards and Technology (NIST) classes out-of-band verification over the public phone network, which includes SMS codes, as a "restricted" authenticator in its digital identity guidelines, because of risks such as SIM change and number porting.
Signals that catch fraud in real time
Useful signals at transaction time include:
- A recent SIM change on the customer's number
- A new device appearing shortly after a SIM change
- An OTP being entered while a phone call is active
- Pasted account numbers, unusual typing cadence or payment velocity
- A recipient account linked to known mule networks
How PayGuard applies this
PayGuard, which we built, makes fraud decisions in under 100ms. SIM Swap Defender freezes outbound transactions when a new device appears within 48 hours of a SIM change. OtpGuard detects OTP entry during an active call and shows a full-screen scam warning. Transaction Guard scores outbound payments, and Fraud Ring Intel uses a Neo4j graph to link accounts and find mule networks. It ships as Android and iOS SDKs with a REST API and a sandbox.
Where to find South African fraud data
The South African Banking Risk Information Centre (SABRIC) publishes crime statistics and awareness material for the South African banking industry. Use its latest reports for current figures.