The Rise of SIM Farms and Digital Identity Abuse in India: Understanding the Growing Threat of SIM Muling
Introduction
In today's interconnected world, a mobile phone number is an inseparable element of digital identity. By this number, digital identity is connected to the user's bank and social media accounts among other digital services. Unfortunately, this dependence has created a possibility for criminal use of the mobile connection and conducting digital frauds.
One of such new threats is SIM muling, when SIM cards are acquired and used in someone else's name. By using it, SIM cards can be used as SIM farms and used for committing scams and other digital frauds such as phishing, impersonation, or OTP fraud. Another concern of SIM muling is the registered SIM owner is not always the user of the SIM.
Understanding SIM Muling and the Rise of SIM Farms
SIM muling refers to the disjunction between the registered user and the SIM subscription. Criminals pay a fee to individuals to get a SIM or rent an existing SIM. Alternatively, they buy several SIM cards using fabricated identification documents. In contrast, SIM farms are a coordinated structure of many SIMs that use devices to send messages, make voice calls, and communicate via data.
Sometimes the two are interdependent: SIM farms can include SIM cards procured using SIM muling. With SIM farms, the problem that fraudsters create for users is creation of several phone numbers so that people do not try to identify the fraud
How SIM Farms are Enabling Cybercrime
One problem mobile connections at a larger scale provides to cybercriminals is the scale at which Phishing/impersonation can take place.
- Fraudsters can create several different fraudulent accounts using many mobile connections to create fraudulent messages to bank customers, government officials, or others.
- Multiple mobile connections provide more opportunities for OTP fraud and other crimes to be conducted with fraudulent mobile accounts. Some of the OTP fraud mechanisms require users to gain control over a fraudulent SIM to be able to capture and/or verify an OTP message, or to gain access to an account or other information.
- Several fake accounts and scams can be created by registering a number of fake mobile accounts. The account and scams can also be verified and cross-verified through multiple mobile accounts.
- When fraudsters use a number to register mobile connections to conduct fraudulent calls, it creates difficulties for authorities when trying to verify the identity of the person who committed the fraudulent communication.
This use of SIM cards by cybercriminals helps to facilitate multiple types of cybercrimes and scams, so telecom abuses at a smaller scale may be a symptom of a larger, more coordinated effort.
Digital Identity Abuse
The fact that people's identities are misused is the most problematic part of SIM muling. A person can think that they are helping others and making some quick cash. Once they open these connections for other people, they lose the ability to manage them. Fraudulent PoS agents can open a connection in a person’s name without their knowledge, by using their ID documents.
For example, in 2026, the Chhattisgarh Department of Telecommunications discovered that a PoS agent had used the IDs of 25 unsuspecting customers to activate 25 mobile numbers. That PoS agent was put on a blacklist, and their association with the department was re-investigated. Identity theft in the digital era can be simple, with low tech methods of stealing ID information, as well as an abuse of access to such information, having devastating consequences.
India's Legal & Regulatory Response
It should be noted that the Indian legislature has made provisions that address the issues relating to the misuse of identity especially within the telecom sector. One such statutory provision is contained in the Telecommunications Act 2023. Section 42(3)(e) provides for penalization for acquiring of SIMs or other telecommunication identifiers through means of fraud, cheating or impersonation. Section 42(3)(c) on the other hand addresses the issue of tampering with the telecommunication identifiers. The Telecommunications Act, 2023 provides for an imprisonment of up to three years and/or fine of up to rupees fifty lakh or both for offences under section 42(3). The concept of abetment has been dealt with separately in section 42(6). Moreover, section 66C and 66D of the Information Technology Act 2000 might apply where the facts show that there has been identity theft and/or cheating by impersonation using computer resources.
Measures for prevention adopted by the Department of Telecommunications:
- Sanchar Saathi: Allows them to see which mobile connections are registered in their names and report the mobile connections that they did not get or need.
- ASTR (Artificial Intelligence and Facial Recognition Powered Solution for Telecom SIM Subscriber Verification): leverages analytics to detect suspicious mobile connections and to re-verify.
- SIM-binding directions: In November 2025, DoT issued directions for communicating apps to maintain a linkage with the SIM which has been issued to the user bearing the mobile number with a requirement of periodic logout from web sessions as well.
These measures are indicative of a commitment to enhancing accountability and traceability in the telecom industry in India.
Challenges and the Way Forward
Despite these measures, tackling SIM muling requires more than simply increasing the number of verification checks. First, accountability needs to be extended further out from the registered subscriber to the intermediaries and Point of Sale (PoS) agents who enable the fraudulent activations. Secondly, there is a need to have good monitoring systems in place to detect expensive bulk SIM acquisitions and suspicious SIM use activity. Third, citizens' awareness is a must.
Users need to be aware that an SIM registered in their name can cause legal and financial hassles if it is shared or rented out. Meanwhile, investigations need to differentiate between knowingly participating in a fraud scheme and the use of an individual's identity without his or her consent. A balanced approach needs to be a combination of better verification, responsible data management, timely reporting systems and the cooperation between telecom operators, law-enforcement and digital platforms.
Conclusion
The existence of SIM farms in India is one of the numerous security problems which have been affecting India. There are many security problems related to India, but SIM farms and the abuse of mobile connections often do not receive the attention they deserve. Although the users of digital communication devices view mobile numbers as yet another medium to communicate, there is so much more to them. A mobile number is more than that. It is the means of linking to the online activities and banking of the user. It is also a tool for connecting to online services. Therefore, this is an urgent need to take measures to combat SIM muling.
As any digital security initiative worth its name, the users are also important here. The users should never sell, rent or lend their SIM cards while service providers and the regulatory authorities must exercise more surveillance and supervision. What is important is that those people whose names were used improperly should not be treated as criminals without any evidence pointing at them, even if the SIM card is more than just a card. In fact, keeping it secure is essential for digital security.
References
1. Department of Telecommunications, Ministry of Communications, Department of Telecommunications (DoT) Cautions About Misuse of Telecom Resources, Press Information Bureau (Mar. 4, 2025).
2. Telecommunications Act, 2023, § 42, Government of India.
3. Information Technology Act, 2000, §§ 66C–66D, Government of India.
4. Department of Telecommunications, Measures to Combat Telecom-Related Frauds, Press Information Bureau (Feb. 6, 2025).
5. Department of Telecommunications, DoT's Directions for SIM Binding for Prevention of Misuse of Telecommunication Identifiers, Press Information Bureau (Dec. 1, 2025).
6. Ministry of Communications, Measures Taken to Tackle Cyber Frauds, Press Information Bureau (July 23, 2026).
7. Department of Telecommunications, DoT Mumbai Cautions Citizens Against Fraudulent SIM Issuance, Misuse of Telecom Identifiers and IMEI Tampering, Press Information Bureau (Sept. 22, 2026).
8. Sanchar Saathi Portal, Department of Telecommunications, Government of India.
Related Blogs
Executive Summary
A video is going viral on social media in the name of the protests organised by the ‘Cockroach Janata Party’ (CJP) in Delhi on October 10 and 11. The video is being shared as footage from Delhi Railway Station, with the claim that the protests led to a massive traffic jam outside the station. CyberPeace Research conducted a detailed analysis of the viral video and found the claim to be misleading. The video is not from Delhi but from Sealdah Railway Station in Kolkata, where students held a protest in July 2026. The old video from that time is now being circulated in connection with the protests in Delhi, falsely linking the two events.
Claim
On October 10, 2026, the Facebook page ‘Atrangi Khabar’ shared a video with the following caption:“Massive Protest and Traffic Jam: Huge Crowd Gathers Outside Delhi Railway Station, Several Passengers Miss Their Trains! A massive traffic jam occurred outside Delhi Railway Station on Saturday due to a large-scale protest.
As a result, railway passengers faced severe difficulties reaching the station, and several passengers even missed their trains because of the traffic congestion. The video clearly shows a huge crowd filling the roads and an atmosphere of chaos all around.”
https://www.facebook.com/reel/2176543963241315/?s=single_unit
Fact Check
To verify the authenticity of the viral video, we first extracted several keyframes and searched them using Google Lens. We found that the video had been uploaded on multiple platforms on earlier dates. An Instagram account named ‘Faruk Biswas’ (faruk.biswas.581730) had shared the video on July 24, 2026, identifying it as footage of a student protest in Kolkata.
https://www.instagram.com/reels/DbLd3N3of7a/
During our search, we also found the same video on a Facebook page named ‘KaimurLive’. The caption accompanying the video read, “Student protests continue in Kolkata and several other parts of the country. Today, a massive gathering of students was seen on the streets of Kolkata. #NEETPaperLeak”
http://facebook.com/reel/2024661971511084
Conclusion
Our research found the viral post to be misleading. An old video from Sealdah Railway Station in Kolkata is being falsely shared as footage from Delhi Railway Station. The original video dates back to July 2026 and has no connection to the protests held in Delhi on October 10 and 11, 2026.
Executive Summary
A video is being widely shared on social media claiming that a leopard dragged away a passenger from a moving train. Several users are circulating the clip as a real incident. However, CyberPeace Research Wing research found the claim to be false. Our research revealed that the viral video is not real and was generated using Artificial Intelligence (AI).
Claim
An X user (formerly Twitter) shared the viral clip with the caption:“A leopard snatched a man from a moving train.”The link, archived version, and screenshot of the post are provided below.
Fact Check
On closely examining the video, several visual inconsistencies were noticed. The leopard’s body appears distorted at multiple points in the clip. In some frames, parts of the animal’s body seem to merge into the background, while in others, sections appear incomplete or disappear entirely — something not typically seen in authentic footage. In the final part of the video, where the leopard is allegedly shown attacking a passenger, the person’s hands, limbs, and body also appear blurred and distorted. Additionally, unusual and selective blurring can be observed throughout the video, indicating possible editing or AI manipulation.
To further verify the clip, we scanned the viral video using the AI detection tool Sightengine. According to the results, the video showed an 86 percent probability of being AI-generated.
As part of the research , we also analysed the clip using another AI detection platform, UndetectableTM AI, which likewise indicated that the viral video was AI-generated.
Conclusion
Our research found that the viral video claiming to show a leopard dragging away a passenger from a moving train is fake. The clip is AI-generated and does not depict a real incident.
Introduction
Data protection has been a critical aspect of advocacy and governance all across the world. Data fuels our cyber-ecosystem and strengthens the era of emerging technologies. All industries and sectors are now dependent upon the data of the user. The governments across the world have been deliberating internally to address the issue and legality of Data protection and privacy. The Indian government has witnessed various draft bills and policies focusing on Data protection over the years, and the contemporary bill is the Digital Personal Data Protection Bill, 2023, which was tabled at the Lok Sabha (Lower House of Parliament) on 03 August for discussions and parliamentary assent.
What is DPDP, 2023?
The goal of the complete and comprehensive Digital Personal Data Protection Bill of 2023 is to establish a framework for the protection of personal data in India. The measure acknowledges the significance of protecting personal data and seeks to strike a balance between the necessity to process personal data for legitimate purposes and the right of individuals to do so. The bill establishes a number of crucial expressions and ideas associated with the protection of personal data, including “data fiduciary,” “data principal,” and “sensitive personal data.” It also emphasises the duties of data fiduciaries, including the need to establish suitable security measures to preserve personal data and the need to secure data principals’ consent before processing their personal information. The measure also creates the Data Protection Board of India, which would implement its requirements and guarantee data fiduciaries’ compliance. The board will have the authority to look into grievances, give directives, and impose sanctions for non-compliance.
Key Features of the Bill
The bill tabled at the parliament has the following key features:
- The 2023 bill imposes reasonable obligations on data fiduciaries and data processors to safeguard digital personal data.
- Under the 2023 bill, a new Data Protection Board is established, which will ensure compliance, remedies and penalties.
- Under the new bill, the Board has been entrusted with the power equivalent to a civil court, such as the power to take cognisance in response to personal data breaches, investigate complaints, imposing penalties. Additionally, the Board can issue directions to ensure compliance with the act.
- The 2023 bill also secures more rights of Individuals and establishes a balance between user protection and growing innovations.
- The bill creates a transparent and accountable data governance framework by giving more rights to individuals.
- There is an Incorporation of Business-friendly provisions by removing criminal penalties for non-compliance and facilitating international data transfers.
- The new 2023 bill balances out fundamental privacy rights and puts reasonable limitations on those rights.
- The new data protection board will carefully examine the instance of non-compliance by imposing penalties on non-compiler.
- The bill does not provide any express clarity in regards to compensation to be granted to the Data Principal in case of a Data Breach.
- Under 2023 Deemed consent is there in its new form as ‘Legitimate Users’ pertaining to the conditions in regard to Sovernity and Intergrity of India.
- There is an introduction of the negative list, which restricts cross-data transfer.
Additionally, the measure makes special provisions for the processing of children’s personal data and acknowledges the significance of protecting children’s privacy. Additionally, it highlights the rights of the data subjects, including their right to access their personal information, their right to have wrong information corrected, and their right to be forgotten.
Drive4CyberPeace
A campaign was undertaken by CyberPeace to gain a critical understanding of what people understand about Data privacy and protection in India. The 4-month long campaign led to a pan-India interaction with netizens from different areas and backgrounds. The thoughts and opinions of the netizens were understood and collated in the form of a whitepaper which was, in turn, presented to Parliamentarians and government officials. The whitepaper laid the foundation of the recommendations submitted to the Ministry of Electronics and Information Technology as part of the stakeholder consultation.
Conclusion
Overall, the Digital Personal Data Protection Bill of 2023 is an important step towards safeguarding Indian citizens’ privacy and personal data. It creates a regulatory agency to guarantee compliance and enforcement and offers a thorough framework for data protection. The law includes special measures for the protection of sensitive personal data and the personal data of children and acknowledges the significance of striking a balance between the right to privacy and the necessity of data processing.
