SIM-Swap Fraud Targeting Vodafone Customers
Criminals impersonate Vodafone customers at stores or through customer service to transfer a victim's number to their SIM, intercepting SMS-based security codes to seize bank and email accounts.
Part of: SIM Swap Scams
Last reviewed: 8 June 2026
Vodafone operates across multiple countries in Europe, Africa, and Asia-Pacific, making it a high-value target for SIM-swap fraud with an international reach. In the UK, where Vodafone has a large subscriber base, SIM-swap fraud has been linked to significant banking losses reported to Action Fraud.
The mechanics are the same as with any mobile carrier: the attacker gathers personal information about the victim, impersonates them to Vodafone customer service or a retail store, and requests that the number be moved to a new SIM. Once the transfer completes, the victim's handset loses service and the attacker receives all SMS messages, including bank OTPs.
Vodafone's UK and European operations require customers to provide account passwords and sometimes answer security questions. Attackers overcome these barriers using information from data breaches, social media profiling, and targeted phishing attacks conducted against the victim before the SIM-swap attempt is made.
How this scam works on the Vodafone brand
In the UK, Vodafone customers can request a PAC (Porting Authorisation Code) to transfer their number to another carrier. Criminals exploit this by calling Vodafone, passing identity checks with stolen personal data, obtaining the PAC, and porting the number to a low-cost SIM on a rival network — effectively hijacking the number away from Vodafone entirely.
Within Europe, similar porting systems exist under EU regulations, and attackers exploit automated online porting processes. In some African Vodafone markets, agents at third-party reseller outlets have been implicated in fraudulent SIM replacements.
After the swap, attackers typically target UK bank accounts, which commonly use SMS OTPs for Faster Payments authorisation. The window of attack is brief — the victim's phone going silent typically triggers suspicion within hours — so attackers move rapidly and aim for high-value transfers.
Common red flags
- Your Vodafone phone loses all service unexpectedly with no outage reported in your area
- Vodafone sends an email or letter confirming a SIM replacement or PAC request you did not make
- Online banking alerts for large or unusual transactions begin arriving on your secondary email
- You cannot receive verification texts from your bank or email provider
- My Vodafone shows a recent login from an unfamiliar device or location
- You receive a call or text claiming to be Vodafone asking you to confirm personal details for a security check you did not request
How to protect yourself
- Set a strong memorable word or security PIN on your Vodafone account that must be given before any SIM change is processed
- Opt for app-based or email-based two-factor authentication rather than SMS for banking and email wherever possible
- Ask Vodafone to add a note to your account requiring in-store ID verification before any SIM change
- Monitor your phone service closely — any unexpected loss of signal should prompt an immediate call to Vodafone from another line
- Register for credit-alert services with Experian, Equifax, or TransUnion to spot new accounts opened in your name
- Keep a secondary phone or Wi-Fi calling route available so you can contact your bank immediately if Vodafone service goes dark
How to report it
- Call Vodafone UK fraud on 191 from another phone, or +44 7836 191 191 from abroad, to report the unauthorised SIM change
- Report to Action Fraud at actionfraud.police.uk (UK) or your national cybercrime body in other Vodafone markets
- Contact your bank immediately to freeze accounts if you suspect intercepted OTPs have enabled fraud
- File a report with the Information Commissioner's Office at ico.org.uk if you believe your personal data was misused
- In EU countries, report to your national data protection authority
Frequently asked questions
What is a PAC code and how can it be misused?
A PAC (Porting Authorisation Code) lets you take your Vodafone number to a new carrier. If a criminal requests a PAC in your name by passing Vodafone identity checks, they can move your number away from you entirely. Vodafone should send any PAC by text to your current number — if you never receive one but your number is ported, report it immediately.
Can Vodafone reverse a fraudulent SIM swap?
Yes, if you report it quickly. Vodafone can reactivate your original SIM. If the number was ported to another network, there is a regulatory process to recover it, though it may take longer.
Which Vodafone markets are most affected by SIM-swap fraud?
SIM-swap fraud is most commonly reported in the UK and South Africa, where it has been linked to significant banking losses. The UK's Action Fraud receives hundreds of SIM-swap reports annually.