They took the SIM and emptied the account: what should you do, and who answers for it?

The phone goes dead for no reason and, when service comes back, the alerts arrive all at once: transfers, cash advances, sometimes a consumer loan nobody asked for. It is called SIM swap, and it has two possible defendants: the bank that never stopped abnormal activity, and the carrier that handed over the line without checking who was asking. What to do in the first hours, and what to demand in writing.

The phone reads “No Service”. There is no outage in the area, nobody is standing in a basement, and restarting the handset changes nothing. Hours later, when the line comes back, the alerts land all at once: a transfer, a cash advance, sometimes a consumer loan nobody applied for. That silence was not a coverage problem. It was the window in which somebody else had the number.

The pattern has a name and it has numbers. In its technical report on payment fraud, published in July 2025, Chile’s consumer protection agency reviewed the 9,899 fraud complaints it received during 2023 and found that identity impersonation accounted for 24% of them. The same report devotes a section of its own to frauds that begin with a fraudulent number port, and the agency later issued a dedicated guide on SIM swapping.

This guide covers three things: what to do in the first hours, why the account holder does not lose the statutory protection even though the codes arrived on their own handset, and who to pursue. Because here there are two possible defendants, and neither one should be let go.

SIM swap, porting and a duplicate chip are three different things

A SIM swap is the hijacking of a phone number. The criminal gets the line working in a chip he controls and, from that instant, receives the calls, the messages and the verification codes the bank sends out.

In everyday talk this gets called SIM cloning, or having your number stolen, and the point is worth getting right: nothing is cloned and no card is copied. The line moves. It stops working in the holder’s handset and starts working in the criminal’s, who runs the scam from there. At bottom it is identity theft carried out on a phone line.

There are three technical routes, and the difference matters because it decides who to pursue.

Fraudulent porting. The number is moved to another carrier by someone posing as the holder. The regime comes from Law No. 20,471 (Ley N° 20.471), which created the number portability implementing body, and from the regulation issued by the Ministry of Transport and Telecommunications. Since Decree No. 6, published on November 5, 2024, that regulation puts it plainly: verifying the identity of whoever requests the port is the receiving provider’s responsibility. The same decree added a mechanism to cancel a completed port where the receiving provider detects circumstances the subscriber is not to blame for, and made both carriers responsible for restoring the technical and commercial terms that applied before.

Duplicate or replacement chip inside the same carrier. No operator changes here: the criminal asks for a new chip on a line that is not his. A good share of cases work this way rather than through porting, which matters a great deal, because both the audit trail and the liability stay with the holder’s own carrier. Exempt Resolution No. 566 of 2024, issued by Chile’s telecommunications regulator, requires that every SIM card activation, whether handled in person, by phone or online, satisfy at least one of three standards: live fingerprint biometrics, facial biometrics with liveness detection, or an advanced electronic signature. And it adds what tends to decide a case in court: the result of that check must enter the provider’s commercial system automatically, with no human intervention, and only a correct result allows the request to proceed. Outsourcing the front desk does not dilute the obligation.

eSIM activation. The same operation on a digital SIM, on another device, with no physical chip involved.

In all three the outcome is identical: the holder loses signal and the criminal starts receiving the codes.

Losing signal is the first alarm. What to do in the first hours

When the line dies for no reason and a restart does not bring it back, treat it as fraud immediately. That silence is precisely the window in which the criminal works, and it does not tend to last long.

In the first minutes. Call the carrier from a different phone. Ask for the line to be blocked and for the port or chip replacement to be reversed, and write down the time and the reference number. In parallel, reach the bank from another device and over a network other than the compromised handset’s.

In the first hours. Give the bank notice of fraud and freeze the products, either by dialling 1212 from any phone in Chile or through the institution’s emergency line, and insist on the reference number with date and time. Then file the formal claim disputing the transactions, on the simple sworn statement the statute requires. That claim is what starts the refund clock, so do not wait to assemble everything else first. Change the passwords on the email account and on the banking service too, from a device that is not the affected one.

In the first days. File the criminal complaint with the uniformed police, the investigative police, the prosecutor’s office or any court with criminal jurisdiction, and get the receipt to the bank. Two clocks are worth keeping apart here: the receipt must arrive before the refund deadline expires and, if it arrives later, the bank holds the funds and then has 24 hours from the moment it is handed in to release them. There is also a hard stop: if 30 calendar days pass from the claim without the complaint being filed, the statute treats the user as having withdrawn it and no refund is due. In those same days, request the records in writing from both the bank and the carrier, and recover the legitimate chip.

Two points about the claim decide whole cases. It goes in within 30 business days of the notice, and it can cover transactions from the 60 calendar days before that notice. That look-back window is what rescues anyone who finds out late, which in a SIM swap is the norm: the holder had no signal and no alerts precisely while it was all happening.

The codes reached the phone. Why that is not the customer’s fault

This is the heart of it, and it is where banks usually anchor their refusal.

Strong customer authentication rests on factors that are supposed to be independent: something you know, something you have, something you are. The trouble is that today the message carrying the code, the banking app, the biometrics and the recovery mailbox all live on the same handset. An impersonated chip does not knock out one factor: it knocks out several, and with them the independence that gives the model its meaning. Delegated Regulation (EU) 2018/389, which shaped the design copied across much of the world, puts it this way in its article 9: the breach of one element must not compromise the reliability of the others, and specific measures are required where several of them are used on the same multi-purpose device.

The NIST guidance points the same way and deserves to be quoted precisely, because it does not say what is often attributed to it. Its July 2025 revision classifies sending codes over the public telephone network as a restricted authenticator, with concrete duties for whoever uses it: offer the subscriber at least one unrestricted alternative, give meaningful notice of the risk, and plan for migration. And it recommends, as good practice rather than as a requirement, that risk indicators such as a device swap, a SIM change or a number port be considered before a code is sent that way. It is a recommendation, not an obligation, but it describes exactly what a diligent system should have been looking at.

Even so, the strongest argument is not a foreign one. Authentication does not release the bank from its duty to monitor, and in Chile that duty is written into the statute. Article 6 of Law No. 20,009 (Ley N° 20.009) requires issuers to run monitoring systems that detect transactions inconsistent with the user’s usual behavior, to have internal procedures for handling the alerts those systems raise, to identify potential fraud patterns, and to set limits and controls across their channels. These are free-standing obligations: they are breached even where the password was entered correctly. General Rule No. 538 of the financial regulator, issued in June 2025, fleshes out those minimum security, record-keeping and authentication standards, and its mandatory strong authentication use cases have applied since July of this year.

In practice, a reasonable fraud engine should have flagged signals like these: a newly enrolled handset, a recent SIM change or number port, a password change followed by transfers, activity in the small hours, an unfamiliar IP address or location, cash advances on a customer who never takes them, consecutive transfers to new payees, and a consumer loan applied for remotely. None of that calls for exotic technology. All of it sits in the bank’s own logs.

Chile’s Supreme Court has been saying much the same. In January of this year, in case No. 38,510-2025, it set out the reach of the statutory concept of fraud and rejected any requirement that the bank’s security systems be breached, or any distinction based on where the deception came from. And in July, in case No. 51,579-2024, it let stand the judgment against Scotiabank ordering it to pay $17,389,624 pesos to a customer whose account was drained in three transfers from an unfamiliar IP address, after a loan was taken out in his name, with the bank neither blocking nor flagging anything.

Who answers for it, the bank or the carrier?

Both, along separate routes. That split is not a tactic: it is the structure of a SIM swap, where one company hands over the number and another accepts what is done with it.

The bank is pursued under Law No. 20,009. Given timely notice, the issuer must refund, and if it wants out on the theory that the user acted with willful misconduct or gross negligence, its only route is to go to the local police court, Chile’s small-claims consumer forum, and prove it there. It cannot decide the point itself or close the file with a letter. Until that ruling exists the refund obligation stands, and ignoring it opens a complaint to the consumer protection agency, an infringement action under Law No. 19,496 (Ley N° 19.496) and a constitutional protection petition.

What cuts the other way is worth saying too, because finding out late is expensive. The statute lets the issuer suspend the refund where it gathers sufficient evidence, provided it asks the local police court for authorization within a short window, and it sets out a catalogue of presumptions of willful misconduct or gross negligence by the user. Which is why the quality of the account and of the evidence matters from day one: in a SIM swap the holder surrendered no password and did not even control the line, and that needs to be on the record before the argument moves to a courtroom.

The carrier is pursued for something else: for handing over the line without checking who was asking. The duty is express and falls on the receiving provider in a port, and on the holder’s own carrier where a new chip is activated. On that footing sit the duty of security and the duty of information under Law No. 19,496, with their infringement action and their damages claim. The complaint goes to the carrier and to the telecommunications regulator, and the breach is proved, once again, out of the records the company itself is required to keep.

And this is no longer theory. In May of this year the Rancagua Court of Appeals ordered Entel PCS Telecomunicaciones S.A., with costs, to pay $2,000,000 pesos in moral damages to a customer whose number was ported without her identity being checked, which let strangers take over the line and run up fraudulent purchases. The judgment, unanimous, reversed on that point the September 12, 2024 ruling of the Santa Cruz local police court in case no. 104,066-23, which had dismissed the civil claim, and left standing the 10 UTM fine payable to the municipality for breach of the consumer statute.

The reasoning is the part worth keeping. The court refused to treat the matter as the ordinary inconvenience of a breach of contract: the consumer lost control of her number, her digital security was compromised and she was left exposed to transactions by strangers, all of it, the judgment says, flowing from deficient verification and control by the service provider. And it added the line that takes the measure of the harm: a phone number today gives access to significant private information, commercial and social alike. That sentence describes precisely why a SIM swap is not a telephony problem.

The evidence to demand in writing

This is the part that decides cases, and the part almost nobody asks for in time. Request it in writing, from the bank and from the carrier, and keep the date:

• The porting or chip replacement request, with the identity verification methods used and their result.
• The device and enrolment history on the account.
• Password change logs, with IP address and location.
• The risk score assigned to each transaction, the alerts the fraud engine raised, who reviewed them and what was decided.
• The call centre recordings, both the holder’s calls and those of whoever called posing as him.
• The limits and thresholds policy applying to the affected products.

If the answer is that no such records exist, that answer is useful too: it reveals a control failure in the party that was required to keep them. Get it in writing and ask for the same material through the courts.

Mistakes that cost the claim

• Do not reschedule the debt the fraud created.
• Do not sign settlements or out-of-court waivers, least of all for less than the amount taken.
• Do not accept a new loan to cover what was stolen. It can be read as acknowledging the debt.
• Do not argue over the phone what belongs in writing, and do not call back the number the calls came from.
• Do not let the deadlines lapse. They run from the notice and from the claim, not from the day the story becomes clear.

When the bank refuses, or sues

It happens, and it is not the end of the road. Rather than absorb the cost, several banks sue the customer in local police court for inexcusable negligence. The victim becomes the defendant, frequently litigating on two fronts.

There is a defense. The burden of proving willful misconduct or gross negligence is the bank’s, each transaction is judged on its own, and the bare record that the passwords were used proves nothing, because in every impersonation fraud the passwords are used. In a SIM swap the point is plainer still: the holder handed over no data and was cut off while the transactions went through. We cover that stage in detail in what to do after bank fraud and how to defend yourself when the bank sues.

What to do, with whom, and by when

The bank must refund unless it proves willful misconduct or gross negligence before the local police court. That is the order of things, and it does not reverse because the institution asserts otherwise in a letter.

Making it harder to happen again

• Set a PIN on the SIM card, the cheapest protection there is and the one almost nobody turns on.
• Avoid text messages as a second factor wherever an alternative exists, and prefer an authenticator app or a hardware key.
• Turn on every bank alert, including device enrolment and password change.
• Use a recovery mailbox that does not depend on the same phone.
• If signal disappears for no reason, do not wait: call the carrier from another handset and check the account from a different device.

One recent development is worth adding. Since August 20 of this year Chile requires telephone service users to be registered and identified, an obligation Law No. 21,729 (Ley N° 21.729) wrote into the General Telecommunications Act, reaching prepaid lines as well and tying every number to an identity and to the handset identifiers. It does not prevent the fraud, but it makes whoever received the chip traceable, which is exactly what most of these investigations were missing.

Two fronts, and neither closes by itself

A SIM swap looks like a technology problem and turns out to be an identity verification problem: somebody handed a line to a person who was not its holder, and somebody else accepted as genuine the transactions that followed. Chilean law splits those two responsibilities and does not make the victim choose between them.

What actually decides the outcome is what gets done in the first hours: the reference number for the notice, the claim filed on time, the criminal complaint with its receipt, and the written request for the records. None of those four is hard to obtain on day one. All of them are impossible to manufacture later.

This article is general information and not legal advice on any specific matter. The legislation and case law cited should be checked in their current form before any decision is taken. If your chip was swapped or your line ported without authorization and your accounts were used as a result, get in touch and we will review your position through our Banking Fraud practice.