All it takes is someone on the other end of the line who skips asking for ID
On a Tuesday morning your phone loses signal. Nothing unusual — it happens, especially if you work somewhere coverage is patchy. You carry on with your day: you serve customers, send a few messages from your computer, don’t think twice about it. By the afternoon you check your business account online and there are several thousand euros missing.
Your phone isn’t broken. Someone requested a duplicate SIM card from your carrier, pretending to be you, and the carrier handed it over without properly checking who they really were.
This isn’t a one-off case or an internet myth. Spain’s Data Protection Agency (AEPD) has spent years fining phone carriers for issuing duplicate SIM cards without correctly verifying the requester’s identity — Digi alone has been fined more than €1.2 million for this exact reason, and across the sector the total already tops €5.8 million. In one of the best-known cases, a customer had €800 stolen after a store handed over her duplicate SIM without asking for the original ID document. The fine against the carrier: €200,000 — two hundred and fifty times the actual damage, a sign of how seriously the regulator treats this failure.
How you get robbed without anyone touching your phone
The attack is called “SIM swapping” and you don’t need to be a hacker to pull it off. What you do need is a handful of basic details about the target: full name, ID number, date of birth — details that have often already been harvested through a phishing email or text pretending to be from the bank, the tax office, or the carrier itself.
Armed with that, the attacker calls the carrier pretending to be you: “I’ve lost my phone, I need a replacement SIM.” If the person on the other end of the line doesn’t require the original ID document — or settles for someone reciting a name and date of birth — the duplicate goes through. Your real SIM gets deactivated, which is the exact moment you “lose signal,” and the copy starts working in the scammer’s phone instead.
From there, everything that arrives by SMS arrives to them: your bank’s verification code, your WhatsApp Business confirmation, the two-factor code for any account that uses your number as a backup. It’s as if someone made a copy of your business’s front-door key by calling the locksmith and claiming they’d lost theirs, without showing any paperwork to prove it.
And we see it every week: the failure isn’t yours, it’s the protocol’s
This isn’t an isolated case at one unlucky carrier. Across several companies, fines for this exact same failure — duplicating a SIM without properly checking who’s asking for it — have been piling up for years, and the list of AEPD rulings keeps growing. It’s a weak point in the sector, not in one particular brand.
And here’s the uncomfortable part for any business: your mobile number isn’t just for calls. It’s the spare key to your online banking, to your WhatsApp Business, to the office line you forward to your mobile when you step out. If that key can be copied with a phone call and a couple of details anyone could find, the problem isn’t yours to begin with — it belongs to whoever decides how easily that copy gets handed out.
What you can do today, without waiting for your carrier to fix it
Ask for a SIM PIN or duplicate-blocking service from your carrier. Most offer it, few customers ever turn it on — it’s a five-minute phone call.
Don’t rely on SMS alone as your second factor. For banking and WhatsApp Business, turn on an authenticator app (Google Authenticator, Microsoft Authenticator) wherever the service allows it: a duplicated SIM is useless to an attacker if the code never travels by text.
If you lose signal for no clear reason, don’t ignore it. Ten minutes without a signal could just be a saturated mast. Past half an hour, call your carrier from another line and ask directly whether any duplicate SIM has been issued under your name.
Ask your carrier today exactly what it requires to issue a duplicate SIM. If the answer is “your name and date of birth,” you already know where the gap is — before you ever need to find out the hard way.
The question isn’t whether your carrier can fail at this. It already has, more than once, at more than one company, and the data protection regulator has put it in writing. The real question is whether you know the answer to the question above before you need it — or whether you’ll learn it the day your signal drops for no reason.
Not a sales pitch, just something you should know: at Netteleco we sell business mobile lines, and one of the first questions we ask any carrier before working with them is this exact one — what protocol do they require to issue a duplicate SIM. If you’d like us to check yours, get in touch.
