SIM PIN & Call Forwarding Security — Full Guide
A stranger doesn't need your password, your phone, or even a text message to take over your WhatsApp or intercept a banking OTP. All they need is for you to dial one short code yourself, usually while believing you're confirming a delivery or verifying an account. That code silently tells your own network to forward your calls to their number, and from there, the rest of the takeover writes itself. This has genuinely happened to real people — documented by security researchers, not just a cautionary story — and the fix takes less time to learn than the scam takes to run.
Never dial a code someone else tells you to dial, especially one starting with * or #. That's how call forwarding gets silently switched on. This guide covers exactly how the trick works, the real codes to check and turn it off, and the second half of phone security most people skip entirely — locking your SIM itself with a PIN.
Here's the shape of the problem before the fix.
- What call forwarding actually is
- The trick that's hijacked real accounts
- The four forwarding codes, decoded
- Checking if forwarding is already on
- Turning it all off, in one code
- SIM PIN — the other half of this guide
- Setting your SIM PIN, step by step
- Which forwarding code applies to me?
- A realistic scenario
- Run your own security audit
- Claims I couldn't verify
- FAQs
What Call Forwarding Actually Is
Call forwarding is a completely legitimate, decades-old telecom feature. It lets your incoming calls automatically redirect to another number — useful when your phone's off, out of coverage, or you simply want calls to ring somewhere else. Every SIM on every network has this feature built in by default, sitting dormant until someone activates it, whether that's you or, in the scenario this guide is really about, someone else using you as the unwitting middleman.
It's controlled entirely through short dial codes, technically called MMI codes (Man-Machine Interface codes) — the same star-and-hash sequences you might already recognise from checking your balance. That's exactly why the trick works: dialling a string of stars, hashes, and digits doesn't look dangerous. It looks like exactly the kind of thing a phone company might legitimately ask you to do.
The Trick That's Hijacked Real Accounts
Security researcher Rahul Sasi, founder of the cybersecurity firm CloudSEK, documented this method in detail, and BleepingComputer independently tested and confirmed it works. The sequence is almost insultingly simple. An attacker calls the target, often posing as a delivery courier, a bank representative, or customer support, and asks them to dial a specific number to "confirm" something — the delivery address, a verification step, anything plausible. That number is preceded by a call-forwarding code and followed by a phone number the attacker controls.
The moment the victim dials it and presses call, their carrier forwards their calls to the attacker's number, sometimes only when the line is busy, sometimes unconditionally, depending on which code was used. Minutes later, the attacker starts registering the victim's WhatsApp on a new device and chooses to receive the verification code via voice call instead of SMS. That call goes straight to the attacker's forwarded number. The victim never sees a single OTP, and by the time they notice their WhatsApp has logged them out, the account already belongs to someone else.
News outlets have reported real victims describing this exact sequence — a courier-impersonation call, a code to "dial to connect," and a hijacked account within minutes. The underlying MMI codes are a standard part of the GSM system used worldwide, including by every Pakistani network, which is exactly why this deserves the same caution here as anywhere else.
The Four Forwarding Codes, Decoded
Every SIM has four separate forwarding conditions, each with its own code. Knowing what each one actually does makes it obvious why a stranger asking you to dial one should never be trusted.
Forwards every single incoming call, all the time, regardless of whether your phone is on or off. The most dangerous one to be tricked into.
Forwards calls only while you're already on another call. Commonly the one used in the "delivery confirmation" trick, since it's easy to disguise.
Forwards calls that ring without being picked up within a set number of seconds.
Forwards calls when your phone is switched off or has no signal — a legitimate use most people actually want active.
Checking If Forwarding Is Already On
You can check the status of each type without changing anything, just by dialling the status version of each code and pressing call.
- Unconditional status: *#21#
- Busy status: *#67#
- Unanswered status: *#61#
- Unreachable status: *#62#
Each one replies with whether forwarding is active and, if so, which number it's pointed at. If any of these show a number you don't recognise, that's your sign something was activated without your knowledge — treat it the same way you'd treat an unfamiliar SIM on your CNIC, worth checking immediately rather than later.
Turning It All Off, In One Code
Rather than deactivating each type one at a time, there's a single universal reset.
Deactivates all four forwarding types at once, restoring your line to receiving every call directly. This is the code worth memorising above all the others.
Turns off just the unconditional type, leaving the other three (like unreachable-forwarding) untouched if you actually use them.
If you ever suspect you were tricked into activating forwarding, dial ##002# immediately, then verify with the status codes above that everything shows as inactive.
SIM PIN — The Other Half Of This Guide
Call forwarding protects your calls from being silently redirected while your SIM stays with you. A SIM PIN protects something different: what happens if your SIM physically ends up in someone else's hands — a lost phone, a stolen device, or even a family member's phone your SIM gets moved into out of curiosity. Without a PIN, anyone can pop your SIM into any phone and immediately use your number to receive calls and SMS, including OTPs, exactly as if they were you.
A SIM PIN is a short code, usually 4 digits, required every time the SIM starts up in any device. Most Pakistani SIMs ship with an easy default — commonly 0000 or 1234 — which means leaving it unchanged offers essentially no protection at all. Changing it takes about a minute and closes this gap completely.
Setting Your SIM PIN, Step By Step
- Find your SIM lock settings
On Android: Settings → Security (or "Security & privacy") → SIM card lock. On iPhone: Settings → Cellular → SIM PIN.
- Enter the current PIN
Try 0000 or 1234 first if you've never set one. If neither works, your operator's helpline can look up or reset the default for your SIM.
- Toggle SIM lock on
This makes a PIN mandatory every time the SIM is powered on in any device, not just this one.
- Change the PIN to something only you know
Avoid birth years, repeated digits, or anything printed on your CNIC.
- Write it down somewhere safe, off your phone
Three wrong attempts locks the SIM entirely, requiring a PUK code from your operator to unlock — annoying, but not something a thief can casually work around either.
A phone's screen lock (fingerprint, face unlock, passcode) protects the device. A SIM PIN protects the SIM card itself, independently of the device it's in. You genuinely need both — a stolen phone with no SIM PIN can still have its SIM moved to a second phone and used immediately.
Which Forwarding Code Applies To Me?
Tap a situation below to expand it. Nothing here is stored or sent anywhere.
🧭 Match your situation to the right code
Tap any row to expand it.
A Realistic Scenario
Maria gets a call from someone claiming to be a courier, saying a parcel delivery attempt failed and she needs to "confirm her address" by dialling a number they'll text her. The text arrives: a string starting with *67* followed by an unfamiliar number. She almost dials it on reflex, but the shape of the code — stars, hashes, an unrelated phone number — makes her pause and search it first.
She doesn't dial it. Instead, she calls the courier company back on the number printed on her last real delivery receipt, who confirm no delivery attempt was made. She runs the four status checks on her own phone anyway, just to be safe, and everything comes back clean. That evening she also finally sets a SIM PIN, since the whole episode reminded her she'd never bothered.
Maria is an illustrative example, not a documented case, but the shape of the call — courier pretext, a code disguised as a phone number, urgency to act immediately — matches the pattern researchers have already confirmed works.
Run Your Own Security Audit
Tick whatever's currently true for your phone. Nothing here is stored or sent anywhere.
🛡️ Quick security status
Tick anything that's NOT currently true for you.
Claims I Couldn't Verify
| The claim | What I found | Status |
|---|---|---|
| The call-forwarding WhatsApp hijack method, as researched by CloudSEK | Documented by CloudSEK's founder and independently tested and confirmed by BleepingComputer and other outlets | Confirmed |
| Real victims describing the exact courier-call variant of this trick | Reported by named news outlets quoting affected users directly | Widely reported |
| *21*, *67*, *61*, *62* and ##002# as universal GSM MMI codes | Standard GSM specification codes, consistent across the sources checked, though exact behaviour can vary slightly by operator or handset | Mostly universal |
| Default SIM PIN of 0000 or 1234 on Pakistani SIMs specifically | Consistent with general GSM industry practice; not something any single Pakistani operator publishes as an official default | Reported |
| Documented Pakistan-specific cases of this exact scam | Cases found and cited are international (India, and global security research); no Pakistan-specific news report of this precise method was found, though the same GSM codes apply here | Unclear locally |
The mechanics of this trick are well-documented internationally and rely on GSM features that work identically on Pakistani networks — that part isn't in question. Where I couldn't find a specific Pakistan-based news report of this exact scam, I've said so rather than implying one exists.
SIM PIN & Call Forwarding: FAQs
Can dialling a code really let someone steal my WhatsApp?
How do I check if call forwarding is active on my phone right now?
What's the fastest way to turn off all call forwarding?
What's the difference between a SIM PIN and my phone's screen lock?
What happens if I enter the wrong SIM PIN too many times?
Is it safe to dial a code someone sends me over text or WhatsApp?
Do these codes work the same on all Pakistani networks?
Should I leave "forward when unreachable" turned on?
I think I already dialled a suspicious code. What now?
Where do I set a SIM PIN on my phone?
Two Minutes, One Code, One PIN
Check your forwarding status, memorise ##002#, and set a real SIM PIN. That's the whole defence, and it costs nothing.
Related guides: SIM Owner Details (main guide) · OTP Fraud & Interception Scams · SIM Swap Fraud in Pakistan · Fake SIM Checker Apps · How To Report SIM Fraud — PTA vs NCCIA · PTA Complaint Process — 0800-55055.
Note: this is general information, not legal or security-consulting advice. Exact MMI code behaviour can vary slightly by operator — confirm with your network if a code doesn't respond as expected. This site is independent and is not a government service.