A SIM swap, also known as a port-out scam, simjacking, or SIM splitting, is a type of fraud that involves stealing a person's phone number and transferring it to a different device. This allows the scammer to access the victim's communications, including texts, voicemails, and calls, as well as any two-factor authentication codes. The scammer can then use this information to access the victim's banking, social media, and other accounts.
SIM swapping scams often target weaknesses in two-factor authentication and two-step verification that use a text message or call to a mobile phone as the second factor. Scammers may obtain the victim's personal information through identity theft, such as convincing their phone company that their phone was lost or stolen and needs a new SIM card. They may also purchase information directly from organized criminals or on the dark web after data breaches.
To protect against SIM swapping, you can:
Use strong, unique passwords
Enable two-factor authentication
Use a password manager
Be suspicious of unsolicited texts, emails, and calls
Forward suspicious texts to S-P-A-M (7726)
The fraud exploits a mobile phone service provider's ability to seamlessly port a phone number to a device containing a different subscriber identity module (SIM). This mobile number portability feature is normally used when a phone is lost or stolen, or a customer is switching service to a new phone.
The scam begins with a fraudster gathering personal details about the victim, either by use of phishing emails, by buying them from organised criminals, directly socially engineering the victim, or by retrieval from online data breaches.
Armed with these details, the fraudster contacts the victim's mobile telephone provider. The fraudster uses social engineering techniques to convince the telephone company to port the victim's phone number to the fraudster's SIM. This is done, for example, by impersonating the victim using personal details to appear authentic and claiming that they have lost their phone. In some countries, notably India and Nigeria, the fraudster will have to convince the victim to approve the SIM swap by pressing 1.
Upon retrieving the victim's information, attackers commonly impersonate them while contacting technical support services for their telecommunication provider and attempt to convince the employees to switch the victim's phone number to their SIM card. In some cases, however, telecom company employees have been bribed by attackers to directly change SIM numbers for them. Attackers have sought out employees for companies including T-Mobile and Verizon through social media or employee directories in attempts to hire them, promising a fixed amount of money in cryptocurrency for each phone number they transfer for the attacker.
Once this happens, the victim's phone will lose connection to the network, and the fraudster will receive all the SMS and voice calls intended for the victim. This allows the fraudster to intercept one-time passwords sent via text or telephone calls to the victim's number and thus subvert two-factor authentication methods relying on them. Since so many services allow password resets with only access to a recovery phone number, the scam allows criminals to gain access to almost any account tied to the hijacked number. This may allow them to directly transfer funds from a bank account, extort the rightful owner, or sell accounts on the black market for identity theft.
Maybe it would be wise to use your phone just to make and receive calls the old fashion way.
16 окт 2024
