SIM Card Swapping and Cell phone Hijacking
SIM card swapping and cell phone hijacking is on the rise to steal authentication codes and access digital wallets or other accounts. While criminals often take advantage of advancements in technology, SIM card fraud is not a hi-tech crime committed by rogue players who manipulate existing holes in how SIM cards are managed.
Cases of SIM card theft are at an all-time high, especially with the abundance of personal messages sent to smartphones such as authentication codes sent via SMS texts. Regardless of how much effort is made to curb smartphone identity theft, this type of crime continues to rise as it provides opportunities to access accounts.
What Is SIM Card Swapping?
SIM card swapping and cell phone hijacking goes by many names and has been around for quite a while, wreaking havoc on people’s lives all over the world.
Port-out scamming, SIM splitting, SIM hijacking or SIM-card swapping is a form of fraud focused on replacing someone’s SIM card with one that’s owned and controlled by the fraudster to take over the smartphone messaging system. This change-over tactic is made possible because there are existing loopholes in how telecom companies manage the identities of their customers.
The scale with which most telecom companies operate is probably one of the contributing factors to SIM splitting. Most telecoms are just too big and serve millions of customers which may be the reason for the lack of sufficient controls and resources to prevent SIM card fraud.
However, mobile phone and telecom technology companies have developed technical solutions to curb cell phone related fraud. One of the common solutions developed over the years is allowing mobile phone users to flag suspected scams and spam phone numbers. These numbers are then added to an ever-growing list which is used to alert future phone users.
This type of fraud is yet another indication that smartphone users need additional awareness to protect themselves from SIM card fraud.
How Does SIM Swapping Fraud Work?
Like every other form of identity theft, cell phone hijacking made possible by SIM swapping requires the criminal to have access to important bits of key information about the potential victim. Getting access to this information can be done in two ways, searching the web for publicly available information about the potential victim or subtly social engineering the victim into unknowingly giving away the information. The social engineering route is one commonly taken by most SIM card scammers, who usually pose as representatives from the victim’s telecom company.
The scammers aim to obtain from the potential victim their SIM PIN, their social security number, numbers they last contacted, their last recharge amount, and their account security question.
Once this information is obtained, the scammer contacts the victim’s service provider, impersonating the victim and requesting them to reassign the subscription to another SIM card. Telecom companies make the swapping mechanisms this easy since they want to provide convenient service to their legitimate customers.
The telecom representative will question the victim impersonator regarding information that the real SIM card owner would only know. Once the information is confirmed, the SIM will be reassigned to another card just as the scammer had intended. This leaves the victim’s card disconnected from the network, and with it goes all the access the victim had to other resources through the SIM card.
What’s So Dangerous about SIM Swapping?
Receiving the victim’s calls and text messages is one of the basic benefits that the scammer will get with the SIM card hijacking; through SIM swapping, the scammer can gain access to most if not all the victim’s online accounts that are linked to the SIM card.
To gain access to a victim’s online accounts, the scammer works on the assumption that the victim has subscribed to two-factor authentication on their online accounts. If this is the case, as is most of the time, the scammer gains full access to victim’s accounts.
In extreme instances of identity theft through SIM swapping, an attacker can gain access to the victim’s online financial resources linked to the SIM card through two-factor authentication. With this access, the attacker is also able to take over digital wallets.
Some Incidents of People Getting SIM Card Swapped
One of the most high-profile incidents of SIM-card swapping is that of Twitter CEO Jack Dorsey. The endgame in the SIM swap of the Twitter CEO was to gain access to his Twitter account. Access to this high-profile Twitter account gave the scammers access to a broader audience on the social media platform. For about half an hour, Twitter experienced a barrage of tweets and retweets from its CEO’s account, a series of racial profanities.
Another recent SIM swapping case includes a couple that lost $75000 of their cryptocurrency deposits. This digital wallet theft was the intended purpose of what started as a SIM swap performed on the couple. The couple narrated to investigators how they helplessly watched the cryptocurrency deposit of their two sons’ college fund savings being emptied. Upon contacting their mobile service provider, they were notified that indeed a SIM swap was conducted on the SIM registered with two-factor authentication to the digital wallet.
Unfortunately, sometimes unsecured SIM cards are used by cell phone owners which places them at risk. For example, after the 3G communication tower in Ukraine was destroyed by the Russian soldiers, they switched off their encrypted phone system and started using normal phones with local SIM cards which led to the interception of conversations revealing the death of Major General Vitaly Gerasimov by Ukrainian intelligence.
What You Can Do If You Have Been SIM Swapped?
Once you realize that you’ve been a victim of SIM swapping, it’s paramount that you move quickly and swiftly to contain the situation.
When you’ve been SIM swapped, the first thing you should do is to contact your phone service provider from a secondary valid phone, and notify them of what has happened. This will enable the service provider to lock down any activity on the SIM, which may help in preventing further damage to your now stolen digital identity.
Secondly, and equally important as the first step, you should immediately change the password and phone number used for dual-factor authentication on your accounts. While the importance of different accounts varies from one person to another, you should list all accounts and only start with the most critical ones. Also consider contacting the financial institution to inform them and take any additional steps as they recommend.
What You Can Do to Protect Yourself Against SIM Card Swapping and Cell Phone Hijacking
When high profile individuals are victims of SIM swapping and families lose their savings through the scam, this goes a long way to show that no one is beyond reach and nothing is sacred to SIM fraudsters. While the Telecom service providers do all that they can to prevent SIM fraud, it is upon you and those around you to stay safe from SIM-card swapping scammers. Here are some tips on how to stay a step ahead of scammers:
- Minimize the amount of personal information that you make publicly available or post online.
- Where possible, use stronger authentication procedures on your accounts such as using a Google or Microsoft authenticator app instead of SMS two-factor authentication.
- Ignore and report any suspected numbers or emails that you receive requesting personal information.
- Secure your cellular accounts with a PIN or password.
Things That Can Happen When a Phone Is Accessed by Unauthorized People
When unauthorized people access a phone or its resources, this can lead to several consequences for the phone’s owner. Here are some of the common things that can happen with unauthorized phone access.
- The scammer can perform unintended financial transactions through the phone’s accounts.
- Damaging communications can be made through the phone, which can at times have irreversible consequences.
- Implanting of malware or harmful software on the phone.
