What are SIM Swap Attacks?

Welcome to our latest edition of the Scam Newsletter, where we dive into the growing menace of SIM swap attacks. This issue will guide you through what SIM swap attacks are, how they work, and how to protect yourself from falling victim to this deceptive scam.

What are SIM Swap Attacks?

A SIM swap attack is a fraudster’s method to hijack your mobile phone number. By manipulating the process of transferring phone numbers between mobile carriers and SIM cards, scammers redirect your text messages and calls to their own devices. Using SMS for two-step authentication (2FA) with services like Stripe means the attacker can intercept your verification codes and gain unauthorized access to your accounts.

How Do SIM Cards Work?

Each mobile phone customer is issued a SIM card, slotted into their phone to identify the customer and associate them with a phone number. Recently, eSIMs have been introduced, eliminating the need for a physical card, but they function similarly.

Mobile carriers can change which SIM a phone number points to. This is necessary when you lose your phone or your SIM card becomes damaged. However, this capability also gives carriers—and potentially their employees—the power to reassign your phone number.

In many countries, laws require that customers can switch between mobile carriers freely. While this promotes healthy competition, it also means minimal verification is often done before a phone number is ported to a new carrier and issued a new SIM.

How Do SIM Swap Attacks Work?

SIM swap attacks can occur in several ways, leading to the same outcome: the attacker gains control of your phone number. Here are the standard methods:

1. Impersonation and Deception: The attacker pretends to be you and contacts your mobile carrier, claiming your phone has been lost. They convince the airline to issue a replacement SIM card.
2. Carrier Switching Fraud: The attacker pretends to be you and contacts a different mobile carrier, wanting to switch services. The new carrier requests the old carrier to confirm the porting, and the attacker manages to convince them, issuing a new SIM card.
3. Insider Bribery: An employee at your mobile carrier is bribed to reassign your phone number to the attacker’s SIM card.

In each case, the attacker receives a SIM card that now handles your SMS and phone calls while your existing phone ceases to function.

How Can I Protect Myself from SIM Swap Attacks?

Due to the involvement of third parties, it is currently impossible to completely prevent SIM swap attacks. However, you can mitigate their harmful effects by discontinuing SMS for two-step authentication. As long as SMS-based 2FA is enabled, your account remains at risk. Here’s what you can do:

• Switch to an Authenticator App: Use an authenticator app like Google Authenticator or Authy for your two-step verification process. These apps generate time-based codes that are much harder for attackers to intercept.
• Use a Hardware Security Key: Consider using a hardware security key, such as YubiKey, for an extra layer of security. These physical devices provide robust protection against various forms of digital attacks.
• Disable SMS 2FA: Once you have enabled an alternative method for two-step authentication, disable SMS 2FA on all your accounts.

Stay Vigilant and Informed

SIM swap attacks are a growing threat, but you can significantly reduce your risk by understanding how they work and taking proactive steps to protect your accounts. Stay informed about the latest scams, and always prioritize your online security.