Sim Swapping is a type of fraud that occurs when someone attempts to gain access to your mobile account by tricking your carrier into giving them a new SIM card registered in their name.

SIM swapping is becoming increasingly common as more and more people rely on their mobile phones for everything from banking to email. It’s important to be aware of the risks and take steps to protect yourself.

This gives the attacker access to your phone number and any online accounts that are linked to it, such as email, any online account and social media. They can then use this information to reset your passwords and take over those accounts.

SIM swapping isn’t a traditional hack but uses basic tradecraft with human interaction and research to enact the attack.

This process usually starts with the hacker collecting some personal information about you, such as your name, date of birth, and address – almost entirely OSINT (info available freely to anyone). With this information, the hacker is able to convince your cell phone service provider to port your phone number over to a new SIM card that the hacker controls.

Once the hacker has control of your phone number, they can use it to reset the passwords on your online accounts. The end result is that the hacker gains full access to any associated online accounts.

Sim swapping is a potentially serious problem because it’s mistaken as a very safe 2FA (two- factor authorization) security measure that many rely on. In theory it is very effective, if used right and with applied OPSEC.

Otherwise, this security measure is an easy attack vector. The other problem is that it can be used to hijack more important and sensitive accounts than social media, such as emails, bank accounts and government / corporate infrastructure.

SIM Swap Attack: Defense

How Can You Protect Yourself From SIM Swapping?

The only 100% effective method of not getting SIM swap attacked is by not using your phone as a 2FA measure. The second best way is to use a phone no one knows about, a burner phone or a dedicated number just for 2FA.

Enable two-factor authentication (2FA) with an authenticator app instead of your phone. Such as Google Authenticator, instead of text message-based 2FA to secure your accounts. This will make it more difficult for a fraudster to access your accounts even if they have your phone number and have successfully SIM swapped it.

However, not using your phone for 2FA is sometimes not ideal or is too convenient to not use. Then in that case, there are some strategies to reduce the possibility of being SIM swapped:

• Never give out your personal information such as your name, date of birth, or address to anyone who you don’t know and trust.

• Use a strong password for your mobile account and don’t use the same password for multiple accounts.

• Enable two-factor authentication to access your phone account (via email or authenticator app), in addition to your password when logging in.

• Don’t give out your number to anyone that doesn’t need it.

• Use a PIN or password to protect your accounts with your mobile phone carrier. This can be activated by contacting your provider.

• Consider using a virtual phone number or secondary phone number for accounts that require SMS verification, such as social media or online banking. This way, even if your main phone number is compromised, your accounts will still be protected.

• Keep a close eye on your cell phone account for any suspicious activity. If you see anything out of the ordinary such as text messages or calls being made that you didn’t initiate, contact your cell phone service provider.

• Avoid posting personal information on social media: Scammers can use personal information that you post on social media, such as your birthdate or mother’s maiden name, to impersonate you and convince your phone carrier to transfer your number to a new SIM card.

• Limit the personal information you share online, and consider adjusting your privacy settings to limit who can see your posts.

• Don’t input your phone number on online forms when signing up for whatever service or mailing list.

• Be cautious of unsolicited calls or text messages from unknown numbers. Do not give out personal information unless you are sure of who you are talking to.

What Should I do if I Discover I’ve Been SIM Swapped?

• As soon as you suspect that you have been sim swapped, contact your mobile phone carrier immediately and explain the situation. They can help you recover your phone number and secure your account.

• Check all your accounts to see if there have been any unauthorized changes or transactions. Notify your bank or credit card company immediately if you notice any suspicious activity.

• Consider freezing your credit report to prevent fraudsters from opening new accounts or accessing your credit without your knowledge.

• Change your passwords for all your online accounts immediately, especially those that are linked to your phone number. Use completely new passwords for each.

• Keep an eye on your credit report for any unauthorized activity or new accounts that have been opened in your name.

• Stay alert for any signs of further attacks, such as phishing emails or suspicious phone calls.

• Report the sim swap attack to the authorities, such as the police or the Federal Trade Commission (FTC).

SIM swapping is a serious problem that can have devastating consequences for victims. By taking some simple precautions you can protect yourself from being attacked of this type of fraud.