Hackers Hijack Your Phone Number Through SIM Swapping Attack:

Preface:

Just imagine that when you wake up in the morning, you find that you cannot access your email, bank accounts, or social media accounts. Worst case scenario can be that unauthorized transactions have been made from your bank account. This nightmare scenario is most of the times the result of a SIM swapping attack. It is a growing #CyberSecurity threat which exploits weaknesses of mobile phone companies to hijack phone numbers. Sim Swapping attack bypasses two-factor authentication (#2FASecurity) which is considered to be one of the most strong security measure.

In this blog, we will discuss that what is #SIMSwapping Attack, and how does it work. We will also have a look at some of the real cases and I will explain that how can we protect ourselves from becoming a victim of Sim Swapping Attack.

What is SIM Swapping Attack?

SIM Swapping Attack, which is sometimes referred as SIM hijacking or SIM jacking is a type of #DigitalFraud in which cybercriminals transfer your phone number to a SIM card which is controlled by them. Once they gain control of your number, they can intercept your calls, carry out #Phishing attacks, use your phone number for SMS based authentication codes (OTPs), and even can reset your passwords to hijack your online accounts.

How Does SIM Swapping Attack Work?

Hackers use social engineering, phishing, and insider help to defraud telecom companies to issue new SIM card of the target number. This process follows following key steps:

Gathering Personal Data: The first step in SIM swapping attack is to collect personal data of the target. To achieve this goal, hackers may use phishing techniques, data breach attempts and social media.
Impersonation to Customer Support: Once the hackers succeed to collect personal data of the target, they impersonate and try to deceive customer support of cell phone company. Most of the times the customer support of the company has a given set of questions to verify the customer. Since hackers have already collected personal data so they are able to answer all possible questions asked by customer support. Once they are considered to be authentic customer they ask to issue a fresh SIM of the target number.
Control of Online Accounts: After issuance of fresh SIM hacker has total control of the number. Now the hacker can recieve One-Time Passwords (OTPs), which is sent via SMS and gain access to your email, bank account, and all social media accounts.
Changing the Passwords: Once the hacker gains access to your online accounts, he changes your existing passwords. Resultantly you cannot access your own accounts.

SIM Swapping Attack Cases:

1. Jack Dorsey, CEO of Twitter (2019)

In 2019, hackers took over Jack Dorsey’s Twitter account by executing a SIM swapping attack. After gaining access to his Twitter account they continued to tweet offensive messages from his profile. (Source)

2. $24 Million Theft from Cryptocurrency Investors (2021)

In 2021, Joseph O’Connor named hacker targeted a crypto investors through SIM swapping. Resultantly he succeeded to steal $24 millions of his digital assets. (Source)

3. T-Mobile Data Breach (2023)

A hacker gang used SIM swapping attack to hijack T-Mobile customers’ numbers. By doing this they stole identities of their thousands of customers and impacted heavy financial losses to the company. (Source)

Why is SIM Swapping Attack so Lethal?

Bypasses Two-Factor Authentication (2FA): 2FA is considered to be a secure mode of authentication; but now you cannot rely on it. Because if your accounts rely on SMS based 2FA, SIM swapping attack will make it ineffective because your number is being controlled by the hacker.
Access to Financial Accounts: When your phone number is being controlled and used by the hacker, he can easily transfer money through your banking apps, crypto wallets, and PayPal accounts.
Identity Theft: Just imagine that your phone number is in control of a hacker; in that scenario he can impersonate you, ruin your credit history, and even he can commit any type of fraud which will be considered to be done by you.
Loss of Personal Data: Today our cell phone is custodian of all of our sensitive information. All types of sensitive emails, private photos, and confidential information is stored in our cell phones, which are normally synched with online accounts. Image that hacker is using your phone number and has gained access to your online accounts. Now he has access to all of your personal data which is synched with your online accounts.

How to Protect Yourself from SIM Swapping Attack:

SIM Swapping Attack

Remember that SIM swapping attack is very lethal and cause serious losses. Therefore, following are some important measures that you must take to avoid any such attack.

1. Enable SIM PIN:

Most of the mobile phone companies offer to generate PIN to activate new SIM, or Number Lock features to prevent unauthorized SIM activation. (How to Set It Up) #MobileSecurity. Therefore, if your service provider offers such facility, you must activate it.

2. Avoid SMS Based Two-Factor Authentication (2FA)

SMS based 2FA are of no use if you become a victim of SIM swapping attack. In that case a third party 2FA app can make your accounts more secure. Therefore, use these third party reliable and authenticated apps like:

Authenticator apps (Google Authenticator, Authy)
Hardware security keys (YubiKey, Titan Key)

3. Set Up a PIN or Passcode with Your Mobile Phone Carrier

Most cell phone companies allow you to set up a PIN that must be provided before making account changes. You must set up the PIN if your mobile company allows you to set it up. (More on This) #DataProtection

4. Limit Personal Data Access on Social Media

As discussed above, one of the common places from where hackers gather information is the social media. Therefore, avoid sharing sensitive data on social media accounts and customize your account security settings to limit access to your personal information to authorized people only.

5. Monitor Unusual Account Activity

Any hacking attempt leaves its footprints on your account; therefore, routinely check activity log of your account for:

Unexpected password reset emails
Login alerts from new devices
Sudden loss of mobile network signal when others are working (this can be a sign that your SIM may have been swapped)

6. Use Encrypted Communication Apps

SMS is a plain text transfer service; therefore, avoid using SMS for exchange of sensitive data. Apps like Signal and WhatsApp offer end to end encryption; hence you should prefer using these types of apps for communicating sensitive information. #OnlineSafety

What to Do If You Become a Victim of SIM Swapping Attack?

If you suspect that you have become a victim of a SIM swapping attack, immediately take following steps:

Contact your mobile carrier to block or reissue SIM of your number.
Immediately Change passwords of all of your online accounts.
Enable multi-factor authentication (MFA) method other than SMS as discussed above.
Intimate bank and crypto accounts for stopping any type of transaction.
Report the incident to the concerned law enforcement agency and your mobile phone company.

SIM Swapping Attack Related Articles:

Conclusion

#CyberThreats like SIM swapping attack is an emerging growing concern in the field of #cybersecurity. Hackers are constantly finding new ways to exploit mobile networks and steal personal information. So far they are targeting SMS based authentication; therefore, it is no longer a safe mode of authentication. Keeping this in mind, users must take proactive steps which have been discussed above, to secure their accounts. By enabling third party stronger authentication methods/apps, setting up protections measures offered by carrier, and regularly monitoring account activity logs, you can reduce the risk of falling victim to SIM Swapping Attack.

Have you ever experienced or heard of a SIM swapping attack? Please share your experience in the comments below!