SIM swap scam

Cell phone account takeover fraud

"Simjacking" redirects here. For the S@T Browser vulnerability, see Simjacker.

A SIM swap scam (also known as port-out scam, SIM splitting,[1] simjacking, and SIM swapping)[2] is a type of account takeover fraud that generally targets a weakness in two-factor authentication and two-step verification in which the second factor or step is a text message (SMS) or call placed to a mobile telephone.

## Method

[edit]

The fraud exploits a mobile phone service provider's ability to seamlessly port a phone number to a device containing a different subscriber identity module (SIM). This mobile number portability feature is normally used when a phone is lost or stolen, or a customer is switching service to a new phone.

The scam begins with a fraudster gathering personal details about the victim, either by use of phishing emails, by buying them from organised criminals,[3] directly socially engineering the victim,[4] or by retrieval from online data breaches.[5]

Armed with these details, the fraudster contacts the victim's mobile telephone provider. The fraudster uses social engineering techniques to convince the telephone company to port the victim's phone number to the fraudster's SIM. This is done, for example, by impersonating the victim using personal details to appear authentic and claiming that they have lost their phone. In some countries, notably India and Nigeria, the fraudster will have to convince the victim to approve the SIM swap by pressing 1.[6][7][4]

Once they have a victim's personal information, attackers commonly impersonate them while contacting technical support services for their telecommunication provider and attempt to convince the employees to switch the victim's phone number to their SIM card.[8][9] In some cases telephone company employees have been bribed by attackers to directly change SIM numbers.[10][5] Attackers have sought out employees of companies including T-Mobile and Verizon through social media or employee directories in attempts to hire them, sometimes promising money in cryptocurrency for each phone number they transferred.[11][12]

Once this happens, the victim's phone will lose connection to the network, and the fraudster will receive all the SMS and voice calls. This allows the fraudster to intercept one-time passwords sent via text or telephone calls to the victim's number and thus subvert two-factor authentication methods relying on them. Since so many services allow password resets with only access to a recovery phone number, the scam allows criminals to gain access to almost any account tied to the hijacked number. This may allow them to directly transfer funds from a bank account, extort the rightful owner, or sell accounts on the black market for further identity theft and fraud.

## Incidents

[edit]

A number of high-profile hacks have occurred using SIM swapping, including some on the social media sites Instagram and Twitter. In 2019, former Twitter CEO Jack Dorsey's Twitter account was hacked via this method.[13][14]

In May 2020, a lawsuit was filed against an 18 year old Irvington High School senior in Irvington, New York, Ellis Pinsky, who was accused with 20 co-conspirators of swindling digital currency investor Michael Terpin – the founder and chief executive officer of Transform Group – of $23.8 million in 2018, when the accused was 15 years old, through the use of data stolen from smartphones by SIM swaps. The lawsuit was filed in federal court in White Plains, New York and asked for triple damages.[15][16][needs update]

In early 2022, the US FBI reported a sharp increase in money losses to consumers in 2021, and continuing into 2022, from this type of fraud.[17][18] The losses in 2021 alone were five times larger than the three prior years summed: “The FBI says that victims lost $68 million to this SIM-card based scam in 2021, compared to just $12 million in the three-year period between 2018 and 2020.”[17] The FBI received 1,600 complaints about SIM-swapping in 2021, a sharp increase from the three previous years. The swaps happen quickly once the scammers have sufficient information to persuade a mobile phone carrier to assign a stolen phone number to their phone; the thefts of money happen when the thieves then receive the two-factor codes sent to the proper owner of the phone number.[18]

In South Korea, alleged incidents of SIM swapping attacks have been documented since the beginning of 2022. The common pattern includes victims facing abrupt disruptions in their mobile services, coupled with a notification suggesting a change. As a result, affected individuals discover that their bank and cryptocurrency accounts have been compromised.[19]

## References

[edit]

1. ^ admin (2014-05-09). "Alert – how you can be scammed by a method called SIM Splitting". Action Fraud. Retrieved 2018-08-22.
2. ^ "NPR Search : NPR". www.npr.org.
3. ^ Tims, Anna (2015-09-26). "'Sim swap' gives fraudsters access-all-areas via your mobile phone". the Guardian. Retrieved 2018-08-22.
4. ^ a b "Many Bengalureans lose cash to sim card swap fraud - Times of India". The Times of India. Retrieved 2018-08-22.
5. ^ a b Murphy, Margi; Bennett, Drake (August 4, 2023). "Teen Gamers Swiped $24 Million in Crypto, Then Turned on Each Other". Bloomberg Businessweek. Retrieved May 11, 2024.
6. ^ "Experts Finger Insiders in Telcos for Rising SIM Swap Fraud – Nigerian CommunicationWeek". nigeriacommunicationsweek.com.ng. 14 July 2018. Retrieved 2018-08-22.
7. ^ "You will be requested to press 1 or authenticate this Swap". Gadget Now. Retrieved 2018-08-22.
8. ^ Hartmans, Avery (12 April 2023). "A hacker ripped me off for $10,000. The scam turned out to be brilliant — and terrifying". Business Insider. Retrieved 11 May 2024.
9. ^ Franceschi-Bicchierai, Lorenzo (9 July 2020). "Verizon Adds Protection Against SIM Swapping Hacks in Mobile App". Vice. Retrieved 11 May 2024.
10. ^ Franceschi-Bicchierai, Lorenzo (2019-05-13). "AT&T Contractors and a Verizon Employee Charged With Helping SIM Swapping Criminal Ring". Vice News. Retrieved 2020-01-23. "Among the alleged criminals were also two former AT&T contract employees and one former Verizon employee, who helped the alleged criminals by providing private customer information in exchange for bribes, according to court documents."
11. ^ Franceschi-Bicchierai, Lorenzo (3 August 2018). "How Criminals Recruit Telecom Employees to Help Them Hijack SIM Cards". Vice. Retrieved 11 May 2024.
12. ^ TRUȚĂ, Filip (17 April 2024). "Scammers Are Tempting Telecom Employees with $300 Bribe Offers for SIM Swapping Help". Bitdefender. Retrieved 11 May 2024.
13. ^ Barrett, Brian. "How to Protect Your Phone Against a SIM Swap Attack". Wired – via www.wired.com.
14. ^ Brandom, Russell (August 31, 2019). "The frighteningly simple technique that hijacked Jack Dorsey's Twitter account". The Verge.
15. ^ Stempel, Jonathan (7 May 2020). "U.S. cryptocurrency investor sues suburban NYC teen for $71.4 million over alleged swindle". Reuters. Retrieved 4 January 2021.
16. ^ Nadeau, Barbie Latza (May 8, 2020) "15-Year-Old From Suburbs Led ‘Evil Computer Geniuses’ in $24M Cryptocurrency Heist: Lawsuit" Daily Beast
17. ^ a b Winters, Mike (February 19, 2022). "This SIM card scam once fooled Jack Dorsey—here's how to avoid it". CNBC. Retrieved February 19, 2022.
18. ^ a b Otis, Ginger Adams (February 18, 2022). "SIM-Swapping Attacks, Many Aimed at Crypto Accounts, Are on the Rise". The Wall Street Journal. Retrieved February 19, 2022.
19. ^ Kim, Myounghoon; Suh, Joon; Kwon, Hunyeong (August 2022). "A Study of the Emerging Trends in SIM Swapping Crime and Effective Countermeasures". 2022 IEEE/ACIS 7th International Conference on Big Data, Cloud Computing, and Data Science (BCD). pp. 240–245\. doi:10.1109/BCD54882.2022.9900510. ISBN 978-1-6654-6582-3. S2CID 252625262.

* v
* t
* e

Scams and confidence tricks

Terminology|

* Scam
* Error account
* Shill
* Shyster
* Sucker list

Variants|

* Advance-fee scam
* Art student scam
* Badger game
* Bait-and-switch
* Black money scam
* Blessing scam
* Bogus escrow
* Boiler room
* Bride scam
* Charity fraud
* Clip joint
* Coin-matching game
* Coin rolling scams
* Drop swindle
* Embarrassing cheque
* Exit scam
* Extraterrestrial real estate
* Fiddle game
* Fine print
* Foreclosure rescue scheme
* Foreign exchange fraud
* Fortune telling fraud
* Gem scam
* Get-rich-quick scheme
* Green goods scam
* Hustling
* Indian coal allocation scam
* IRS impersonation scam
* Intellectual property scams
* Kansas City Shuffle
* Locksmith scam
* Long firm
* Medical quackery
* Mismarking
* Mock auction
* Moving scam
* Overpayment scam
* Patent safe
* Pig in a poke
* Pigeon drop
* Pork barrel
* Pump and dump
* Redemption/A4V schemes
* Reloading scam
* Return fraud
* Salting
* Shell game
* Sick baby hoax
* SIM swap scam
* Slavery reparations scam
* Spanish Prisoner
* SSA impersonation scam
* SSC Scam
* Strip search phone call scam
* Swampland in Florida
* Tarmac scam
* Technical support scam
* Telemarketing fraud
* Thai tailor scam
* Thai zig zag scam
* Three-card monte
* Trojan horse
* Wash trading
* White van speaker scam
* Work-at-home scheme

Internet scams and
countermeasures|

* Avalanche
* Pig butchering
* Carding
* Catfishing
* Click fraud
* Clickjacking
* Cramming
* Cryptocurrency scams
* Cybercrime
* CyberThrill
* DarkMarket
* Domain name scams
* Email authentication
* Email fraud
* Internet vigilantism
* Lenny anti-scam bot
* Lottery scam
* PayPai
* Phishing
* Referer spoofing
* Ripoff Report
* Rock Phish
* Romance scam
* Russian Business Network
* SaferNet
* Scam baiting
* 419eater.com
* Jim Browning
* Kitboga
* Scammer Payback
* ShadowCrew
* Spoofed URL
* Spoofing attack
* Stock Generation
* Voice phishing
* Website reputation ratings

Pyramid and
Ponzi schemes|

* Aman Futures Group
* Bernard Cornfeld
* Caritas
* Dona Branca
* Earl Jones
* Ezubao
* Foundation for New Era Philanthropy
* Franchise fraud
* High-yield investment program (HYIP)
* Investors Overseas Service
* Kapa investment scam
* Kubus scheme
* Madoff investment scandal
* Make Money Fast
* Matrix scheme
* MMM
* Petters Group Worldwide
* Pyramid schemes in Albania
* Reed Slatkin
* Saradha Group financial scandal
* Secret Sister
* Scott W. Rothstein
* Stanford Financial Group
* Welsh Thrasher faith scam
* WinCapita

Lists|

* Con artists
* Confidence tricks
* Criminal enterprises, gangs and syndicates
* Impostors
* In the media
* Film and television
* Literature
* Ponzi schemes

*[v]: View this template
*[t]: Discuss this template
*[e]: Edit this template