In ‘SIM swap,’ criminals really have your number

And criminals are finding it’s pretty easy to fool the phone companies.

By Liz Weston / NerdWallet

If you’re not familiar with SIM swap fraud, prepare to be terrified.

This scam, also known as port-out or SIM splitting fraud, allows criminals to hijack your cellphone number. Once they have your number, the bad guys can clean out your financial accounts, confiscate your email, delete your data and take over your social media profiles.

Fraudsters can do all this because many companies — including banks, brokerages, email providers and social media platforms — verify your identity by texting a code to your cellphone. Intercepting those codes can give a criminal an all-access pass to your financial and digital life.

This kind of identify fraud has been around for years, but it’s getting more attention after a wave of cryptocurrency thefts and attacks on high profile victims, including Twitter CEO Jack Dors ey, who briefly lost control of his Twitter account.

This is the fraud the experts fear most

The potential damage is so great that security expert Avivah Litan, vice president at research firm Gartner Inc., fears losing her phone number far more than having her Social Security number compromised.

“I’d rather they took my social, to tell you the truth,” Litan says, “because I care about my retirement money and I know some of it’s protected through phone number access.”

What’s more, you can’t prevent this fraud — only your carrier can. And right now, criminals are finding it’s pretty easy to fool the phone companies.

Sometimes the scam artists bribe or blackmail carrier employees; sometimes, the employees are the criminals. Other times, the fraudsters use identifying data they’ve stolen, bought on the dark web or gleaned from social media to convince carriers that they’re you. They pretend they want to change carriers or say they need a new SIM card, the module that identifies a phone’s owner and allows it to connect to a network. Once they persuade the carrier to transfer your number to a phone they control, they can attack your other accounts.

Even getting your cellphone carrier to recognize what’s happening, and help you stop it, can be a challenge, says security expert Bob Sullivan, host of the “So, Bob” technology podcast. Victims report being forced to educate phone company employees about the fraud and having their numbers stolen more than once, even after protections were supposedly in place.

“The real problem is when you call, are you going to get a person that you can talk to about this quickly and are they going to recognize what’s happening?” Sullivan asks. “Or are you going to be in voicemail hell for three hours while a criminal raids all your accounts?”

Phone companies protest they’re doing all they can, and solutions that would make this theft harder also would inconvenience people who legitimately want to switch carriers or need their numbers transferred to new SIM cards because their phones have been lost or stolen.

While you can’t prevent this fraud if you have a cellphone, you may be able to reduce the chances of being victimized or at least limit the damage.

Change how you’re indentified, if you can

First, ask your phone company to put a personal identification number on your account. Hopefully the carrier will require that to be produced before your phone number is “ported out” to a new carrier or assigned to a different SIM card.

Then, investigate whether you can switch to more secure authentication on your sensitive accounts. Being texted a code is better than nothing, since this “two factor” authentication is harder to beat than just using a password. Better options would be to get the codes through a call to a landline or by using an authenticator app such as Authy, Google Authenticator or Duo Security on your smartphone.

Assume the worst

If your phone stops working or you can’t send or receive texts, don’t assume it’s a glitch. Call using an alternate method or visit your carrier immediately to report phone takeover fraud. Sullivan recommends knowing a few alternate ways to contact your carrier, such as Wi-Fi calling, Skype or an easily accessed backup phone.

If you do become a victim, you should:

— Alert your financial institutions.

— Change the email and password associated with all your financial and payment accounts.

— Freeze your credit reports.

— File identity theft reports with your local police department.

The important thing is to move quickly, because the bad guys won’t wait.

“You have a plan in place because minutes are going to matter,” Sullivan says.

Talk to us

More in Herald Business Journal

Sarah Calvo pours icing on to a cinnamon roll at the Maltby Cafe while Kylie King checks take out orders on Thursday, Dec. 3, 2020 in Maltby, Washington. A GoFundMe fundraising page continues to grow, raising more than $80,000 from 1,200 people in just a few days. Owners Tana Baumler and Sandra Albright thought they were going to closed before the website donations made them pause their decision. (Andy Bronson / The Herald)
Miracle in Maltby: Community support saves small-town cafe

Owners of the Maltby Cafe feared closure, but a wave of business and donations has thwarted the end.

More deadlines loom for local small-business grant programs

Those in Everett and Stanwood must apply by Monday. Monroe and other cities are giving more time.

The Colors of Hawaii gift store Saturday afternoon in Everett November 21, 2020. (Kevin Clark / The Herald)
If you can’t go, a new Everett shop sells Hawaiian sunshine

The Colors of Hawaii gift store has relocated to Broadway. Yes, of course, they sell grass skirts.

Amethyst Skeels and Alexander Walsh pick out cannabis products at Kushman's Everett Cannabis Dispensary on Evergreen Way on Tuesday, Dec. 1, 2020 in Everett, Washington.  (Andy Bronson / The Herald)
Cannabis sales surge, proving pot is pandemic-proof

There are more customers, and some regulars are stocking up — just in case there’s a shortage.

Claire Vondemkamp (left) and Jami Sollid check out customers Saturday afternoon at Just James Boutique in Stanwood on November 28, 2020. (Kevin Clark / The Herald)
Crazy or just brave? These folks opened businesses this year

In spite of the pandemic, the number of new businesses is up sharply compared to last year.

Sofia Drogomiretskiy sets up an example of what she would photograph for a Decorent Instagram photo on Wednesday, Nov. 18, 2020 in Bothell, Wa. (Olivia Vanni / The Herald)
They rent you a merry Christmas — the tree trimmings, that is

Tired of storing holiday decorations, a Bothell couple launched a company that rents tree ornaments.

Boeing lands crucial Max deal from Ryanair as grounding ends

The Dublin-based carrier will add to an existing Max purchase by taking 75 more 737-8s.

Shop local without leaving your home: Merchants go online

It’s more important than ever to support area businesses, and it’s now easier to find them on the web.

Pilots Peter Gamble, left, and John Konstanzer talk with journalists and crew members after flying a Boeing 737 Max from Dallas and arriving at the American Airlines Tulsa maintenance facility Wednesday, Dec. 2, 2020 in Tulsa, Okla.. Earlier the plane had flown a group of journalists and American Airlines employees from Dallas to the American Airlines Tulsa maintenance facility. (Mike Simons/Tulsa World via AP)
Waiting for passengers, American puts Boeing Max in the air

American Airlines is likely to be the first carrier to put passengers on Max jets, beginning Dec. 29.

A Boeing 737-8AS aircraft, operated by Ryanair, taxis passed an EasyJet passenger jet at Schoenefeld airport in Berlin on March 13, 2019. MUST CREDIT: Bloomberg photo by Krisztian Bocsi.
Boeing nears Max deal with Ryanair in win for embattled jet

The order would help repnlenish a backlog that’s been depleted since the start of the Covid-19 crisis.

Anastasia Allison poses with samples of her Kula Cloth, a pee cloth for women to use outdoors, near her home on Monday, Oct. 12, 2020 in Arlington, Washington. Allison's invention has caught the eye of outdoor retail giant REI and will being selling them in stores soon. (Andy Bronson / The Herald)
Kula Cloth tries to wipe away the mountains of toilet paper

An Arlington woman’s “spiritual awakening via pee cloth” led to a popular product for outdoorsy women.

A passenger aircraft at Ciudad Real International Airport in Ciudad Real, Spain, on Oct. 27, 2020. MUST CREDIT: Bloomberg photo by Paul Hanna.
Airlines face ‘mission of the century’ in shipping vaccines

Cars, buses, trucks, motorcycles, bikes and even donkeys may be needed to get the drug to rural areas.