Sim-swap fraud can be an incredibly lucrative scam, leaving victims without access to their phones, and in many cases their bank accounts. According to Action Fraud, between January and June of 2020, there were 483 cases, with each victim losing around £2,500 on average. We’ve been looking into sim-swap fraud, and what smartphone users can do to prevent themselves from becoming part of these statistics.
What is sim-swap fraud?
Sim-swap fraud is where a hacker convinces your mobile phone network to transfer your phone number to their Sim card. They do this by calling your network customer services helpline, and requesting the Porting Authorisation Code (PAC), which enables users to move their numbers to different networks.
Once the perpetrator has access to your phone number, they also gain access to all of your calls and text messages. From here, the perpetrator can attempt to reset your passwords on accounts and applications. From here, the hacker can access an email account, and with your email account and phone number, is also likely to be able to access your bank and credit cards.
The hacker can then empty your accounts, apply for loans in your name or make purchases, costing you thousands of pounds.
How does sim-swap fraud work?
The key part of sim-swap fraud is that it involves some social engineering; essentially convincing someone who works for your phone network that they are you, and that they need to swap your phone number to their sim card.
There are a number of things that mobile networks have in place in order to protect themselves against these kinds of hacks, such as only sending the PAC to the original Sim card, which prevents perpetrators from moving forward with this kind of scam.
However, one of the ways that hackers will try to gain the trust of the customer service representative, and convince them to hand over the PAC, is by correctly answering security questions about the victim’s likes, hobbies and family.
This is a really effective way of convincing the network provider that the fraudster is legitimate, and thanks to social media, it’s very easy for the fraudster to collate this kind of information. Hackers can easily target a victim who posts about their pet or favourite sports team, and wait for the right security question to crop up.
What can you do to stay safe?
One of the key factors in a successful sim-swap fraud is the social engineering element, and how effectively the perpetrator can impersonate you through answering those security questions. By making your social media accounts accessible only to your friends, you’re preventing perpetrators from mining that information and using it against you.
Another way of protecting yourself against this scam is by answering the security question with a passphrase, or adding a password to your mobile account. If you do receive a text about your Sim being swapped, contact your network provider immediately, and let your bank know that you may be at risk.
Tweet us @TranscenditUK
