NEW YORK — SIM-swapping is a growing form of identity theft that goes beyond hacking into an email or social media account. In this case, the thieves take over your phone number. Any calls or texts go to them, not to you.
Any protections consumers enabled to secure access to their financial accounts, such as two-factor authentication texts, now can aid attackers and lock out owners.
Experts say these scams will only increase and become more sophisticated, while the data show they are on the rise.
The FBI Internet Crime Complaint Center reports that SIM-swapping complaints have increased more than 400% from 2018 to 2021, with associated personal losses estimated to be more than $68 million .
Rachel Tobac, CEO of online security company SocialProof Security, says the numbers are probably a vast underestimate because most identity thefts are not reported.
Criminals use personal information about their victims – phone numbers, addresses, birthdays and Social Security numbers – obtained through data breaches, leaks, dark web purchases or phishing scams to impersonate the victims as they contact their mobile carriers.
They will claim the original phone and SIM card were damaged, lost or sold accidentally and ask for the number to be associated with a new SIM, or eSIM, card in their possession. Once this is done, the phone number belongs to the criminals, along with the ability to receive text messages or calls to verify accounts.
Prevention is the best form of protection, according to cybersecurity experts. The tricks and habits security experts say help prevent SIM-swapping are what they have long been recommending for online security in general. They include the following:
If your credentials are caught in a cyber breach, the hackers could try using the stolen passwords to get into other services to gather the personal data they need to pull off a SIM swap.
If you’ve been using the same or similar login information for multiple websites or online accounts, make sure to change it. If criminals pilfer your password from one service, they can try it on your other accounts and easily get into all of them. If you find it too hard to memorise your various credentials, consider a password manager.
Also use strong passwords that include letters, numbers and symbols. The longer they are the better. Some experts say they should be 16 characters.
Add biometrics or multifactor authentication apps and devices that do not involve texting. These methods often use separate login methods and encryption that are not tied to your phone’s identity, making them more difficult for criminals to access.
AT&T also advises contacting your carrier to set up a unique passcode to prevent significant account changes such as porting phone numbers to another carrier. Your carrier may already have other protections in place to protect against SIM swapping, so it’s worth calling them to ask.
