![\"\"](\"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/wp-content\/uploads\/sites\/119\/2024\/09\/Diagram-of-the-SIM-Swap-process-Phase-1-attacker-accesses-victims-account-credentials.jpg\")
<\/figure>\n\n\n\nSource: Financial Cybercrime: A Comprehensive Survey of Deep Learning Approaches to Tackle the Evolving Financial Crime Landscape (Nicholls, Kuppa and Le-Khac, 2021) https:\/\/www.researchgate.net\/figure\/Diagram-of-the-SIM-Swap-process-Phase-1-attacker-accesses-victims-account-credentials_fig5_356887995<\/a><\/em><\/p>\n\n\n\n SIM swapping is a targeted attack where the scammer is able to convince the victim\u2019s cell provider to send them a new SIM card for the victim\u2019s account [5]. The attacker is able to convince the cellphone provider that they are the victim through social engineering or other means, such as knowing the answers to your password recovery questions. Then, the attacker is able to receive an OTP for any accounts linked to that phone. This is especially an issue for bank and cryptocurrency accounts, where attackers are able to authenticate fraudulent withdrawals [5].<\/p>\n\n\n\n SIM swapping is lucrative enough that SIM-swap-as-a-service is being offered by some hacker groups [5]. Many of these groups have gone after celebrities and other high profile individuals, amassing $1.8 million and $5 million in cryptocurrency in some recent individual attacks [6]. Even actress Sydney Sweeney has fell victim to this scam. Her X account was taken over and used to advertise a fraudulent cryptocurrency service [7].<\/p>\n\n\n\n However, regular people have been targeted as well. In August of this year, 10 people in Toronto were arrested for using SIM swapping to defraud multiple individuals of over $1 million [9]. Over 1500 accounts were compromised by this group of attackers [9].<\/p>\n\n\n\n There a few strategies you can use to reduce your risk of being a victim of a SIM swap. As recommended by Europol, if possible, use an authenticator app for 2FA, such as those offered by Google or Microsoft, rather than having codes sent by SMS [6]. As well, to avoid being a victim of social engineering attacks, limit the personal information you share online and avoid giving any such information to unknown callers [6]. Additionally, you can contact your mobile carrier and ensure your account is configured using the highest security settings. If possible, try to get your account configured so that acquiring new SIM cards can only be done in person [6].<\/p>\n\n\n\n Another way to safeguard yourself is to be aware if you are currently experiencing a SIM swap attack. During an attack, your phone will lose service. You may see \u201cSOS\u201d in the top right of your phone where your cellular signal information typically is [9]. This disruption may only be temporary as the attacker will often switch back to the original SIM card after gaining access to your accounts [9]. If you experience an unexpected service disruption, contact your cellphone carrier to determine if any new SIM card requests were made recently. Also, notify your bank if you see any fraudulent activity taking place around that time.<\/p>\n\n\n\n Though 2FA by SMS message is by no means perfectly secure, is still preferable to just using one factor of authentication, like a password. However, if an authenticator app is available for 2FA, that can provide an extra layer of protection against attacks such as SIM swap attacks. As always, staying on top of current advancements in security and authentication will allow you to keep your accounts secure, even as new attacks are identified.<\/p>\n\n\n\n [1] https:\/\/www.nomios.com\/news-blog\/password-problem\/<\/a><\/p>\n\n\n\n [2] https:\/\/www.cloudflare.com\/learning\/bots\/what-is-credential-stuffing\/<\/a><\/p>\n\n\n\n [3] https:\/\/www.fortinet.com\/resources\/cyberglossary\/brute-force-attack#:~:text=A%20simple%20brute%20force%20attack,identification%20number%20(PIN)%20codes<\/a>.<\/p>\n\n\n\n [4] https:\/\/www.pearsonitcertification.com\/articles\/article.aspx?p=1718488<\/a><\/p>\n\n\n\n [5] https:\/\/arstechnica.com\/security\/2023\/11\/the-fcc-says-new-rules-will-curb-sim-swapping-im-pessimistic\/<\/a><\/p>\n\n\n\n [6] https:\/\/arstechnica.com\/information-technology\/2021\/02\/authorities-bust-sim-swap-ring-they-say-took-millions-from-the-rich-and-famous\/<\/a><\/p>\n\n\n\n [7] https:\/\/www.pcmag.com\/news\/sydney-sweeneys-x-account-reportedly-hijacked-via-yet-another-sim-swap<\/a><\/p>\n\n\n\n [8] https:\/\/mobileklinik.ca\/blog\/how-do-sim-cards-work-and-where-can-you-buy-them\/<\/a><\/p>\n\n\n\nHow can you prevent a SIM Swap Attack?<\/h2>\n\n\n\n
Conclusion<\/h2>\n\n\n\n
References<\/h2>\n\n\n\n