Fraud Detection - 2FA Bypass Methods and SIM Cloning

Question

I am assisting another Data Scientist with helping a bank detect and prevent fraud via data analysis and predictive modeling (Machine Learning). It's a challenge because the proportion of known fraudulent cases is small and some fraud goes undetected.

I need to combine my statistical modeling techniques with subject matter expertise (SME) in the domain of fraud / infosec. We had a number of "traditional" rules to serve as SME, such as checking IP addresses, comparing users' current browser data / fingerprint / canvas against the past and for internal consistency, etc. We can catch most fraud this way by requiring 2-Factor Authentication (2FA) whenever something looks suspicious.

However, one of our customers indicated that now fraudsters are able to "defeat 2FA by cloning SIM cards and other methods". This would be a huge complication but I've never heard of it before, at least not on any significant scale that wouldn't involve offline contact between the customer/victim and fraudster. So, my first question is:

1. Is this true? Does this happen and if so, how is it being done? Any known mitigation strategies?

This is only a small and intermittent part of my job, so it's quite possible that my information is out of date and there are new techniques like this. This leads me to my second question:

2. Are there other methods like this that I should be aware of, which would allow attackers to bypass 2FA?

We were aware that sometimes the identity thief will have enough personal information to call or login to the bank, pass verification, and update the phone / email contact info so they can later try to bypass 2FA when making a withdrawal. We have a strategy to combat this, but if there are other attack vectors please let me know.

Answer 1

Yes, people can and do attack SMS-based 2FA with SIM swapping attacks. Essentially, the attacker convinces the phone provider to port the number from the legitimate owner to a SIM card that they are in possession of, meaning that the attacker can receive all calls and texts. This can happen through social engineering or bribery. (Consider the cost of bribing an employee for $500 if you can make off with $20,000.)

TOTP is more secure, but it is vulnerable to phishing (as is SMS 2FA). Essentially, the attacker creates a phishing site and prompts the user to log in with their username, password, and TOTP code, and then the attacker immediately uses that to log into the real site and perform malicious activities.

FIDO2 and WebAuthn security keys avoid this problem because they produce a digital signature which is bound to the domain of the website (as the browser sees it). As a consequence, on a phishing site, the domain will be different, and the signature will fail to validate if proxied to the real site. In addition to physical security keys such as YubiKeys, WebAuthn can also be handled with the user's unlock code on Android phones or Windows Hello, among other implementations.

Of course, many people don't have devices that can do WebAuthn, but if it's possible to implement, it's the gold standard for 2FA. TOTP is also a good option, since authentication apps like Google Authenticator or Authy are available and easy to use. (Please, for goodness' sake, do not use a proprietary TOTP app, just use the standard approach.) I personally use WebAuthn wherever possible and add TOTP as a backup in case I lose my YubiKey.

My recommendation in general is that if you're using 2FA to just always use 2FA and not just when something looks suspicious. SMS 2FA is insecure, but it's better than nothing and makes widespread attacks more difficult. Providing WebAuthn for those who have it (or, for that matter, standard TOTP) would in fact put your financial institution beyond literally every financial institution I've done business with in the U.S. or Canada. Forcing 2FA in all cases will dramatically raise the cost of attacking your institution, although it may lead to an increase in customer support problems. In conjunction with other measures to prevent phishing sites from being successful, you'll probably end up much less of a target.