One of the most common cybersecurity protections is multi-factor authentication (MFA). You might use MFA when checking your bank account or logging into a social network. After typing in your password, the system requires one more step for verification: often, a text or email is sent to your phone. MFA is an effective way to bolster the security of any account. But what if a malicious hacker could use social engineering to access your phone number? That would enable them to break past MFA protections, log in to your most personal accounts, and wreak havoc. We’re talking about a SIM swap attack.
In this article, we’ll define that term and discuss what you need to know to stay secure in a world of dangerous hackers.
What is a SIM?
Before we dive into SIM swap attacks, let’s establish what a SIM is, By SIM, we mean the SIM card in your phone.
SIM is an acronym for Subscriber Identity Module. It’s usually a physical card that gives your phone a unique phone number, though digital versions, such as eSIM cards, are available, too. If you remove a SIM card from one phone and place it in another, you should continue to receive the same texts and calls you received on the first phone.
Your SIM is like your personal identifier within the phone.
SIM swap attacks defined
A SIM swap attack occurs when a malicious hacker steals the SIM card from your phone to access your text messages. Armed with your SIM, they can initiate a multi-factor authentication message and use the code they receive to break into your accounts.
With these one-time codes, hackers have been known to log into bank accounts, crypto exchanges, and credit card accounts. In short, this attack can put some of your most important assets at risk.
It’s bad enough that the attacker could steal money from you or personal information. But to make things worse, many SIM attacks also include changing your information. For example, a SIM swap attack might log into your social media accounts and change the passwords—leaving them inaccessible.
A hacker doesn’t always need to steal your physical SIM card. Sometimes, they can hack it or manipulate the SIM to steal incoming data. Let’s discuss the most common ways a SIM swap attack takes place.
Common SIM swap attack methods (and how to notice them)
There’s more than one way for hackers to steal your SIM. These are the most common ones:
Social engineering
A hacker can learn much about you from what’s publicly available online. They might stalk your social media to see where you live, the names of your pets and family members, and your contact information, like a phone number.
Armed with this intimate information, the hacker can call your phone company pretending to be you through a mix of call spoofing, minimal information about the victim, and persuasion. The result is that the phone carrier is manipulated into swapping your SIM card into the hacker’s phone.
Seems too hard to believe? Here’s a short video of this exact attack happening in less than two minutes:
This is how hackers hack you using simple social engineering:
Physical theft
This attack is more accessible to catch and must occur quickly if the hacker wants to progress. In this case, the hacker must either steal the physical phone or its SIM card (which means getting ahold of the victim’s device).
With the SIM, the hacker can log into accounts, quickly bypass the MFA, and deploy their attack. This form of attack is obvious when done by a stranger. It may be harder to notice if it’s done by someone you know, such as a roommate or loved one. When you share the house with someone, getting ahold of their device as a form of theft might be easy.
This is another reason to have a strong PIN on your device. Keep it away from people you don’t trust.
Desktop login
Receiving texts on your computer is convenient. For example, many iPhone users enable the iMessage app on their Mac computers. Android users can do the same with various messaging apps.
Unfortunately, in cybersecurity, convenience comes at the cost of greater personal risk. This is a strong example. If someone can log into your messaging app from their device, there’s a chance they can begin seeing your messages—and initiate a SIM attack.
Keep your passwords strong. Change them frequently. A leaked password can be destructive and expensive.
Are you the victim of a SIM swap attack? Here are the common signs
Most of us use our phones many times throughout the day. This can work to your advantage. You can pay attention to unusual activities. Here are the top indicators of compromise for a victim of a SIM swap attack:
No phone service
When someone steals your physical SIM card, your phone loses the ability to send and receive SMS, phone calls, and data. This is the easier clue that someone may have stolen or tampered with your SIM.
Unprompted MFA texts and calls
As we discussed, sometimes SIM theft doesn’t require the SIM card to leave your phone. The thief may simply be logged into your phone from a computer. In that case, beware of MFA texts from your bank, social media profiles, or other personal accounts. While these may simply indicate a failed login attempt by a hacker, it could also suggest that someone is in the process of completing a SIM attack. Immediately contact the company. Login to the account and change your password.
Check your “Sent” messages
Check your outgoing calls and text messages. Do you see anything that you know you didn’t send? This could be the result of someone using your SIM without your permission. Or equally as bad, it could be a sign that your phone has been hacked. Either way, it’s time to take action.
SIM swap attacks are identity theft
SIM swap attacks work when the thief successfully impersonates the owner of the SIM. That makes SIM swap attacks a case of identity theft. They’re using your information to steal and hack.
Preventing identity theft—especially SIM swapping—begins with taking extra precautions when sharing personal information online. Sharing your email address, phone number, and the names of people and places close to you can have security risks.
The best thing you can do to defend yourself is to be more private online. Share as little personal information on the internet as possible. When you stop using an old account, delete your information to reduce the risk of hacks or data leaks.
Finally, one of the best ways to passively stay more anonymous online is to use a trusted virtual private network (VPN). This tool routes your online activity through a private and encrypted server, making it harder for malicious hackers to track your activity and intercept your network traffic.
