A common cyber threat is SIM swapping attacks, through which hackers exploit a victim's phone number, bypass SMS-based multi-factor authentication, and steal credentials. The US Federal Trade Commission (FTC) has decided to help usersby providing some guidance on how to protect against these attacks.
SIM swapping attacks are also known as SIM hijacking, SIM splitting, or SIM jacking. The initial goal is for hackers to gain control of the victim's number.
This is often done with the help of mobile phone companies. Hackers often bribe employees and ask them to change the victim's phone number and give it to them, so that they have control and not the victim. There is also the possibility that they do not bribe employees but deceive them through social engineering.
Criminals typically use one of the following methods to carry out the attack:
- Criminals bribe or blackmail a company to participate in the crime.
- Employees participate voluntarily, exploit access to customer data, and assist criminals.
- The employees deceive their colleagues from other branches of the company and have them do the SIM card exchange.
Once criminals obtain the victims' credentials through this process, they are able to do various things, such as gain access to the bank account, steal money, use social media or email.
Also, according to the FTC: "They could change passwords and prevent you from logging into your accounts.".
What are the FTC's tips for protecting yourself from SIM swapping attacks?
- Do not respond to calls, messages or emails asking for personal information. Companies do not ask for such information through these methods. It may be a phishing attack. Therefore, you should be very careful.
- Don't share too much personal information online. Ideally, you shouldn't post details like your full name, address, or phone number on social media or any site. Criminals can use this information to answer security questions (to verify your identity) and log into your accounts.
- Use a PIN or strong password on your accounts.
- Use more effective methods for authentication, especially on accounts that contain sensitive personal or financial information. SMS-based multi-factor authentication can be bypassed in a SIM swapping attack. In this case, it is better to use an app authenticator
What about people who have fallen victim to a SIM swapping attack? How can they limit the consequences?
- You should contact your mobile carrier immediately and regain control of your phone number. Once this is done, you should change your account passwords.
- You should immediately check your credit card and bank accounts to see if any charges or changes have been made. If you notice anything unusual, contact bank .
SIM swapping attacks, like any other attack aimed at stealing credentials and thereby gaining access to accounts and personal and financial data, can cause major problems for victims. For this reason, all users should be very careful and take into account the instructions of securityin order to stay safe.
