SIM hijacking, or "SIM-jacking," is a new, dangerous way that fraudsters use to steal money from people by hacking their phones.
As a growing trend, thieves are taking advantage of mobile providers' ability to "port" a phone number between different SIM cards.
Under normal circumstances, this feature is quite useful for carriers' customers. If a customer loses or breaks their SIM card, they can buy a new one and ask their mobile service provider to transfer the original phone number to the new device. The provider will ask for some security information to make sure the caller is the rightful owner before simply sending the phone number to the new SIM card.
But a series of high-profile SIM-jacking cases – including that of Jack Dorsey, CEO of Twitter – have revealed how fraudsters can use phone number portability to gain access to people's personal information and steal large sums of money.
How does SIM-jacking work?
First, scammers need to gather the security information they need to port their victim's phone number. They can do this through:
- Sending phishing scam emails.
- Bribery of employees of the victim's mobile phone service provider
- Gaining the trust of victims to reveal sensitive information.
Once they have the security information or passwords they need, the scammers will pretend to be the rightful owner when they call the victim's mobile service provider and convince them to "port" the victim's phone number to a new SIM card.
The victim's phone will lose its network connection, and any texts and calls intended for it will now be received by the scammer's phone.
Why do scammers do it?
SIM-jacking is the first step for scammers to gain access to their victim's money and personal information.
If you forget your email or bank account password , these companies will send you a security code as part of a verification process to reset your password .
But once the scammers have captured a SIM card, they will obtain the verification security codes – allowing them to reset their victim’s passwords and gain access to their social media accounts, bank accounts and email.
How can I prevent it?
If you are concerned about SIM-jacking, you can call your mobile service provider and ask them to add extra security to your account, such as using a PIN when making changes to your details.
You should make sure that all your accounts – email, bank account, social media accounts, online shopping – have strong and unique passwords. This will make it harder for fraudsters to hack into all of your accounts.
You should avoid sharing too much personal information on social media. Social media is, of course, a key source of information for malicious hackers
