TLDR: SIM Swapping is on the rise and we want to help keep it from happening to you.
Gone are the days when phone numbers resided innocently in a publicly-distributed giant book of yellow or white printed pages packed with names, addresses, and phone numbers for anyone in your city or community to contact you. Now, your phone number is far more valuable than a simple tool for basic telephone interactions.
And it’s actually far more readily available to any motivated entity that wants to find it. Your phone number is part of your digital identity, and it holds the key to a wealth of critical personal information tied to you. Bank accounts, logins, health insurance, virtually every corner of your online journey requires a phone number for account creation, verification, etc.
Sadly, everyday we hear of a new threat to personal, cyber, and global security. We’re shining some light on a seemingly obscure threat, but one that’s on the rise. We’ve already encountered customers (not ours, but we’ll get to that) who’ve fallen victim to it. It’s called SIM swapping. And we don’t want it to happen to you. Here’s what you urgently need to know about it, and how you can lock down your phone number, no matter who’s the carrier.
What is SIM Swapping?
Also known as SIM hijacking or a SIM swap attack, SIM swapping happens when an unauthorized individual essentially hijacks your phone number in order to receive critical information like your 2FA account verification numbers to login to your accounts.
SIM stands for “‘Subscriber Identity Module’ and it’s a tiny but crucial chip in your mobile device storing unique identifiers like the International Mobile Subscriber Identity (IMSI) and authentication keys for carriers to verify your identity, route calls and messages, and provide mobile data services.” Unlike the name “SIM swapping,” attackers never actually snatch and steal or swap your device’s physical SIM card. More or less, they steal your phone number directly from your carrier and transfer it to their SIM or eSIM card.
To put it in perspective, Verizon gives a more technical and telling explanation:
“Unauthorized SIM changes, sometimes called SIM swapping or SIM hijacking attacks, occur when a customer’s phone number is transferred to a different SIM card or eSIM profile under the control of a criminal. If the SIM swap is successful, the criminal may intercept the customer’s phone calls and text messages to receive one-time security codes from social media, banks, credit card companies, cryptocurrency exchanges, and other financial institutions, allowing them to potentially access those accounts and cause financial and reputational harm to the customer.”
Not All Heroes Where Capes – A Scary Story with a Miracle Save
Recently, an individual who was not actually a NumberBarn customer, frantically reached out to NumberBarn support saying that an attacker had stolen their phone number, managing to convince their carrier to port their number out, and that the thief was attempting to port it to NumberBarn. In a feat of collective heroism, the major carrier and our legendary support team sprang into action together to thwart the real-time unauthorized port and return the phone number to its rightful owner. Fortunately, this does NOT happen everyday and we’re proud to have been a part of bringing a positive outcome to a unique and scary situation.
In this scenario, the fraudster attempted to move the number to NumberBarn, and the victim recognized the signs of phone number theft while in progress, which allowed all parties to collaborate to retrieve the phone number. But in most SIM swapping scenarios, the attacker or perpetrator manages to port the number to a SIM or eSIM controlled by them, making it much more difficult to interrupt or intercept once it’s ported away.
Unfortunately, SIM swapping can happen to anyone. The customer above wasn’t a particularly high-profile individual. Of course, people with more public visibility or in more financially lucrative positions can become more frequent or obvious targets.
How SIM Swapping Works
Like all security scams, SIM swapping may evolve as technology changes and fights against it. For now, it typically works like this:
- The scammer identifies their target. The attacker may research the victim via publicly available information like social media, business pages, even tapping into the victims prior passwords and any available information (like phone numbers, PINs, DOBs, addresses, etc.) using scam tactics like phishing, or stolen from prior data breaches.
- The scammer impersonates the target. The attacker essentially impersonates the victim, contacting the victim’s phone number provider or carrier and convincing them to port the number away. The perpetrator may claim the number was lost or stolen (ironically).
- The scammer gains control of the victim’s phone number and begins accessing accounts. The carrier allows the phone number to transfer (port) to the attacker’s SIM, allowing the perpetrator to assume control over the phone number and begin to gain access to your accounts, etc. by utilizing your account 2FAs sent to your phone number, etc.
Ways to Recognize SIM Hijacking
Like our real life scenario earlier, you can sometimes prevent further account invasions by recognizing suspicious signs early on or right when they happen. Keep an eye out for:
- Phishing attempts, etc: Unusual text messages or emails with links that ask you for your login credentials or any personal information have gotten increasingly sophisticated and anyone can fall for them. If you’re unsure about a message that looks legit, go directly to the website from your browser to login. Do not log in through the link sent to you via text or email.
- Sudden loss of cellular coverage and phone access: If you suddenly completely lose cell coverage, stop receiving calls and texts, especially if you’ve just used your phone and in a place you always have coverage, consider this an immediate red flag.
- Unanticipated account activity notification emails: Login notifications and password reset emails surface for accounts you haven’t accessed.
- Blocked access to apps, platforms, etc: You’re suddenly locked out of your bank, social media or other accounts.
- Closed accounts: Emails from your phone provider or carrier that inform you that your phone number transferred or that you’ve activated a new SIM.
How to Protect Yourself From SIM Swapping
Thankfully, you can help protect yourself from SIM swap attacks literally right now with a few very straightforward steps.
1. Set a SIM PIN or account passcode with your carrier. Most major carriers including Verizon, AT&T and T-Mobile offer extra SIM swapping protection via a separate PIN or passcode which you personally provide to them before any changes to your account, including a port out or SIM swap. Check out this recent KCLA news investigation with “Rich On Tech” for a quick instructional play-by-play on how to turn on protection with the major carriers.
2. Consider using an authenticator app for important 2FAs. Accessing your SMS-based 2FA remains the intended tool for exploitation by perpetrators in SIM swapping attempts. Authenticator apps like Google Authenticator, Authy, or Microsoft Authenticator create and send codes locally to your device instead of your phone number. When a site offers an authenticator app as a 2FA option, consider using it instead of text message 2FA.
3. Use a hardware security key for high-value accounts. Kind of like an old school USB stick, but a lot more high tech, a physical security key (like a YubiKey – no affiliation, just an example) offers extreme layers of security for your most valuable accounts. Just don’t misplace it!
4. Minimize your publicly available personal info. Lock down your private info and take careful inventory of all of your privacy settings on social media, etc. Once upon a time platforms like Meta (the artist formerly known as Facebook) publicly displayed whatever phone number you entered in your “About” section unless you turned it off in your settings. These platforms may make major updates or UI changes which may inadvertently affect your account and privacy settings, unbeknownst to you.
5. Use unique, strong passwords for your carrier account, etc. Don’t use the same generic password across multiple accounts, as tempting as it is. Change your passwords fairly often. Specifically, if a phone carrier account uses the same password as one in a data breach, an attacker could log in and request a SIM swap online without ever calling the carrier. Make it extra complicated and unique with a password manager.
Get an Alternative Number
You can safeguard your phone number even further and better protect your privacy by getting an alternate phone number. Run, don’t walk…head straight over to a phone number provider and get an alternate phone number right now. At this particular point in “today’s digital era” (as the AI’s frequently say), we believe everyone should have a second phone number, and not just because we sell phone numbers.
You can use free numbers from platforms like Google Voice, but note that if you don’t use them for a certain period of time Google will deactivate them. Or choose from millions of numbers (even some fun ones) starting at just $9.95 at NumberBarn, and activate a call forwarding plan starting at just $6.99/mo. (Pro tip, look for numbers labeled “Get It Now” for immediate activation.) Incoming calls to your new number forward to your private number, without the caller ever seeing the private number. This essentially allows you to have two (or more) phone numbers on your single cell phone. Use the alternate number for rewards, new accounts, or junk accounts, etc.
Turn on “Transfer Lock” to add extra protection against unauthorized transfers and take advantage of NumberBarn’s additional built-in security features. Find more simple ways to protect any phone number here.
If you want to take more drastic measurers to fortify your phone number and security, you could also consider “retiring” your old number while still keeping it under your ownership. Port it to NumberBarn and park it, which securely stores it without any calling capacity. You can view incoming call logs but it won’t receive incoming texts unless you enable texting, making it harder for attackers to access and hijack your number, especially if you’ve turned on Transfer Lock.
What to Do If You’ve Been SIM Swapped
If you suspect you’re under a SIM swap attack right now, don’t delay. Act fast. And we mean fast. Stop everything and:
- Secure your email account first. If an attacker can reset your email password, they can reset every account they can find that’s connected to it. Log in from a device not connected to your phone number and immediately change the password and 2FA method.
- Call your phone carrier ASAP, from a different phone. Let them know your number has been compromised and fraudulently ported, request them to reverse the swap and lock your account if they can.
- Alert your bank and financial institutions. Call banks, credit card companies, and any financial platforms you use. Ask them to flag your account for suspicious activity and add additional verification requirements, credit freezes, and fraud alerts.
- Change passwords on your most critical accounts.
- File a report with the FTC and local law enforcement. File a fraud report at reportfraud.ftc.gov to establish an official record to help with identity theft disputes and investigations.
There’s Good News Too
Yes, we know that was a lot, but as Smoky the Bear says “only you can prevent forest fires!” In this case, the good news is that you can prevent identity theft “fires” today, even by doing just a few of the recommended steps above.
And if you have any questions about how NumberBarn helps you protect your personal number, our (truly) superhero support team is ready to help.
