TLDR: SIM Swapping is on the rise and we want to help keep it from happening to you. <\/p>\n\n\n\n
Gone are the days when phone numbers resided innocently in a publicly-distributed giant book of yellow or white printed pages packed with names, addresses, and phone numbers for anyone in your city or community to contact you. Now, your phone number is far more valuable than a simple tool for basic telephone interactions.\u00a0<\/p>\n\n\n\n
And it\u2019s actually far more readily available to any motivated entity that wants to find it. Your phone number is part of your digital identity, and it holds the key to a wealth of critical personal information tied to you. Bank accounts, logins, health insurance, virtually every corner of your online journey requires a phone number for account creation, verification, etc.<\/p>\n\n\n\n
Sadly, everyday we hear of a new threat to personal, cyber, and global security. We\u2019re shining some light on a seemingly obscure threat, but one that\u2019s on the rise. We\u2019ve already encountered customers (not ours, but we\u2019ll get to that) who\u2019ve fallen victim to it. It\u2019s called SIM swapping. And we don\u2019t want it to happen to you. Here\u2019s what you urgently need to know about it, and how you can lock down your phone number, no matter who\u2019s the carrier.<\/p>\n\n\n\n
Also known as SIM hijacking or a SIM swap attack, SIM swapping happens when an unauthorized individual essentially hijacks your phone number in order to receive critical information like your 2FA account verification numbers to login to your accounts.\u00a0<\/p>\n\n\n\n
SIM stands for <\/a>\u201c\u2018Subscriber Identity Module\u2019 and it\u2019s a tiny but crucial chip in your mobile device storing unique identifiers like the International Mobile Subscriber Identity (IMSI) and authentication keys for carriers to verify your identity, route calls and messages, and provide mobile data services.\u201d Unlike the name \u201cSIM swapping,\u201d attackers never actually snatch and steal or swap your device\u2019s physical SIM card. More or less, they steal your phone number directly from your carrier and transfer it to their SIM or eSIM card.\u00a0 \u201cUnauthorized SIM changes, sometimes called SIM swapping or SIM hijacking attacks, occur when a customer\u2019s phone number is transferred to a different SIM card or eSIM profile under the control of a criminal. If the SIM swap is successful, the criminal may intercept the customer’s phone calls and text messages to receive one-time security codes from social media, banks, credit card companies, cryptocurrency exchanges, and other financial institutions, allowing them to potentially access those accounts and cause financial and reputational harm to the customer.\u201d<\/p>\n<\/blockquote>\n\n\n\n Recently, an individual who was not actually a NumberBarn customer, frantically reached out to NumberBarn support saying that an attacker had stolen their phone number, managing to convince their carrier to port their number out, and that the thief was attempting to port it to NumberBarn. In a feat of collective heroism, the major carrier and our legendary support team sprang into action together to thwart the real-time unauthorized port and return the phone number to its rightful owner. Fortunately, this does NOT happen everyday and we\u2019re proud to have been a part of bringing a positive outcome to a unique and scary situation.<\/p>\n\n\n\n In this scenario, the fraudster attempted to move the number to NumberBarn, and the victim recognized the signs of phone number theft while in progress, which allowed all parties to collaborate to retrieve the phone number. But in most SIM swapping scenarios, the attacker or perpetrator manages to port the number to a SIM or eSIM controlled by them, making it much more difficult to interrupt or intercept once it\u2019s ported away. <\/p>\n\n\n\n Unfortunately, SIM swapping can happen to anyone. The customer above wasn\u2019t a particularly high-profile individual. Of course, people with more public visibility or in more financially lucrative positions can become more frequent or obvious targets. <\/p>\n\n\n\n Like all security scams, SIM swapping may evolve as technology changes and fights against it. For now, it typically works like this:<\/p>\n\n\n\n Like our real life scenario earlier, you can sometimes prevent further account invasions by recognizing suspicious signs early on or right when they happen. Keep an eye out for:<\/p>\n\n\n\n Thankfully, you can help protect yourself from SIM swap attacks literally right now<\/em> with a few very straightforward steps.<\/p>\n\n\n\n 1. Set a SIM PIN or account passcode with your carrier. <\/strong>Most major carriers including Verizon, AT&T and T-Mobile offer extra SIM swapping protection via a separate PIN or passcode which you personally provide to them before any changes to your account, including a port out or SIM swap. Check out this recent KCLA news investigation<\/a> with \u201cRich On Tech\u201d for a quick instructional play-by-play on how to turn on protection with the major carriers.<\/p>\n\n\n\n 2. Consider using an authenticator app for important 2FAs. <\/strong>Accessing your SMS-based 2FA remains the intended tool for exploitation by perpetrators in SIM swapping attempts. Authenticator apps like Google Authenticator, Authy, or Microsoft Authenticator create and send codes locally to your device instead of your phone number. When a site offers an authenticator app as a 2FA option, consider using it instead of text message 2FA.<\/p>\n\n\n\n 3. Use a hardware security key for high-value accounts. <\/strong>Kind of like an old school USB stick, but a lot more high tech, a physical security key (like a YubiKey – no affiliation, just an example) offers extreme layers of security for your most valuable accounts. Just don\u2019t misplace it!\u00a0<\/strong><\/p>\n\n\n\n 4. Minimize your publicly available personal info.<\/strong> Lock down your private info and take careful inventory of all of your privacy settings on social media, etc. Once upon a time platforms like Meta (the artist formerly known as Facebook) publicly displayed whatever phone number you entered in your \u201cAbout\u201d section unless you turned it off in your settings. These platforms may make major updates or UI changes which may inadvertently affect your account and privacy settings, unbeknownst to you.<\/p>\n\n\n\n 5. Use unique, strong passwords for your carrier account, etc. <\/strong>Don\u2019t use the same generic password across multiple accounts, as tempting as it is. Change your passwords fairly often. Specifically, if a phone carrier <\/strong>account uses the same password as one in a data breach, an attacker could log in and request a SIM swap online without ever calling the carrier. Make it extra complicated and unique with a password manager.<\/p>\n\n\n\n You can safeguard your phone number even further and better protect your privacy by getting an alternate phone number<\/strong>. Run, don\u2019t walk\u2026head straight over to a phone number provider and get an alternate phone number right now. At this particular point in \u201ctoday\u2019s digital era\u201d (as the AI\u2019s frequently say), we believe everyone<\/em> should have a second phone number, and not just because we sell phone numbers.<\/p>\n\n\n\n You can use free numbers from platforms like Google Voice<\/strong>, but note that if you don\u2019t use them for a certain period of time Google will deactivate them. Or choose from millions of numbers<\/strong> (even some fun ones) starting at just $9.95 at NumberBarn<\/a>, and activate a call forwarding plan starting at just $6.99\/mo. (Pro tip, look for numbers labeled \u201cGet It Now\u201d<\/strong> for immediate activation.) Incoming calls to your new number forward to your private number, without the caller ever seeing the private number. This essentially allows you to have two (or more) phone numbers on your single cell phone. Use the alternate number for rewards, new accounts, or junk accounts, etc.\u00a0\u00a0<\/p>\n\n\n\n Turn on \u201cTransfer Lock\u201d<\/strong> to add extra protection against unauthorized transfers and take advantage of NumberBarn\u2019s additional built-in security features. Find more simple ways to protect any phone number here.<\/a>\u00a0<\/p>\n\n\n\n If you want to take more drastic measurers to fortify your phone number and security, you could also consider \u201cretiring\u201d your old number while still keeping it under your ownership. Port it to NumberBarn and park it,<\/a> which securely stores it without any calling capacity. You can view incoming call logs but it won\u2019t receive incoming texts unless you enable texting, making it harder for attackers to access and hijack your number, especially if you\u2019ve turned on Transfer Lock.<\/p>\n\n\n\n If you suspect you\u2019re under a SIM swap attack right now, don\u2019t delay. Act fast. And we mean fast. Stop everything and:<\/p>\n\n\n\n
To put it in perspective, Verizon<\/a> gives a more technical and telling explanation:<\/p>\n\n\n\n\n
Not All Heroes Where Capes – A Scary Story with a Miracle Save<\/h2>\n\n\n\n
How SIM Swapping Works<\/strong><\/h2>\n\n\n\n
\n
Ways to Recognize SIM Hijacking<\/strong><\/h2>\n\n\n\n
\n
How to Protect Yourself From SIM Swapping<\/strong><\/h2>\n\n\n\n
Get an Alternative Number<\/h2>\n\n\n\n
What to Do If You’ve Been SIM Swapped<\/strong><\/h2>\n\n\n\n
\n
<\/li>\n<\/ul>\n\n\n\nThere\u2019s Good News Too<\/h2>\n\n\n\n