SIM Swapping.

What is SIM swapping?

SIM swapping is a scam where a criminal gets a mobile carrier to move your phone number to a SIM card the criminal controls. A SIM card is the small chip that links a phone to a carrier account. The FBI Internet Crime Complaint Center (IC3) calls it a malicious technique where criminal actors target mobile carriers to gain access to victims’ bank accounts, virtual currency accounts and other sensitive information.

How does a SIM swap work?

The FTC explains that scammers contact your cellular provider and say your phone was lost or damaged. They ask the provider to activate a new SIM card on a phone they control. If the provider believes the story, the FTC says the scammer, not you, gets your text messages, calls and data.

The FBI says criminals mainly use three routes:

• Social engineering, which means tricking people. Criminals pose as the victim and persuade the carrier to switch the number.
• An insider threat. A criminal pays a carrier employee to switch the number.
• Phishing, which means deceptive messages. Criminals deceive employees into downloading malware that is then used to hack carrier systems that carry out SIM swaps.

Why does losing a phone number matter?

Many accounts send a code by text message to prove who you are. The FTC says a scammer who holds your number can log in to accounts that use text message codes as a form of multi-factor authentication. The FBI adds that criminals can send “Forgot Password” requests and use text message codes to reset passwords.

What is port-out fraud?

The FCC describes a related scam. In port-out fraud, the bad actor poses as the victim and opens an account with a different carrier. The phone number is then transferred to that new account. In a SIM swap, the FCC says, the bad actor convinces the victim’s own carrier to move service to a phone the bad actor holds.

What are the warning signs?

The FTC lists some signs. You may get an unexpected notice from your provider about a SIM card being activated. Your phone may lose service for no clear reason.

How can you lower the risk?

The FTC suggests these steps:

• Do not reply to calls, emails or texts that ask for personal information.
• Limit the personal details you share online.
• Set up a PIN or password on your cellular account.
• For sensitive accounts, use an authentication app or a security key instead of text message codes.

The FBI also advises authentication beyond text messages, such as security tokens or standalone apps, and never giving account credentials during unsolicited calls. The FCC’s rules require wireless providers to use secure methods to authenticate a customer before moving a phone number to a new device or provider. The rules also require providers to notify customers right away when a SIM change or port-out request is made on their account.

What should you do if it happens?

The FTC says to contact your provider straight away to get your number back, then change your account passwords. The FBI asks victims to report to IC3 at ic3.gov.

Is SIM swapping the same as account takeover?

No. SIM swapping takes control of a phone number. Account takeover is when someone gains control of an online account. A SIM swap can be one way to reach an account that relies on text message codes, but the two terms describe different things.