SIM Swap Fraud. It just happened to me.

All my data was stolen overnight.

July 11, 2020. By Dominic Alvieri,  @AlvieriD

Other people can write about SIM Swap Fraud. I can tell you how it feels. You feel violated. Exposed. Vulnerable. Angry. I lived in New York City when you didn't always get an “I Love NY” greeting with local interactions, but I never felt vulnerable. It just isn't supposed to happen in the middle of the night without breaking into my home. My alarm or pets would have alerted me. 

I didn't have a chance.  

 

SIM Swap Fraud is not just an ID theft

It was the usual wake up routine except this morning was different. An ominous security text from my phone service provider was the first image after turning off my phone alarm. "A request to move is in progress…Calls and texts will go to your new phone/SIM card. Please call if you did not request". The text was hours ago in the middle of the night. Call you to deny the request with what. The phone service is already gone!

What do you do?

Act first and ask questions later. Call your service provider immediately. Find a way. Get your service and phone number back first. Your phone number is connected to your bank accounts, business accounts, email and social media accounts. Keep calling everyone. Every account has been compromised. 

The SIM Swap Scam is not an ordinary identity theft. It is in a class by itself. Your phone was ported to another device and all of your data has been assigned to a new SIM card as well. You have to get the phone number back. The criminal is a few hours ahead.

A SIM card basically instructs the phone to connect to a specific cellular network. The SIM Swap Scam is a socially engineered attack. They targeted the phone company representative and pretended to be me. AT&T, Sprint, T-Mobile and Verizon all claim to have “extra security”, which they do, but it is usually an additional pass code or a PIN. Better security best practice would be to package voice recognition technology to authenticate user ID. Confirming the actual loss of service or device with a call would have prevented serious damage and would have been nice.

2:58 AM. Security alert text issued and within two minutes, it is gone. My email and bank account are breached first. Go down the list of horrors. Brokerage, business, intellectual property. The recovery begins. What a forensics trail. The biggest issue was not money lost or every conversation being elsewhere, but private pictures. Private moments not meant to be on Facebook, Twitter or auctioned off by some low life on the dark web. Look at your phone. Look in your phone. It can all be stolen overnight.

How do you protect yourself? Add as much security you can with your phone provider. Private backup emails and at least one clean or unknown phone number is paramount. Basic information is already in the criminals hands. The criminal enterprise has advanced with technology. Data dumps and socially held auctions of personal and business data is being conducted right now on the dark web. No longer is it just a phish. Now it is a Spear. It can be a whaling, smishing or vishing. The list goes on.

The Cyber Show on Blogger

 

Two Factor Authorization(2FA) is a great tool, but make sure to use it correctly. Data in SMS messages is not encrypted and can be obtained without a SIM swap. Use an end to end encrypted messaging app. There are a few good ones out now. Google Authenticator is a great 2FA app. It is tokenized and adds extra security. Be careful how you set it up. I use a special set up. Do not put every account online. Use cold bank and business accounts and cold storage for any cryptocurrency. That will remove a valuable bread crumb trail for criminals. Do not place any business data, intellectual property or documents on your phone. Eliminate any app that is a risk. Do not use a password keeper. 

Protect your data. You can control and limit the information you put online or on your phone. Restrict the critical data and monitor frequently. Do not put every bit of information about your life on social media. The criminal underworld has databases on us. Criminals troll sites to gather information on their targets. It happens more and more every day. Prepare for the unexpected.   

   

Independent Security Researcher. 

                

The Cyber Show on YouTube.

The Cyber Show on Facebook Live.

The Cyber Show on Blogger.   @AlvieriD