SIM Swapping Attacks: A Surprisingly Common Cyberthreat

SIM swapping attacks quintupled from 2021 to 2022. Potential consequences of this cyberattack include monetary theft and reputational harm.

• Anyone may be targeted by a SIM swapping attack and the impacts can extend far beyond the individual who is targeted to include professional or personal networks.
• In this post, we’ll discuss SIM swapping, social engineering, two factor Authentication (2FA), and personal information exposure.

What Is a SIM Swapping Attack?

Subscriber Identification Module (SIM) swapping attacks are a rising cyber menace that can significantly impact your finances, reputation, and privacy. SIM swapping attacks increased by an astounding 400% from 2021 to 2022, according to the Federal Trade Commission (FTC).

Hackers use SIM swapping attacks, sometimes called SIM hijacking, to access your texts and calls. They use your personal information to impersonate you to your phone service provider and redirect your calls and texts to a device with a new SIM card that they control. The hackers can then receive one-time security codes from banks, cryptocurrency exchanges, and other service providers to gain unauthorized access to accounts on these sites.

How Does a SIM Swapping Attack Impact You?

SIM swapping attacks can detrimentally impact you financially and reputationally. Hackers can directly target you to compromise your accounts that have your phone number associated with password recovery to take fraudulent actions, such as unauthorized money withdrawals on bank accounts. Hackers can also access your online accounts, and send malicious links via social media posts or emails while impersonating you to your closest connections.

• Your data may also be obtained by hackers through SIM swapping attacks on third-party entities such as companies that have stored your personal data.
  
• Individual employees may also be targeted as a gateway to access corporate systems of their employer. Hackers who have successfully victimized an employee can use that employee’s access to compromise corporate systems including customer data, proprietary information, and sensitive business material. They can leak the information, demand a ransom from the company, or impersonate high-profile executives to disrupt corporate operations.
  
  

Two SIM swapping attacks in August and September 2023 highlight how SIM swapping attacks impact an individual’s daily life and an enterprise’s business operations:

• In the case of Vitalik Buterin, co-founder of Ethereum, hackers gained access to his phone number by social engineering T-mobile. They then hijacked Buterin’s Twitter account, which only needed a phone number for verification to login, and posted malicious links that defrauded several followers in early September.

• An employee of Kroll, a financial advisory firm, was victimized in a SIM Swapping attack in August 2023. The hackers transferred the employee’s phone number to an attacker-controlled device and then used it to gain unauthorized access to company and customer information, according to media reporting.
  
  

The Role of Social Media and Personal Information Exposure

Your public social media activity and online exposure may provide hackers with a treasure trove of personal information that they can use to target you for SIM swapping attacks. Information such as your phone number, email, and other details are often accessible online, facilitating attackers in impersonating you to mobile carriers and orchestrating SIM swaps. The information you provide to retail rewards programs, real estate aggregators, and even publicly available state and government records can populate data aggregators and general internet searches. The companies you provide your data to, or where your data has been sold to for marketing purposes, can also be susceptible to data breaches. Experienced cybersecurity hackers use convincing social engineering methods through social media to try and coerce you, a company, or someone in your network to divulge your personal information.

How Do You Know If You Have Been SIM Swapped?

Detecting a SIM swapping attack is challenging, but not impossible and it is essential to stay vigilant. The first sign of a SIM swapping attack is receiving notifications from your provider that your phone number or SIM card has been activated elsewhere. If you have the proper settings enabled on your provider account, you may receive notifications or email alerts that passwords, pin numbers, security questions, or general contact information has been changed or that logins were attempted from unrecognized locations or devices.

How Do You Prevent SIM Swapping Attacks?

Safeguarding yourself against SIM swapping attacks requires you to be proactive. Here are some key methods to help minimize your chances of being the victim of a SIM swapping attack:

• Utilize non-SMS two factor authentication (2FA) methods such as biometrics, authenticator apps, or a physical security key on all of your online accounts. Never use a text message as a form of 2FA if more secure options are offered. Adding a secure second form of authentication creates an extra step in verifying that it is you accessing your account. This extra step may lock potential hackers out as a result of too many failed attempts and alert you of unauthorized access attempts.

• Contact your mobile carrier to bolster account security by implementing additional authentication layers like a PIN or passphrase.

• Use unique passwords for each of your online accounts. This helps compartmentalize your digital exposure and makes it harder for bad actors to access multiple accounts if one of your passwords is compromised.

• Review and reduce the personal information you share publicly on social media platforms.
• Edit your privacy settings to limit your exposure.
• Remove any posts that share sensitive information such as phone numbers, current location, and date of birth.

• Remove your personal information from data aggregators (such as Spokeo and WhitePages) via the opt-out processes for each site. Complete this process on a quarterly basis, as data continuously repopulates on these sites.
• Monitor and report unusual activity on all accounts.

Key Takeaways on SIM Swapping Attacks

In an era where personal information is a precious commodity, protecting your sensitive data will be an important step in making you a hard target for SIM swapping attacks. Be sure to review your public facing information for anything a bad actor may take advantage of and take steps to minimize your online exposure.

Recent incidents such as the Kroll data breach and the Vitalik Buterin Twitter hack underscore the urgency of understanding how to protect your personal information and how wide of a network is impacted when an attack is successful. By staying informed, remaining vigilant, and proactively fortifying your digital bubble, you can mitigate the risks associated with SIM swapping attacks and ensure the safety of your digital identity.

At Red Five, we may assist in highlighting the prevalence of your online personal information through our online exposure services, and can assist in removing personal information from data aggregators through our WebScrub services.