SIM swapping is like coming home from work and finding your home is no longer yours… Our phones today are like our digital houses. They have everything of value in them – including our personal, financial and health data – and we feel lost without them.
Imagine coming home from work and trying to get into your home, only to find that someone had taken possession of your home without you knowing.
I recently switched my mobile phone carrier and I was shocked at how easy it was to move my phone number from one provider to another… Efani, an anti-SIM swapping carrier, significantly reduces the risk of SIM swapping, as I describe below.
That’s basically what SIM swapping is for your phone and it’s especially shocking because, in one threat actor’s opinion, it has a 100% success rate for them…
What Is SIM Swapping?
I’ve talked about social engineering in previous videos.
SIM swapping is the social engineering of your mobile phone carrier. It’s an attack that results in the carrier representative moving your mobile phone number to someone else’s SIM card.
The SIM card on your phone – which stands for “subscriber identity module” – is a small chip or physical card used in your mobile device that securely stores information that identifies and authenticates you as a subscriber on your mobile network…
Your SIM includes all the important data you need to identify yourself, such as your phone number, carrier details, and your security credentials.
SIM swapping is a type of account takeover where a criminal tricks your mobile carrier into transferring your mobile number to a SIM card that they control.
When the SIM swap is complete, the criminal controls your phone number… They receive all your text messages, etc.
Once a SIM swap is done, all calls and texts – including 2FA codes – go to the attacker’s phone.
How Does SIM Swapping Happen?
SIM swapping can happen by an individual stealing your phone and swapping your SIM card out, or it can happen remotely without you even knowing.
A remote SIM swap happens like this:
- Hacker Conducts Research: An attacker will gather information about you from publicly available sources, including but not limited to, social media and information that’s publicly available because of a data leak.
- Hacker Contacts Mobile Carrier: They’ll then use that stolen personal information to contact your mobile carrier and pretend to be you.
- Hacker Claims Your Phone Was Stolen: They may claim that your phone was stolen, or your SIM card was stolen and then request that your SIM card be transferred to a different SIM card that they control
- Hacker Tricks CSR: To convince a customer service representative at your carrier that they are you, they may use social engineering or even bribe the representative, getting them to activate the new SIM card they control with your phone number
- Hacker Controls Your Phone Number: Once the SIM swap happens, this gives the hacker access to accounts that you use your phone number to authenticate with.
Note that this type of remote account takeover is something that can happen whether you have a physical or virtual SIM card because it happens at the carrier level…
And – unfortunately – a 2020 study by Kevin Lee at Princeton University found that all five major wireless carriers were vulnerable to SIM swap attacks due to problems with authentication processes…
How To Prevent SIM Swapping
The following strategies can help you strengthen your iPhone’s security, prevent SIM swapping, and/or secure your iPhone from hackers:
1) Maximize Security With Your Carrier: Call your wireless carrier and add multi-factor authentication to your account. Tell them that you want to be protected from SIM swapping.
Regretfully, many cellular carriers do not even offer multi-factor authentication (MFA) with the use of an authenticator app, or a passkey.
2) Add a SIM PIN to your phone: This PIN will be required to be entered before your SIM card can be used. Honestly, there’s no excuse by carriers for not giving people the option to make it hard for a SIM swap to occur.
3) Use a Secure Carrier: If you feel your carrier is not serious enough about protecting your account, you can move to a wireless carrier that focuses on security of your account, such as Efani. Efani is a mobile virtual network operator (MVNO) that focuses on preventing SIM swapping by using multiple layers of authentication to prevent account takeovers. Securing the Built Environment viewers can save $100 on the Efani service by going to Efani.com/rob and use coupon code “Rob” at checkout, or click the link below.
4) Strengthen The Security On Your Phone: If you use an iPhone, as I mentioned above, Apple can’t protect you from a carrier level attack. However, you can take steps to make yourself less vulnerable to a SIM swap attack.
5) Authentication Apps: One way to increase the security of your phone is to move away from SMS based security to an authentication app which isn’t text message-based. An authentication app for 2FA removes your phone number from the authentication process.
6) Protect Your iCloud Account: If you use an iPhone, you can protect your iCloud account by setting up device-based 2FA, recovery keys, and Stolen Device Protection.
7) Use Phone Buddy with Apple Watch: If you use an Apple Watch and an iPhone, you can also protect yourself from losing your phone by using an app called Phone Buddy .
As I describe in this video, Phone Buddy is a “must have” app for anyone with an Apple Watch and iPhone because the app will set off an alarm on your Apple Watch when you and your iPhone are more than a pre-set distance apart from one another.
It will help you make sure you always have your iPhone with you and that you don’t lose it.
At the end of the day, the best defense is to utilize all available Apple security features and hold your carrier to a higher standard when it comes to enforcing strong authentication measures.
Unfortunately, as how we use and rely on technology changes, we need to rethink how we protect what’s most important to us.
