In today’s world, your cell phone is everything; it’s your connection to work, email, family, social media, entertainment, and bank and financial accounts. The security of your mobile device is therefore increasingly important to prevent unauthorized access to your phone and to prevent take-over frauds. We secure access to our actual phone through passcodes and increasingly through biometrics like a thumb print or facial recognition. These safeguards work pretty well. Even if someone steals your phone, it’s not likely that they will get into it.
Hackers and thieves know this too, but they figured out years ago that they don’t need to have your phone or hack into your device to gain access to information necessary to steal from consumers. Financial institutions, social media accounts, and email accounts use a security feature called Two-Factor authentication. If you need to change your password to your email or to a bank or crypto currency account, the account will trigger a password reset process which almost always triggers this 2FA passcode. This code is sent to your cell phone through a text or SMS message, with a 6 or 8 digit one-time code that you input into your account and that allows you to access the account without the password. Intercepting that 2-Factor Authentication code is like stealing the keys to a safe and can lead to a domino effect of financial disaster for consumers.
Before the thieves can capture those critical 2FA codes, they must first convince your mobile carrier, like T-Mobile, AT&T, or Verizon, to perform a “SIM Swap”. The bad guys get the cellular provider to execute this unauthorized SIM swap by taking advantage of poor security and authentication procedures by telecom employees and agents. Once the unauthorized SIM swap is executed, your cellular service is transferred to the phone in the thief’s possession and when he gets into your Coinbase account or email account and change security settings, change passwords, execute trades, whatever it may be, the 2FA code that verifies it is “you” goes to the thief instead. Now he is into your Coinbase account, he is into your email account, and will very quickly execute a playbook to steal from you before you will even know you lost cell-service.
A “SIM” (which stands for Subscriber Identification Module) is a chip or card in your phone that contains data necessary to connect your device to the cellular network. Without a functioning SIM, your phone cannot connect to the cellular network or the “service” you pay for. These SIMs can also be electronic and are called eSIMs. Almost all SIM swaps are legitimate. If you buy a new phone, lose your phone, or if your phone is damages beyond repair or lost, you obviously want to keep your phone number. To get your new phone to work on the cellular network with your number, your mobile account needs to be transferred to the SIM in the new device – A SIM Swap. Cellular customers request SIM swaps in three primary ways. 1) through an in-store visit; 2) over the phone; or 3) through your mobile online account. All three of these options require the telecom to authenticate the legitimacy of the SIM swap request before executing it.
Contact Us Today