What Is a SIM Swap Scam & How to Stay Protected?

Author: Trend Micro

March 3, 2022

This article is from Trend Micro.

A SIM swap scam, aka SIM swapping, SIM jacking, or SIM hijacking, is when a criminal steals someone’s mobile phone number by tricking the victim’s cell phone provider into transferring the number to a SIM card that is in the criminal’s possession.

After the number has been transferred, the criminal can insert the SIM card into their phone and use it to access the victim’s online accounts by bypassing two-step verification.

How do SIM swap scams work?

Here is a breakdown of what happens during a SIM swap scam:

  1. The criminal contacts your mobile phone carrier and pretends to be you.
  2. Most commonly, the criminal will say that their phone and SIM card (your phone and SIM card) has been lost or destroyed and that your mobile phone number needs to be transferred to the new SIM card that they already have.
  3. After the criminal has convinced the customer service representative that their bogus story is legitimate, your mobile phone number will be transferred to their SIM card.
  4. The criminal inserts the SIM that is now linked to your phone number into their phone and uses it to bypass the SMS-based two-factor authentication of your online accounts. Because two-step verification is used during “forgot password” and “account recovery” requests, it means the criminal can take over any online accounts linked to your phone number and reset their passwords with no issue.

SIM swap scam statistics

According to a recent FBI public service announcement, SIM swap scams are on the rise — and causing massive losses to victims. Throughout 2021, the FBI received 1,611 reports of SIM swapping, with losses totaling over $68 million. This is in contrast to the entire two-year period between January 2018 and December 2020, when there were just 320 SIM swapping-related complaints, with victims losing approximately $12 million.

How to stay protected from SIM swap scams — the FBI’s advice

The FBI recommends people take the following precautions to stay protected from SIM swapping scams:

  • Never post information about your financial assets (including cryptocurrency) anywhere on the internet.
  • If you receive a phone call from someone requesting information relating to your mobile phone number or cell phone provider account, do not give it. If you believe the call may be from your cell phone provider, contact its customer service department directly.
  • Avoid sharing personal information (including your mobile phone number) online.
  • Use a strong and unique password for every online account.
  • Watch out for any changes in SMS-based connectivity.
  • Use strong multi-factor authentication methods like biometrics (fingerprints, iris patterns, for example), standalone authentication apps, and physical security tokens.
  • Never store passwords, usernames, or other personal information that could be used to log in or hack into your online accounts on mobile device apps.

How criminals get personal data

Wondering how a criminal would even get their hands on the personal information needed to pull off a SIM swap scam in the first place? It’s no secret — they most often get it from data leaks.

The 2021 T-Mobile and LinkedIn data leaks exposed over 800 million people’s data — including personal information such as their full names, physical addresses, phone numbers, Social Security numbers, and more. Leaked data is commonly posted to underground internet forums and the dark web, where criminals can get their hands on it and use it to commit various crimes, including SIM swap scams.

Be even more protected with Trend Micro™ ID Security

Trend Micro ID Security — available for Android and iOS — can scan the internet and the dark web 24/7 for your personal information. If your data is leaked, the app notifies you immediately so you can take action to avoid people stealing your identity. If your information is out there, you’ll be the first to know!

Here are some of the features offered by Trend Micro ID Security :

  • Personal Data Protection Score — See exactly how safe your online personal data is with your customized Protection Score.
  • 24/7 Comprehensive Personal Data Monitoring — ID Security can scan the internet and the dark web for all your personal information including up to 5 email addresses and bank account numbers, 10 credit card numbers, your Social Security number, and lots more.
  • Social Media Account Protection — Strengthen the security of your social media accounts. Be instantly alerted if your Facebook or Twitter account’s data is leaked by cybercriminals.

To learn more about Trend Micro ID Security and claim your free 30-day trial, click the button below.

 

Think you might be the victim of SIM swapping?

If so, here’s what the FBI says you should do:

  • Get in touch with your cell phone provider for help regaining control of your phone number.
  • Change the passwords to all your online accounts.
  • Contact your financial institutions so they can watch out for any suspicious activity with your accounts.
  • Report any suspicious activity to your local FBI field office or your local law enforcement agency and the FBI’s Internet Crime Complaint Center.

As ever, if you’ve found this article an interesting and/or helpful read, please do SHARE it with friends and family to help keep the online community secure and protected.

Report a Scam!

Have you fallen for a hoax, bought a fake product? Report the site and warn others!

Help & Info

Popular Stories

As the influence of the internet rises, so does the prevalence of online scams. There are fraudsters making all kinds of claims to trap victims online - from fake investment opportunities to online stores - and the internet allows them to operate from any part of the world with anonymity. The ability to spot online scams is an important skill to have as the virtual world is increasingly becoming a part of every facet of our lives. The below tips will help you identify the signs which can indicate that a website could be a scam. Common Sense: Too Good To Be True When looking for goods online, a great deal can be very enticing. A Gucci bag or a new iPhone for half the price? Who wouldn’t want to grab such a deal? Scammers know this too and try to take advantage of the fact. If an online deal looks too good to be true, think twice and double-check things. The easiest way to do this is to simply check out the same product at competing websites (that you trust). If the difference in prices is huge, it might be better to double-check the rest of the website. Check Out the Social Media Links Social media is a core part of ecommerce businesses these days and consumers often expect online shops to have a social media presence. Scammers know this and often insert logos of social media sites on their websites. Scratching beneath the surface often reveals this fu

So the worst has come to pass - you realise you parted with your money too fast, and the site you used was a scam - what now? Well first of all, don’t despair!! If you think you have been scammed, the first port of call when having an issue is to simply ask for a refund. This is the first and easiest step to determine whether you are dealing with a genuine company or scammers. Sadly, getting your money back from a scammer is not as simple as just asking.  If you are indeed dealing with scammers, the procedure (and chance) of getting your money back varies depending on the payment method you used. PayPal Debit card/Credit card Bank transfer Wire transfer Google Pay Bitcoin PayPal If you used PayPal, you have a strong chance of getting your money back if you were scammed. On their website, you can file a dispute within 180 calendar days of your purchase. Conditions to file a dispute: The simplest situation is that you ordered from an online store and it has not arrived. In this case this is what PayPal states: "If your order never shows up and the seller can't provide proof of shipment or delivery, you'll get a full refund. It's that simple." The scammer has sent you a completely different item. For example, you ordered a PlayStation 4, but instead received only a Playstation controller.  The condition of the item was misrepresented on the product page. This could be the