1

There's a technique called sim swap, which enables a fraudster to transfer the victim phone number to an other sim, allowing a fraudster hence to read the messages but especially to empty out their bank account by recovering or changing the bank website account password via phone number, so by receiving a recovery code or something like that. Anyway this can be avoided by setting a number unknown to anyone.

The problem is that maybe anyone who has my phone number could potentially use this technique just to associate a Google account or any other account to my number, in order to commit crimes on behalf of my identity. How can this thing be prevented in the first place?

I mean, in this case I could have as many unknown numbers as I want but, a perpetrator can still use this technique with my known number, and even if my acquaintances are not evil minded, they can just give the number to other people who give it to other people as well, until my number happens to be in wrong hands.

1

The obvious way to prevent the effects of someone using this technique to access your accounts is not to use your phone number for 2FA or for account recovery. If you need to, then use an "unknown number" that you don't use to call anyone. Just use the number for account recovery.

To prevent social engineering attacks to be used by the attacker as a means of social engineering the companies to make the swap, you provide fake information to the company on your account. That way the attacker would have to figure out the specific data you provided the company.

As for someone using your main, known number to set up new accounts with which they will commit crimes, I'm not sure why that's a concern.

|improve this answer|||||
  • The first part was obvious for me. This is a concern because eventually one could get locked up for a thing he supposedly cannot prevent to begin with. – abdul Nov 2 '19 at 14:41
  • That's not true. You can't get locked up because of a phone number that you can show that you do not control... – schroeder Nov 2 '19 at 15:08
  • But I suppose it is took over and at paper I do control it, but not in that moment. You don't understand what I'm saying. The phone number in that occasion is not controlled by the legit holder but the crucial thing is what it appears to the authoroties. Potentially they can sim swap, get the verification number, put it, leave then the sim swap and use the account without the holder of the number seeing any message nor being aware of the thing. Afterwards if a crime is committed with the account, it would result associated with my number. What could I do in this case? – abdul Nov 2 '19 at 16:17
  • How can I prove that I didn't control that number, since it is associated to my identity and since it is supposedly assumed that the sim is controlled by the holder? – abdul Nov 2 '19 at 16:21
  • I do understand. You are assuming that any of this would be "evidence". It's not. There would be records at the phone company of the changes and the timing of those changes. – schroeder Nov 2 '19 at 16:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.