How to protect against SIM swap scammers?

Question

SIM swap occurs where the scammer uses phished information about you to request a SIM card replacement from your cell phone carrier, by tricking them into believing that it is you who is making the request for a SIM card replacement by passing their security questions on the phone based on the biometric data they phished about you.

Once they have that duplicate of your SIM card, they can receive access codes to your banking and cryptocurrency accounts, because all of this is linked to your phone number (the SIM card).

How can anyone possibly protect themselves against this sort of attack? Rarely does anyone have a second phone number, so whatever account you based on your sole number, means they instantly have backdoor access (by fooling your service providers using phished information about you, orally over the phone and by online forms)

Answer 1

You don't use SMS for a second factor.

SMS is not secure by any means. The text is on clear, the traffic is on clear, and it's trivially easy to get a new SIM by pretending to be the victim. I once got my phone stolen and got myself a new SIM just by walking to the telco booth and telling my name and the phone number.

Google Authenticator is offline. It does not depend on the SIM in any way. You can even calculate the OTP token using PHP/Python/Perl/Javascript, all offline. You would even be able to do it with a calculator that lets you run programs on it.

Answer 2

One of the main vulnerabilities that leads to SIM-swapping is from social engineering attacks. If you must use SMS 2FA, one approach is to use a Google Voice number. Since Google Voice has minimal customer support, there's little opportunity to perform a social engineering attack.

It's not a good solution, and, as other answers said, skipping SMS 2FA is best. However, this may be better than nothing if you must use SMS 2FA.

Answer 3

For serious 2FA authentication systems, the phone is only the second factor. That means that to impersonate its victim, the attacker should also guess the primary factor (the password).

What is really bad is that some authentication systems, including some banks ones, accept the phone holding the second factor of authentication as the primary password recuperation tool. And this clearly breaks into pieces the 2FA security. In the event that this happens, I think that the responsability of the bank should be involved: they force their client to use a broken weak authentication system. But IANAL and have no idea if any legal action about this has ever occured in any country...

Answer 4

Buy a cheap old Nokia phone with a few different SIM cards. Only use one number for each online account. Never share these numbers with anyone. Keep the phone off in a draw.

Why? If people do not know the number, they cannot do a SIM swap. If they can get into the database belonging to insert company name here they likely already have everything they need to drain your account.

Also, this might sound weird, but it is often easier to SIM swap when the user has verified the SIM with an ID document, because then it can be done over the phone as opposed to the scammer going into the carrier's phone shop.

Answer 5

First, the symptom of a SIM swap is that you lose signal on your phone. Using a primary number rather than a secondary, i.e., one your mum will usually call you on instead of a SIM card you put in the drawer, is the best way to detect it earlier and act earlier. You'll detect something's wrong and try to get in contact with your provider to discover evil. And do your best to gain ownership back.

You don't protect yourself: providers do

It's not up to you, but all about the education of your service provider not to use SMS as the only recovery factor.

If your service provider using SMS recovery holds information or assets (e.g. cryptocurrency, information that may permanently damage your personal reputation like very personal media) that are totally unrecoverable after incident, then you should just change provider; you can't protect yourself. Even if you write to customer service, they may bounce you on excuse of paranoia (reason is budget).

Also depending on your jurisdiction, and the environment your service is operating in, you have a few more chances to protect not from SIM swap, but from consequences.

Bank example: if your bank operates under PSD2 (e.g., Europe) and they use SMS as the only recovery factor, by the time you report the incident to your provider and/or police, you are protecting yourself from fraudulent trades until you can call the bank and shout "stop everything! somebody stole my number!". The laws, your mileage may vary, according to jurisdiction, can add a layer of protection so that you could get your money back.

As a final note, many (four+) large banks of my knowledge are aware of SMS weakness and use it as first and not only recovery factor. The second factor are.... security questions!

SIM swap is matter of mobile operators, not customers

Also remember that the SIM swap is a matter of people who work at the mobile operator, so you can't really make the difference. In order for someone to obtain a SIM card fast, one should go to a physical retailer, with either counterfeit ID or they must really really really really look like you for identification.

If I call your mobile operator and say "Hello, this is J. Doe, I was born on 01/01/1990 in Dallas, could you mail a replacement SIM to Evergreen Terrace?" without any additional form of recognition, then that's your carrier's fault!

Answer 6

Modern landline phones can receive SMS messages. Or as a fallback, the provider is turning it into a text-to-speech phone call, at least here in Germany. It worked so far with every service I tried.