How Sim-swap Fraud Works
Simple but Effective
At its core, Sim-swap fraud is very simple. Fraudsters seek to gain control of a user’s mobile phone number, either by swapping the victim’s number to a new Sim card on the same network, or by moving the number to a different network altogether by requesting the Porting Authorisation Code (PAC), which in legitimate circumstances enables users to move networks without losing their phone number.
Password Guessing & Social Engineering
As Elliott explained, perpetrators will typically begin by seeking out the answers to the security questions asked by mobile networks – such as the user’s birthday, place of birth or mother’s maiden name – so that they can present these to the mobile operator and gain control of the number. If they can’t access such information, they may try social engineering techniques such as claiming to have suffered a recent bereavement, to convince the mobile operator to grant them access anyway. Either way, they focus on gathering intelligence and then convincing the network that they are the owner of the number in question – at which point they can ask for the number to be switched to a Sim card that they own.
Forgotten my Password
Once the phone number is compromised, an agile attacker can quickly use the ‘I’ve forgotten my password’ function online – say, on a banking website – which then sends a code to the phone number in question. Provided the criminal has already gathered other credentials, such as usernames, this could be the final piece of the jigsaw, enabling them to access a bank account.
End goals such as ‘inbox viewing’ and ‘social media account takeover’ are often advertised as products on the dark web, underlining just how commercialised some aspects of the cybercriminal world have become. A myriad of different tools and techniques are incorporated into these packages, with the perpetrators simply using anything at their disposal to accomplish the objective. Illicit Sim-swapping can be a hugely effective part of this. Our research suggests that such packages can cost as little as $100.