SIM (Subscriber Identity Module) swapping is an increasingly common tactic used by scammers to gain access to consumer data. In SIM swapping, a scammer hijacks your cell phone number by convincing your carrier that they are you and gets them to associate your phone number with a new SIM card in their own device.
Once a scammer has this access, they can get your emails, text messages, and other sensitive data. They may even be able to gain access to your bank account. In this high-tech form of identity theft, they have gained the information they need to log in to your online accounts and they may even lock you out in the process.
Here are four tips to help ensure this doesn’t happen to you.
1. Use multi-factor authentication
Multi-factor authentication (MFA) has long been touted by security experts as a way to keep identity thieves from gaining access to your various online accounts. MFA simply means having to go through two or more steps to log in, and many services provide this as an option. Often, this will consist of a password and a secondary code that is usually sent to your phone via text message or by email. To combat potential SIM swapping, however, this may not be enough.
"Consider using stronger authentication on accounts with sensitive personal or financial information," says Alvaro Puig with the Federal Trade Commission (FTC).1 "If you do use MFA, keep in mind that text message verification may not stop a SIM card swap. If you’re concerned about SIM card swapping, use an authentication app or a security key."
2. Don't respond to requests for personal info
To gain the information to conduct a SIM swap, a scammer needs to obtain your personal information in the first place. Otherwise, they won't be able to convince your carrier to associate your number with their SIM. To prevent these people and other types of scammers, always refrain from giving out personal information if you receive requests for it. You should never need to do this with any reputable organization or business unless you are filling out an application or form of some type that you have initiated yourself. In other words, if someone contacts you first and requests personal information, ignore it and report it.
3. Don't share personal information online
Be careful about what you share online. This extends beyond information requests, but also on social media and the web. Sensitive information isn't limited to just passwords and social security. It could be seemingly innocuous details about your life.
"Be careful what you post online," says the AARP website.2 "This generally means avoiding the kind of information often prompted by security questions, including birthdates, the name of your pet, your best friend’s first name and high school mascot."
Scammers are always on the lookout for details they might be able to exploit. Don't give them anything to work with.
4. Use a PIN/password
The FTC recommends setting up a PIN or password on your cellular account in order to prevent your account from experiencing unauthorized charges. If you are unsure about how to set this up, you should be able to find out on your carrier's website.
If you become a victim, respond accordingly
Be sure to keep an eye out for unauthorized charges on credit cards and bank accounts, and immediately report them. If you find that you have been victimized by a SIM swapper, there are steps you can take to resolve the situation. There is no guarantee that you'll be able to repair all the damage done if you discover the problem too late, but you should contact your service provider as soon as possible to ensure you are able to regain control over your phone number.
You should also change all your passwords to make sure the scammer no longer has access. If they've already changed passwords and locked you out, contact these services for further instructions on how to resolve the situation.
Like other identity theft scams, SIM swapping can create major headaches for victims. Make sure you are taking the proper precautions to help ensure that you don't become one.
1. https://www.consumer.ftc.gov/blog/2019/10/sim-swap-scams-how-protect-yourself
2. https://www.aarp.org/home-family/personal-technology/info-2021/how-to-avoid-sim-swap-scams.html