A SIM swap scam, aka SIM swapping, SIM jacking, or SIM hijacking, is when a criminal steals someone’s mobile phone number by tricking the victim’s cell phone provider into transferring the number to a SIM card that is in the criminal’s possession.

After the number has been transferred, the criminal can insert the SIM card into their phone and use it to access the victim’s online accounts by bypassing two-step verification.

How do SIM swap scams work?

Here is a breakdown of what happens during a SIM swap scam:

1. The criminal contacts your mobile phone carrier and pretends to be you.
2. Most commonly, the criminal will say that their phone and SIM card (your phone and SIM card) has been lost or destroyed and that your mobile phone number needs to be transferred to the new SIM card that they already have.
3. After the criminal has convinced the customer service representative that their bogus story is legitimate, your mobile phone number will be transferred to their SIM card.
4. The criminal inserts the SIM that is now linked to your phone number into their phone and uses it to bypass the SMS-based two-factor authentication of your online accounts. Because two-step verification is used during “forgot password” and “account recovery” requests, it means the criminal can take over any online accounts linked to your phone number and reset their passwords with no issue.

SIM swap scam statistics

According to a recent FBI public service announcement, SIM swap scams are on the rise — and causing massive losses to victims. Throughout 2021, the FBI received 1,611 reports of SIM swapping, with losses totaling over $68 million. This is in contrast to the entire two-year period between January 2018 and December 2020, when there were just 320 SIM swapping-related complaints, with victims losing approximately $12 million.

How to stay protected from SIM swap scams — the FBI’s advice

The FBI recommends people take the following precautions to stay protected from SIM swapping scams:

• Never post information about your financial assets (including cryptocurrency) anywhere on the internet.
• If you receive a phone call from someone requesting information relating to your mobile phone number or cell phone provider account, do not give it. If you believe the call may be from your cell phone provider, contact its customer service department directly.
• Avoid sharing personal information (including your mobile phone number) online.
• Use a strong and unique password for every online account.
• Watch out for any changes in SMS-based connectivity.
• Use strong multi-factor authentication methods like biometrics (fingerprints, iris patterns, for example), standalone authentication apps, and physical security tokens.
• Never store passwords, usernames, or other personal information that could be used to log in or hack into your online accounts on mobile device apps.

How criminals get personal data

Wondering how a criminal would even get their hands on the personal information needed to pull off a SIM swap scam in the first place? It’s no secret — they most often get it from data leaks.

The 2021 T-Mobile and LinkedIn data leaks exposed over 800 million people’s data — including personal information such as their full names, physical addresses, phone numbers, Social Security numbers, and more. Leaked data is commonly posted to underground internet forums and the dark web, where criminals can get their hands on it and use it to commit various crimes, including SIM swap scams.

Be even more protected with Trend Micro™ ID Security

Trend Micro ID Security — available for Android and iOS — can scan the internet and the dark web 24/7 for your personal information. If your data is leaked, the app notifies you immediately so you can take action to avoid people stealing your identity. If your information is out there, you’ll be the first to know!

Here are some of the features offered by Trend Micro ID Security:

• Personal Data Protection Score — See exactly how safe your online personal data is with your customized Protection Score.
• 24/7 Comprehensive Personal Data Monitoring — ID Security can scan the internet and the dark web for all your personal information including up to 5 email addresses and bank account numbers, 10 credit card numbers, your Social Security number, and lots more.
• Social Media Account Protection — Strengthen the security of your social media accounts. Be instantly alerted if your Facebook or Twitter account’s data is leaked by cybercriminals.

To learn more about Trend Micro ID Security and claim your free 30-day trial, click the button below.

Think you might be the victim of SIM swapping?

If so, here’s what the FBI says you should do:

• Get in touch with your cell phone provider for help regaining control of your phone number.
• Change the passwords to all your online accounts.
• Contact your financial institutions so they can watch out for any suspicious activity with your accounts.
• Report any suspicious activity to your local FBI field office or your local law enforcement agency and the FBI’s Internet Crime Complaint Center.

As ever, if you’ve found this article an interesting and/or helpful read, please do SHARE it with friends and family to help keep the online community secure and protected.