SIM Swap Scams: How to Protect Yourself

PRESS RELEASE
Federal Trade Commission
October 23, 2019

by

Alvaro Puig

Consumer Education Specialist, FTC

If your cell phone is your go-to device for checking your email, paying your bills, or posting to social media, you’re not alone. So imagine that your cell phone suddenly stops working: no data, no text messages, no phone calls. Then picture getting an unexpected notification from your cellular provider that your SIM card has been activated on a new device. What’s going on? These could be signs that a scammer has pulled a SIM card swap to hijack your cell phone number.

So how do scammers pull off a SIM card swap like this? They may call your cell phone service provider and say your phone was lost or damaged. Then they ask the provider to activate a new SIM card connected to your phone number on a new phone — a phone they own. If your provider believes the bogus story and activates the new SIM card, the scammer — not you — will get all your text messages, calls, and data on the new phone.

The scammer — who now has control of your number — could open new cellular accounts in your name or buy new phones using your information.

Or they could log in to your accounts that use text messages as a form of multi-factor authentication. How? Because they’ll get a text message with the verification code they need to log in.

Multi-factor authentication (MFA) can provide extra account protection by requiring two or more credentials to log in. Besides your password, you’ll need a second credential to verify your identity. That could be something you have — like a passcode you get via text message, a security key, or an authentication app. Or something you are — like a scan of your fingerprint, your retina, or your face.

Armed with your log in credentials, the scammer could log in to your bank account and steal your money, or take over your email or social media accounts. And they could change the passwords and lock you out of your accounts.

Here’s what you can do to protect yourself from a SIM card swap attack:

• Don’t reply to calls, emails, or text messages that request personal information. These could be phishing attempts by scammers looking to get personal information to access your cellular, bank, credit or other accounts. If you get a request for your account or personal information, contact the company using a phone number or website you know is real.
• Limit the personal information you share online. If possible, avoid posting your full name, address, or phone number on public sites. An identity thief could find that information and use it to answer the security questions required to verify your identity and log in to your accounts.
• Set up a PIN or password on your cellular account. This could help protect your account from unauthorized changes. Check your provider’s website for information on how to do this.
• Consider using stronger authentication on accounts with sensitive personal or financial information. If you do use MFA, keep in mind that text message verification may not stop a SIM card swap. If you’re concerned about SIM card swapping, use an authentication app or a security key.

If you’re the target of a SIM swap scam

• Contact your cellular service provider immediately to take back control of your phone number. After you re-gain access to your phone number, change your account passwords.
• Check your credit card, bank, and other financial accounts for unauthorized charges or changes. If you see any, report them to the company or institution.

If you think a scammer has your information — like your Social Security, credit card, or bank account number — go to IdentityTheft.gov to see the specific steps to take.

Find out what else you can do to protect the personal information on your phone and how to keep your personal information secure online.

Tagged with: identity theft, mobile, personal information

Blog Topics:

Privacy, Identity & Online Security, Online Security

NPR Report of victim:

‘SIM-Swap’ Scams Expose Risks Of Using Phones For Secondary I.D.

Update your software now — Federal Trade Commission encourages security measures

PRESS RELEASE

June 13, 2019

by Ari Lazarus, Consumer Education Specialist, FTC

We secure our valuables – our wallets, keys, and homes. We know that, if left unsecured, they can easily be a target for criminals. So it makes sense to think the same way about the information stored on all our devices.

Computers, tablets, phones and other personal devices hold your emails and your financial and tax documents (with your Social Security numbers). Criminals who get access to this valuable information can commit identity theft, put harmful software on your devices, or both.

What’s one easy way to help protect all of this sensitive information? Update your software regularly, and as soon as possible when a newer version comes out. What’s an even easier way? Set the updates to happen automatically. Don’t ignore reminders to update. Criminals look to exploit vulnerabilities before the software companies can fix it. Delaying gives hackers time to access your information – even when a patch is out there to lock them out.

So what software should you be updating?

1. Security software. Whether you use antivirus or firewall programs that were pre-installed on your device or that you bought on your own, make sure they’re up to date.
2. Operating system software. Your operating system could be Windows, Apple OS, etc. If you’re not sure how to update your operating system, go to the website of your device manufacturer for help.
3. Internet browsers and apps. Both are access points for criminals to enter your devices, so it’s important to keep them secure.

Looking for more tips on how to stay safe online? Check out FTC.gov/OnGuardOnline.

Tagged with: cell phone, computer security, online safety, security software

Blog Topics:

Privacy, Identity & Online Security

Hiding in plain sight? — Federal Trade Commission

July 1, 2014

by Cristina Miranda

Consumer Education Specialist, FTC

Could your mobile carrier be hiding third-party charges on your phone bill that you never authorized? The FTC has alleged that T-Mobile has done just that.

The agency says that T-Mobile charged consumers not only for regular phone services, but also for third party content – including monthly subscriptions for ringtones, wallpaper, horoscope texts, flirting tips, and celebrity gossip – that consumers neither knew about nor agreed to.

According to the FTC, here’s how it happened: On the first page of the bill, T-Mobile deceptively lumped third-party charges under a general line item that also included charges for their services like texting. The obscure breakouts of each charge were on the pages toward the end of the bill.

More surprising? The company continued to charge consumers, pocketing up to 40 percent of those third-party charges, even after some consumers caught on, complaints piled up, and industry auditors put T-Mobile on notice that the charges were unauthorized.

Here’s how to reduce the chances of paying charges crammed onto your bill without your knowledge or permission:

• Read your mobile phone bill each month – line by line, and page by page. Don’t ignore the billing statement you get in the mail or through an automated online payment system. You should know your baseline monthly bill. Taking time to read every page of your statements can help you detect potentially fraudulent charges, keep surprise charges to a minimum, and save you money.
• Consider a block on third-party charges. Many phone carriers already offer third-party blocking service for free. You just have to ask.
• Ask your mobile phone carrier for its policy on refunds for fraudulent charges. Some carriers have a 60-day period for refund requests, and many have a policy of partial refunds for fraudulent charges you detect – no matter how long the cramming charges have occurred.
• If you have a prepaid phone plan, check that you’re not losing pre-paid minutes to pay for unauthorized third-party charges. Stay on top of how many calling minutes you have, and make sure that minutes don’t go missing due to deductions unrelated to your regular phone calls. Check your accounts online or call the number your carrier gives you for account access.

If you suspect you’ve been a victim of cramming, contact your phone carrier first about the charges, then file a complaint with the FTC.