{"id":27957,"date":"2021-11-22T15:29:59","date_gmt":"2021-11-22T09:59:59","guid":{"rendered":"https:\/\/www.subex.com\/?p=27957"},"modified":"2021-11-22T15:29:59","modified_gmt":"2021-11-22T09:59:59","slug":"regulators-train-their-sights-on-sim-swap-what-should-telcos-do","status":"publish","type":"post","link":"https:\/\/dev.enki.studio\/test\/?p=27957","title":{"rendered":"Regulators train their sights on SIM Swap. What should telcos do?"},"content":{"rendered":"

In April 2018, <\/em>Gregg Bennett<\/em><\/a>, an entrepreneur in Bellevue, Washington, noticed something odd happening across his email account, after which his phone connectivity immediately zeroed out. <\/em>Fearing a hacking attempt, Bennett, unfortunately, could do little as the fraudsters took control of his phone number via his SIM, therein gaining access to Bennett\u2019s Amazon, Evernote, Starbucks, and even his Bitcoin account, whereby he lost 100 Bitcoin.\u00a0<\/em><\/p>\n

Greg Bennett was a victim of SIM swapping.<\/p>\n

SIM swapping<\/a> is a form of digital identity theft that banks on \u2018social engineering.\u2019 Often recognized as the second phase of a fraud attack, SIM swapping happens when fraudsters take control of a victim\u2019s mobile number and from there obtain verification codes like OTPs and URNs that give them unfettered access to protected accounts.<\/p>\n

The trick: How does SIM Swapping work?<\/strong><\/p>\n

I\u2019ve often likened the finesse of SIM swapping to the sleight of a hand seen at a magic show. One moment the magician directs your attention to the object, perhaps a bird cast in flight. The next second, it vanishes, and as your eyes remain distracted trying to fathom the disappearing act, the real magic trick unfolds in the shadows: The bird pops up into existence somewhere unexpected \u2013 a pleasant surprise, a round of applause, a delighted audience.<\/p>\n

But unlike the joy audiences feel at seeing the friendly flutter of feathers again, the ripple effect of SIM swapping is unpleasant and notably sinister.<\/p>\n

Scammers take control of a replacement SIM that is replaced through spurious methods such as reporting a handset lost or stolen, placing requests for SIM replacement, or producing fake documents to get a duplicate SIM. Today, mobile phones are the nerve center of authentication for myriad transactions. So, it doesn\u2019t take more than a few steps thereafter to grant hackers access to personal accounts.<\/p>\n

\"How
How SIM swapping works. Source Europol<\/figcaption><\/figure>\n

Fun, Funds, and Fame \u2013 Motives of SIM Swap Crime\u00a0<\/strong><\/p>\n

Money, certainly, is a driving factor. In the UK alone, SIM swapping<\/a> cost telecom operators \u00a32.9 million, with over\u00a03,000 cases registered<\/a>\u00a0in 2018. In their 2019 IC3 Report, the FBI notes how arresting a leader of a SIM swapping group leader led to the seizure of over US $18 million, five vehicles, a US $900,000 home, and hundreds of thousands of dollars in jewellery.\u00a0Which.co.uk<\/a>\u00a0reported a story about Garth Pollard, a victim of a SIM swapping attack where the attacker spent \u00a313,000 over 48 hours.<\/p>\n

But some hackers engage in SIM swaps simply for the fun of it.<\/p>\n

Take the case of\u00a0Ruby<\/a>, whose Instagram handle @ruby was much desired by some of the platform\u2019s users. When Ruby turned out many requests to sell her handle, one hacker decided to scam it off her using a SIM swap<\/a>. Her provider, AT&T, took note of her complaint and restored her phone number, but it took Ruby much longer to regain her beloved Insta-handle.<\/p>\n

No matter the motive behind the fraud, SIM-jacking is a menace for customers. It also exposes telecom providers to a series of negative effects through lawsuits arising from non-compliance and inadequate consumer protection.<\/p>\n

Seamlessness versus Security \u2013 The Telco Dilemma<\/strong><\/p>\n

It almost makes you wonder why telecoms aren\u2019t doing more to stop this fraud. A chief research officer and expert in the field\u00a0holds the view<\/a>\u00a0that higher security barriers for SIM registrations detract from the \u2018seamless experience\u2019 telcos wish to provide their customers. In an effort to make customer acquisition easier, telecoms just might be leaving a window open for SIM swappers to manipulate the system and create trouble for existing customers.<\/p>\n

There is light at the end of the tunnel! Just like how a magician\u2019s repetitive tricks force us to bypass the legerdemain, regulators are now training their sights on SIM swappers.<\/p>\n

The loophole lies in mobile number portability vulnerabilities, which is what the US Federal Communications Commission (FCC) hopes to fix with its\u00a0new slew of rules<\/a>. Some of these include introducing a \u2018port freeze\u2019 whereby customers can opt to disable SIM duplication requests to avert \u2018port out fraud.\u2019 As stated in its\u00a0recent press release<\/a>, the FCC proposes that phone carriers be required to securely \u201cauthenticate a customer before transferring a phone number to a new device or carrier.\u201d<\/p>\n

African telcos are adopting countermeasures, too.\u00a0Safaricom<\/a>, the Kenyan telecom provider, has created an API that alerts banks when a customer\u2019s SIM has been swapped, allowing the bank to decisively protect the customer\u2019s commercial accounts from fraud attacks. African telecoms have also attempted to tighten SIM registration processes in the hope of dissuading scammers. But in emerging markets where standardized national identities are owned by far fewer citizens than there are mobile users, enforcing such dictates (and the efficacy of it) is yet to be known.<\/p>\n

So, how do you begin to protect yourself?<\/strong><\/p>\n

Creating awareness, protecting privacy, and fostering healthy scepticism among end-users in the online world is a good place to start.<\/p>\n

What does this look like? Think about being cautious when installing apps from non-trusted sources. Refrain from clicking on non-verified links, check before downloading files from unknown senders, and use protocols to keep data private. These are actionable guidelines and advice everyone can follow by default.<\/p>\n

As end-users, here are some tips from Europol (in the infographic) that we can use to minimize the risk of becoming a victim of SIM swaps:<\/p>\n

\"What
What can we do to avoid being a victim of SIM Swap? Source: Europol<\/figcaption><\/figure>\n

For telecom organizations, a robust defense strategy with multi-layered defense mechanisms, as listed below, can help stay ahead of SIM swap:<\/p>\n