New Hack Threat: Thieves Take Over Your Phone Number

SIM-swapping is a growing form of identity theft that goes beyond hacking into an email or social media account. In this case, the thieves take over your phone number. Any calls or texts go to them, not to you, reports the AP. Any protections consumers enabled to secure access to their financial accounts, such as two-factor authentication texts, now can aid attackers and lock out owners. The FBI Internet Crime Complaint Center reports that SIM-swapping complaints have increased more than 400% from 2018 to 2021, with associated personal losses estimated to be more than $68 million. Rachel Tobac, CEO of SocialProof Security, says the numbers are probably a vast underestimate because most identity thefts are not reported. More:

• How does the scheme work? Criminals use victims' personal information—phone numbers, addresses, birthdays, and Social Security numbers—obtained through data breaches, leaks, dark web purchases, or phishing scams to impersonate the victims as they contact their mobile carriers. They claim the original phone and SIM card were damaged, lost, or sold accidentally and ask for the number to be associated with a new SIM, or eSIM, card in their possession. Once this is done, the number belongs to the criminals, along with the ability to receive texts or calls to verify accounts.
• Better password habits: If you've been using similar login information for multiple accounts, change it. If criminals pilfer your password from one service, they can try it on other accounts. If you find it too hard to memorize various credentials, consider a password manager. Use strong passwords. The longer they are, the better. Experts say they should be 16 characters.

• Multifactor authentication without texts: These methods often use separate login methods and encryption that are not tied to your phone's identity, making them more difficult for criminals to access. AT&T advises contacting your carrier to set up a unique passcode to prevent significant account changes such as porting phone numbers to another carrier. Your carrier may already have other protections in place to protect against SIM swapping, so it's worth calling to ask.
• Watch out for phishing (especially at work): Criminals will use email or texts to trick you into giving them your information or to expose your workplace to possible attacks, and it's incredibly effective.
• Steps to take if you're a victim: All major US carriers have web pages advising victims how to report SIM fraud. Filing complaints with the FTC, the Internet Crime Complaint Center, or with state attorneys general can expedite recovery efforts. If card numbers were stolen, inform your bank or credit card company, asking the company to alert you to any suspicious activity. You can also notify credit agencies, which can freeze your credit.

(More SIM cards stories.)