Sim Card Frauds - LC must escalate this
Read about how sim card frauds are happening. LC must escalate the need for a SIM password and email validation for sim card reassignment by operators.
This is how sim card frauds are taking place:
Hackers hijack SIM connections in three ways. The most prevalent one is called “SIM swapping over a call". In this case, they first gather information on targets—their full name, address, mobile number, date of birth, passcode or Aadhaar number — through phishing scams or leaked databases found on the dark web (that portion of the web that is not traceable by search engines).
Then they will call the target, pretending to be a customer care executive from the operator, in the name of upgrading to new services. They will ask the target to share their SIM card’s ICCID (integrated circuit card identifier) number—a 19-20 digit serial number specific to the SIM.
Once they have the details, they will call the operator, impersonating the actual user and use this information to pose as the user.
Once the SIM swap request is initiated, the operator sends an SMS for authentication and users have to acknowledge it by tapping a single key or a bunch. The hacker will tell users in advance about this SMS so the latter easily falls for it.
Once the SIM swap is complete, the original SIM will be deactivated and the number will be active on the duplicate SIM owned by the hacker.
The second method is “SIM swapping in person" and is likely to be used by small-time cybercriminals. In this case an impostor will visit an operator’s retail outlet with fake documents pretending to be the actual customer and try to get a duplicate SIM card issued.
Another way to take control over a person’s mobile number is through SIM cloning, but that requires the hacker to have physical access to the SIM card to break the encryption keys and extract the IMSI (international mobile subscriber identity) number—a unique 15 digit code that identifies the SIM to the GSM (global system for mobile communications) network. Unlike SIM swapping, in this case both the original SIM and cloned SIM remain active simultaneously.
SIM hijacking has recently become particularly popular because mobile numbers are being used by various applications, including popular social media platforms, as an identifier, and to enable account recovery and second factor of authentication via SMS confirmation. Therefore an attacker who successfully swaps the SIM card is able to take over an account that uses that phone number as an identifier and as an SMS recipient for the second factor of authentication. more
This is how sim card frauds are taking place:
Hackers hijack SIM connections in three ways. The most prevalent one is called “SIM swapping over a call". In this case, they first gather information on targets—their full name, address, mobile number, date of birth, passcode or Aadhaar number — through phishing scams or leaked databases found on the dark web (that portion of the web that is not traceable by search engines).
Then they will call the target, pretending to be a customer care executive from the operator, in the name of upgrading to new services. They will ask the target to share their SIM card’s ICCID (integrated circuit card identifier) number—a 19-20 digit serial number specific to the SIM.
Once they have the details, they will call the operator, impersonating the actual user and use this information to pose as the user.
Once the SIM swap request is initiated, the operator sends an SMS for authentication and users have to acknowledge it by tapping a single key or a bunch. The hacker will tell users in advance about this SMS so the latter easily falls for it.
Once the SIM swap is complete, the original SIM will be deactivated and the number will be active on the duplicate SIM owned by the hacker.
The second method is “SIM swapping in person" and is likely to be used by small-time cybercriminals. In this case an impostor will visit an operator’s retail outlet with fake documents pretending to be the actual customer and try to get a duplicate SIM card issued.
Another way to take control over a person’s mobile number is through SIM cloning, but that requires the hacker to have physical access to the SIM card to break the encryption keys and extract the IMSI (international mobile subscriber identity) number—a unique 15 digit code that identifies the SIM to the GSM (global system for mobile communications) network. Unlike SIM swapping, in this case both the original SIM and cloned SIM remain active simultaneously.
SIM hijacking has recently become particularly popular because mobile numbers are being used by various applications, including popular social media platforms, as an identifier, and to enable account recovery and second factor of authentication via SMS confirmation. Therefore an attacker who successfully swaps the SIM card is able to take over an account that uses that phone number as an identifier and as an SMS recipient for the second factor of authentication. more
Viewed by 1804
View all 10 comments Below 10 comments
Wonder as to how did you know of these techniques used by criminals? Have you got any personal experience or are these mere assumptions shared to scare readers? more
Jan 31
