Quarter Four Report 2019

Once the attacker has the victim’s mobile phone number on their SIM card, they try to access the victim’s accounts, such as bank accounts, using stolen or guessed credentials. When prompted for a two-factor authentication code, the attacker uses the stolen number to receive two-factor authentication by SMS, working around the security control. 

Being compromised in this way represents a significant risk to the people and businesses targeted by these attacks because the attacker can perform sensitive tasks, like changing passwords or authorising financial transactions.

Anecdotal reports show that incidents of SIM swapping are on the increase, as motivated attackers find ways to circumvent additional security controls.

Reducing the impact of SIM swapping

It’s difficult for an individual to prevent or detect SIM swapping. Attackers can contact mobile phone service providers and have numbers transferred without the user’s knowledge. But, there are ways to prevent or reduce your chances of being a target of successful SIM swapping, including:

• Be careful where you share identity information Your personal information can be used to impersonate you, particularly when it’s used as part of the identity confirmation process. If you know that your mobile phone provider confirms your identity by asking for personal information, make sure it’s hard to find online. For example, you may be asked for your date of birth so make sure you’re not sharing it on your public social media accounts.

• Be creative with account recovery questions For some services, when you set up your account you’ll be asked to provide answers to a set of security questions. These are generally used as a way to identify you if you forget your password and need a prompt — like your mother’s maiden name. Unfortunately, these are also easy things for an attacker to find out, and could be used to gain access to your accounts without your knowledge. Where you can, make up something memorable but untrue that an attacker couldn’t find through a simple search of your name. You can use a password manager to store these answers too.

• When there’s a choice, don’t use SMS two-factor authentication SMS two-factor authentication is better than a password alone, but there are stronger options available. Ask your bank or service provider if they offer other forms of two-factor authentication for account access. For example, this might be an app-based authenticator that generates a new code every 60 seconds or sends you a push notification.

• Get notifications Check with your bank or service provider about whether they have a system to notify you about suspicious account activity – like sending you an email any time there’s a request for a transaction over a certain value.

What to do if you are affected

If you notice suspicious activity on your online banking or email accounts, such as unprompted password reset notifications, or if your phone suddenly loses connection to your mobile phone provider, you may be affected by a SIM swap attack.

If you’re affected, take the following steps immediately:

1. Report the incident to CERT NZ, we can help with advice to secure yourself. With your permission we can also work with the New Zealand Police.
2. Reset passwords for your important online accounts. Online banking and email should be a priority.
3. Report the incident to your provider of the affected account, for example your bank. They may be able to place more protection on your accounts and, if early enough, reverse any unauthorised transactions. 
4. Report the incident to your mobile phone network provider and ask them to check if your mobile phone number has been transferred to another network.

Report an incident

Advice for businesses

Businesses that are responsible for customer accounts and data should consider the controls they have available. Attackers may try to compromise your customers’ accounts using SIM swapping attacks. Protect your customers by:

• using our critical controls when designing and implementing your systems
• using app-based or hardware two-factor authentication for customer access to your services where possible. If this isn’t an option, SMS-based two-factor authentication is still better than relying on a password alone.

If you use a third party vendor or provider for your IT, ask them about the secure authentication and access controls available for customer-facing services.

Read CERT NZ’s Critical Controls

Report an incident