7 Social Engineering Tactics Behind SIM Swaps

In this video, I'm going to review some of the ways hackers perform SIM swaps, and I don't like using the word hacker. It's just that it's normally used in um articles and different videos about the mobile SIM swap attacks, but these are not IT hackers. They are not coders. They are hackers in the sense of that they're good at social engineering, good at bribery, good at tricking people. And keep in mind that even though I'm going to review these methods, they're very creative people, and their methods change as the carriers attempt to change their defense against mobile SIM swap attacks. First up is the plain old impersonation. This is where a nefarious person pretends to be a victim, uh pretends to be you by using leaked personal information like name, address, date of birth, social security number. They may have uh gotten this information online. They may have gotten it from the dark web or the many data breaches that all the US citizens have been part of for uh the last two or three decades. However they get it, they're basically going to use that information to impersonate you. They're very good at sounding confident, urgent, and convincing customer support reps that they are you. And once that agent get uh gives up um and gives over your mobile account, then that nefarious person owns you. They can steal from you. The second is sort of a play on the impersonation, and that is emotional manipulation. So, they claim their their phone was lost, stolen, broken. Uh they act desperate. In cases, uh they may they they play they do things like um have a crying baby in the background from YouTube video, and they try and create stress and urgency, and they desperately need to make a flight in the next hour or two, and trying to get that customer support rep again to put their guard down and move your mobile account over to the phone in the hacker's hands. The third way is fishing customer service employees. Not necessarily impersonating you, but actually trying to trick a customer support rep by doing things like uh sending fake internal emails or messages that look like they come from a supervisor or an IT department asking staff to reset or transfer a phone number. The fourth is bribery or insider help. So in this case they don't need to social engineer or trick somebody. They're actually paying somebody that works at a phone store, independent phone stores or the many customer support reps and and centers that these uh carriers have around the world. In some cases criminals pay dishonest employees to move a phone number over to a new SIM card without proper verification. And many ways to bribe different people. Could be to just simply bribe somebody to get your information, your verification information, information about uh like what's your PIN number, what's your address, what's your birthday. So that they can then call back or go to a store and impersonate you that way. It's sort of a two-step process. The fifth is repeated attempts. This is also called agent shopping. And so if one support agent says no or store says no, they try and learn whatever they can about you. They try and learn what information they don't have so that they can the next day or even that afternoon go to another store or call back on the 800 number with that one more piece of information that they they've learned about you in the meantime. And again try it again and again. And there's been cases there's actually a YouTube video on this where one of the victims showed that the attacker had gone to tens of stores. Like I think it was something like 30 37 stores and without them paying for an investigation to make sure that this person got caught, they wouldn't have seen all this the CCTV camera from all these different stores and eventually caught this person. And so they weren't going to give up until they were either caught or they were able to SIM swap and harass or steal from that victim. The sixth is a multi-step approach and this is sort of a softer approach, and this is where one day they call up and pretend to be you, and they do something simple like trying add an email to the account. And once they can do that, then they call back the next day, and they'll use that added email to then say, "Oh, now today I want to change a PIN or modify a password or modify a an address." And the third time they call, they're able to get verified because they're no longer having to try and trick or impersonate. They're actually calling back on your account, and they're verifying be- because they know all the information. So, they're now verifying on the true information that's in your account, even though it is the wrong information. Now, the seventh is they do something like they order a phone and possibly a new line off your account. Now, if you have a mobile account with AT&T, Verizon, T-Mobile, any of these carriers where it's direct, then you have most likely a credit account. And what that means is somebody can go into a store, impersonate you, and say, "I want to buy a a phone and a line off of my account." And they're using the incentive of that uh that store rep who wants to earn the commission to sell a phone and a line on your account. They walk out of the store with that phone and the line. They call the 800 number, and they're calling from a phone and a line off of your account. So, the verification's already half there. They uh you know, that person's calling from that phone that's on your account. They know the device ID, they know the MZ number of the SIM or the eSIM, and of course, they're calling from a mobile account, mobile line that's on your account. And so, it's much easier for them to verify, and then they'll do something like um ask them to move the old number, which is pointing to your phone, over to the brand new phone. And once they do that, then they have you. And so, the goal of every SIM swap is always the same. It's to take control of your phone number, reset passwords, break into email, crypto, iCloud, cloud storage, web hosting, whatever they can do to try and either harass you, take money, take your crypto. You know, the motivation is different for all kinds of people. In the meantime, stay safe and secure. Be vigilant about your personal privacy and your security. If you want defense against SIM swap protection, then check out A phone at afone.com. We provide mobile service. You get your choice of AT&T Verizon. You get a guaranteed SIM swap security with some added privacy, some other layers of security that we add in there, and we back it up with a line of insurance against SIM swap losses. We'd love to have you join our secure mobile community. Stay safe and secure.