What are SIM swap attacks: how to protect your crypto from SIM hijacking

SIM swap attacks are a growing threat in the cryptocurrency world, where attackers hijack phone numbers to gain unauthorized access to users' crypto accounts. What are SIM swap attacks exactly, and how can you prevent them? Read on to find out.

TL;DR

• SIM swap attacks are on the rise. They involve scammers using social engineering to convince your mobile carrier to transfer your mobile number to a new SIM card they're in control of.

• SIM swap attacks — also called SIM hijacking — bypass SMS-based two-factor authentication (2FA). It's advised to instead use app-based 2FA, such as the Google Authenticator app.

• With access to your SIM, scammers can also gain access to your crypto accounts by intercepting 2FA codes sent via SMS.

• Disruption to your mobile carrier service and unexpected or unusual notifications of an attempted password reset or login are signs that a SIM swap attack is happening to you.

What are SIM swap attacks?

SIM swap attacks, also known as SIM hijacking, occur when an attacker convinces your mobile carrier to transfer your phone number to a new SIM card they control. Once they control your number, they can intercept SMS-based two-factor authentication (2FA) codes and gain access to your cryptocurrency accounts.

SIM swap attacks are particularly dangerous because they can bypass SMS-based 2FA, a commonly used security measure for crypto accounts. The consequences of a successful SIM swap attack can be severe:

• Financial losses: Attackers can drain funds from your cryptocurrency accounts.

• Identity theft: They can impersonate you, leading to further unauthorized activities.

• Loss of trust: Victims may lose trust in the security of their mobile carriers and cryptocurrency platforms.

Who’s vulnerable to SIM swap attacks?

Anyone who only uses SMS-based 2FA for their cryptocurrency accounts is at risk. However, individuals with significant crypto holdings or those publicly known in the crypto community are particularly attractive targets for attackers.

SIM swap attacks can happen anywhere, but they typically involve:

• Mobile carriers: Attackers exploit weaknesses in carrier security processes.

• Crypto platforms: Accounts secured only with SMS-based 2FA are vulnerable.

• Social media: Publicly available information can be used by attackers to craft convincing social engineering attacks.

What's more, SIM swap attacks can occur at any time, often without warning. They typically happen when personal information is compromised, for example, following data breaches and leaks that provide attackers with the information needed to impersonate victims. SIM swap attacks can also occur as a result of weak security processes. Carriers with inadequate security measures are more susceptible to social engineering attacks because there are typically fewer safeguards in place to protect user data and verify identities.

How to protect your crypto from SIM swap attacks

SIM swap attacks may be on the rise, but there are plenty of steps you can take to protect yourself and sidestep the threat. Understanding how a SIM swap attack works can help you to adequately protect yourself.

Typically, as the first step in an attack, the criminal will gain access to personal information by contacting your mobile carrier and using social engineering techniques to convince them to transfer your phone number to a new SIM card. Once they control your number, attackers intercept 2FA codes and gain access to your accounts.

However, there may be warning signs that a take is taking place, which gives you an opportunity to take action before your crypto assets are compromised. They include a sudden loss of phone service, which can indicate that your number has been transferred. Unusual account activity, such as notifications of login attempts or password resets, can also signal an ongoing attack.

Preventing SIM swap attacks

Preventing the opportunity for a SIM swap attack is, of course, much better than dealing with one as it happens. We recommend the following actions to prevent an attack in the first instance.

• Use authenticator apps: Replace SMS-based 2FA with authenticator apps like Google Authenticator which generate codes on your device.

• Enable PINs and passwords: Set up a PIN or password with your mobile carrier to add an extra layer of security.

• Secure personal information: Limit the amount of personal information you share online and use privacy settings on social media.

• Use a hardware wallet: Store your cryptocurrencies in a hardware wallet, which requires physical access to approve transactions.

There are further security measures you can take that relate to the specific mobile carrier you use.

• Account notes: Request your carrier to add a note to your account requiring additional verification steps before making changes.

• Carrier-specific security: Some carriers offer enhanced security features such as account take-over protection. Check with your provider.

What to do if you suspect a SIM swap attack

Acting fast can help you to minimize the damage caused by a SIM swap attack. Here are the first steps to take if you suspect an attack has happened.

• Immediate action: Contact your mobile carrier immediately to regain control of your number.

• Secure your accounts: Change passwords and enable 2FA on your crypto accounts using an authenticator app.

• Report the incident: Notify the cryptocurrency platform and consider filing a report with local authorities.

The final word

SIM swap attacks are a significant threat to the security of your cryptocurrency assets. By understanding how these attacks work and implementing robust preventive measures, you can protect yourself from becoming a victim. Use authenticator apps, secure your personal information, and stay vigilant to safeguard your crypto holdings on the platform.

SIM swap attacks aren't the only threat to your crypto assets. Read our guide on how to spot scams to help protect your crypto, and if you're new to the space, learn more about crypto custody and how it can help protect you.