The growing threat of SIM swapping

By Alan Bavosa, 18 March 2024
 
In the rapidly evolving cybersecurity landscape, SIM swapping has emerged as a significant threat to an organisation’s security and regulatory compliance across various industries.

SIM swapping involves unauthorised individuals gaining control of a user's mobile phone number by convincing the telecom provider to transfer the victim’s phone number to a new SIM card the attacker controls. This deceptive manoeuvre grants attackers not only access to and control over the victim’s phone number, but also paves the way for the attacker to easily parlay the power of controlling someone else’s phone number into an escalating barrage of malicious actions against the victim. 

Case studies

There have been several high-profile cases of SIM swapping, demonstrating that no-one is immune from this type of fraud. In fact, it is not just individuals at risk, as seen in January this year when the US Securities and Exchange Commission fell victim to SIM swapping, compromising its X, formerly Twitter, account.[1] Previously, the former CEO of Twitter, Jack Dorsey, was also targeted in such a scheme [2] while recent reports have highlighted the devastating impact on victims when their mobile phone numbers are taken over by scammers in order to access and clean out their bank accounts.[3]
 
Let's delve into specific attacks made possible by SIM swapping. One such attack is unauthorised account access, where cybercriminals exploit the compromised phone number to gain control of accounts tied to financial transactions, personal data, or healthcare information. Additionally, SIM swapping facilitates social engineering attacks, enabling perpetrators to impersonate legitimate users and manipulate support personnel to make unauthorised changes. 
 
With control over the person’s phone number, attackers can:  

• anonymously open new accounts fraudulently under the victim’s name – establishing a form of synthetic identity fraud
• generate Multifactor Authentication (MFA) requests and use the MFA codes to gain access to or take over accounts via existing mobile apps running on the victim’s phone
• masquerade or impersonate the victim by fraudulently purchasing goods or services that are tied to the victim. 
  
  

Vulnerable sectors

Industries such as mobile gambling, lottery, healthcare, and finance are particularly susceptible to the repercussions of SIM swapping attacks through their apps, necessitating a focused and comprehensive approach to regulatory compliance. 
 
SIM swapping introduces a critical vulnerability in the mobile gambling sector, where financial transactions and personal data are central. Regulatory bodies prescribe stringent security measures to protect user data and financial transactions. A successful SIM swap can compromise the two-factor authentication mechanisms employed by these platforms, leading to unauthorised access and potential breaches. 
 
Lottery applications, which handle sensitive personal information, face similar risks. Regulatory frameworks governing lotteries mandate robust security protocols to safeguard user data and maintain the integrity of the lottery process. SIM swapping attacks can disrupt these mechanisms, allowing unauthorised access to user accounts and compromising the fairness of lottery operations. 
 
In the healthcare app domain, where the protection of patient data is paramount, SIM swapping poses a unique threat. Healthcare applications often store and transmit sensitive medical information, subject to regulations like the Health Insurance Portability and Accountability Act (HIPAA). A successful SIM swap can grant unauthorised access to patient records, jeopardising the confidentiality and integrity of healthcare data. 

Preventative measures

Taking all of this into account, understanding the risks associated with SIM swapping is crucial therefore for the safeguarding of organisations across diverse sectors. By adopting no-code automation platforms for mobile app defence, businesses in the finance, mobile gambling, lottery, and healthcare sectors can fortify their defences against the evolving menace of SIM swapping. These platforms provide a seamless and effective solution, ensuring industry compliance and protecting against specific attacks made possible via SIM swapping.

Alan Bavosa is Vice President of Security Products at Appdome, a mobile app defence platform for Android & iOS apps.