Today, our cellphones are connected to almost everything we interact with online and in daily life. Nearly every single account you create online with a retailer, an email service, cloud storage, cellular/wireless provider, a credit bureau, credit monitoring service, online banking, you name it… your phone number is likely tied to each of these accounts. If you forget your password or if you setup two-factor authentication, these services will typically send a code to your device via text message or push alerts. These are great features to have enabled to ensure your account security. However, this makes your phone number the key to access your online accounts and essentially your online identity. Scammers know this, so they are employing a tactic that will trick you into giving them control of your phone number!

The scammer may contact the victim posing as their cellular carrier claiming that a fraudulent purchase has been made and the only way to stop it is if they verify your information. During that call they may ask for information such as your social security number, your wireless account number or username/password, and they may even have you read a code that was sent to your phone. The code that is being sent to your phone is usually the code generated when a login attempt is occurring online or, even worse, the code is a port out pin. A port out pin allows the phone number to be transferred to another wireless provider. By giving these codes out, you are essentially giving the scammer access to your wireless online account and/or allowing them to port your phone number to another wireless carrier.

Some scammers may also opt for what is known as a SIM swap to port your existing service to their phone. Most smartphones in operation today, utilize an electronic SIM (e-SIM) rather than a physical SIM (p-SIM) card. Thus, service can be installed to another phone by downloading an e-SIM to the scammer’s device. This attack also relies on getting sensitive information from you to conduct the attack.  

How can you protect yourself?

The first way to protect yourself is to never give out sensitive information to someone calling you, messaging you or emailing you, especially if they are claiming to be from your financial institution or wireless carrier. Another, very important way to protect yourself is by utilizing a service provided by many wireless carriers known as a  line lock  or number lock,  depending on your carrier. These features prevent your phone number from being ported to a new provider and stops scammers from stealing your number and taking over your digital identity. Further, utilizing these features also restrict SIM card changes by preventing the activation of a new SIM (physical or digital) on your phone line. Thus, preventing your current service from being taken over on another device. Extra verification is required to remove the line lock, such as when you need to get a new phone or port your service to another carrier. This typically involves a waiting period following the removal of the line lock removal to provide you time to stop the process if you detect fraud.

Traditionally, identity protection is typically credit monitoring services, utilizing credit freezes or fraud alerts with the credit bureaus, as well as exercising caution when it comes to giving out your personal information. However, in today’s digital world ensuring that we do not provide codes or sensitive information pertaining to our cellular phone service and utilizing a line lock feature is also just as important. If you find yourself a victim of a SIM Swap or Port Out scam, contact your wireless carrier to alert them immediately, notify your financial institution that your phone number is no longer under your control and file a police report. It is also wise to remove the compromised recovery phone number for any services such as email, online banking, cloud storage services, online shopping accounts, etc. before the scammer has time to take over these accounts. Lastly, it is advisable to file an FTC identity theft report online at identitytheft.gov, as this report may help you recover from any unauthorized use of your wireless account and any subsequent misuse of your identity.

‍