Imagine that one day you wake up to find that your phone no longer seems to work - you can’t
send a text message and you can’t make a phone call. For some people,
this may be an indication that you simply haven’t paid your phone bill.
But for others, this is the canary in the coal mine, the first sign of an attack known as
SIM swapping. If you’ve ever had to log in to one of your accounts using text verification,
you know that process where they text you a code and you have to type it in,
you’re going to want to watch this video all the way through.
My name is Josh and this is All Things Secured, a channel where we break down what may feel like
complex online security issues into easy to follow instructions and tutorials. And this
week’s video explaining a common attack known as SIM swapping is brought to you by Efani.
There are a number of different ways to deal with SIM swapping and other security issues
related to your mobile carrier, but if this is a serious concern for you or your small business,
consider this: Efani is pretty much the only solution that can guarantee protection
against SIM swaps so much so that every plan comes with a $5 million insurance policy.
I’ll explain more later in the video, and you can visit AllThingsSecured.com/efani
to learn more. For now, let’s discuss what this attack is,
why it’s a big deal and the simple steps you can take to avoid it.
So what is SIM Swapping?
SIM Swapping is a malicious attack targeting your mobile carrier that
allows the attacker to gain control of your phone number in order to intercept
any 2-step authentication or verification codes that may be sent via SMS text.
That’s a lot so let me break down why this is such a big deal. First, this attack can be done
remotely, meaning that I could be here in Thailand and target AT&T in the US or Virgin in the UK.
I don’t have to steal or touch your phone in order to do a SIM Swap.
The second reason this is such a big deal is because this is hard to detect.
After an attack, it may take some time before you realize that you
can’t make a phone call anymore or you aren’t receiving text messages.
The third reason this is such a big deal is because it’s shockingly easy to do.
In 2020, researchers at Princeton University published their test of 5 major U.S. cell phone
providers and found that out of 50 attempts to do a fake SIM swap, 39 of them were successful!
That’s almost an 80% success rate, do you realize that? Most mobile phone
carriers rely on low paid customer support employees to handle these kinds of requests.
So if I’ve been able to do a lot of research on you as an individual, and I call up AT&T,
for example, telling them that I’ve lost my phone and I need to switch my SIM card, they’re going
ask for different bits of information including perhaps my home address on file, my full name,
maybe my mother’s maiden name, date of birth and other personal info depending on the carrier.
Some carriers require more information than others, but the bottom line is that if I can
convince the customer service rep on the phone that I am you, they’ll switch the phone number
over to my phone. Or maybe I pay an insider to make the switch for me. The weakest link
is this customer service rep, and since they’re usually not highly trained
nor well-paid, they’re an easy target.
That’s what it is but…why should you care?
Over the past few years, a number of high profile individuals have been victims of a SIM swap,
including the CEO of Twitter, an actress, YouTubers, and many more.
But the most common attacks happen to people like you and me,
or they happen to small businesses, and these are the ones that don’t get reported on much.
You see, these text codes that companies send out to verify your identity are more
common than you may realize. Your bank does it all the time, your email provider might do it,
your investment accounts, it’s basically a default authentication method for most online accounts.
So if somebody gets access to your phone number, there is significant damage that
can be done. They’ve gained access to your identity verification mechanism, and with
that they can request transfers, takeover your social media accounts, and other kinds of fraud.
Hopefully I don’t need to do too much convincing here. It’s an issue, but how can you avoid it?
I’m going to give you a number of simple ways that you can protect yourself against the
damages of a SIM swap, some of them might be obvious and others will likely be new to you.
First, don’t use SMS text 2-factor authentication if you have the choice! If you’re subscribed
to this channel you’ve already heard me say this and if you aren’t subscribed, go ahead
and hit that button down there so you can stay informed on basic security principles like this.
Nowadays you have a number of different options when it comes to identity verification, or
two-step verification. This includes apps like Google Authenticator or Authy,
which uses a mathematical algorithm to present you a 6-digit passcode
that changes every 30 seconds. Or you could pay a bit of money for a 2FA key
that somebody would need to physically steal in order to use and log in as you.
Either way, moving away from SMS text as a means of verification
is a good idea. This can be done with your email, with your social media,
with your crypto exchange accounts, and with most investment accounts.
Unfortunately, most banks still refuse to allow anything other than SMS text,
so you’re kind of stuck there. What are your options.
Well first, you can call into your mobile carrier and ask them what
protections they’ve put in place. For many of them, you can set a PIN or passcode that
would need to be shared in order to make any changes to your SIM card,
and even though that’s not a foolproof protection, it’s better than nothing.
A lot of banks work with the carriers to monitor for SIM swaps, which is great, but
again, you’re just dealing with one isolated problem.
If this is a serious concern for you - and that might be the case if you have a
significant store of value in a crypto account secured by SMS text verification,
perhaps if you’re small business who wants to make sure that an attack on one
single employee does not grant access to an entire network or database,
or - and this is an interesting one - if you want a little more privacy in relation to the
personal data a mobile carrier has on you - that’s where a solution like Efani comes in.
Now as I said earlier, Efani is sponsoring this video,
and I want to be transparent about that with you. This solution doesn’t work for
everybody but if the previous two tips didn’t already give you confidence in a solution,
then I really like this option for US residents that’s worth being aware of.
You see, if your trust in the security and privacy of your mobile phone carrier is low,
Efani is a service that replaces your current phone plan. You can get a new
number or port your phone number to their service which operates on top of the AT&T
and Verizon networks in the US, but then adds another layer of security.
They offer an 11-layer authentication process that pretty much eliminates all risk of SIM swaps,
and because of that protection you also get a $5 million insurance against any
losses related to SIM swaps, which is something I don’t think you could easily get on your own.
But even more than that, I like the fact that Verizon and AT&T
don’t have my personal information - if I were to go into a store with my Efani phone plan and ask
them about my phone number, their records would only show Efani as the customer and not me - and
I also appreciate the transparent pricing without a contract and their 60-day money back guarantee.
All that to say, whether you’re a VIP, crypto trader,
government official, business executive or just someone who
really cares about their mobile privacy and security, it’s worth checking out Efani.
Learn more about the world’s most secure mobile phone serivce at AllThingsSecured.com/Efani.
A couple other ideas for those who want to protect against SIM swapping.
Some carriers - though not all - allow you set a PIN number for your SIM card which
could help. You would find that under the network settings on your phone.
My final thought is this, and this applies to more than just mobile phone security.
Whenever you’re asked for pieces of information used to verify your identity - so that’s things
like your mother’s maiden name, your favorite pet, your first car, those kinds of questions - don’t
tell the truth. You can either make something up or if that sounds too complicated,
you could write the answer backwards. A big problem with this kind of authentication is
that much of this information is easily available to those of us who know how and where to look.
So if the answer is not, in fact, the truth, impersonation becomes harder to accomplish.
Give this video a like if it’s been helpful and make sure to check out
Efani if you’re watching this from the US. And I have another video about completely
hiding your phone number that you might find interesting. Click here to watch that next.