<story><title>NY Man Pleads Guilty in $20M SIM Swap Theft</title><url>https://krebsonsecurity.com/2021/12/ny-man-pleads-guilty-in-20-million-sim-swap-theft/</url></story><parent_chain><item><author>krebsonsecurity</author><text>That&amp;#x27;s nice to hear. So the SIM swappers have to double their bribes.&lt;p&gt;I think the best solution is to cut the mobile providers out of the equation altogether. I&amp;#x27;ve long advised removing your phone number from anything you can, or at least substituting a voip service that can&amp;#x27;t be social engineered over the phone. Some services don&amp;#x27;t let you use voip services for multi-factor or signup, so your mileage may vary.&lt;p&gt;Also, it&amp;#x27;s important where possible to use types of multi-factor that don&amp;#x27;t rely on your phone number. The tricky part is, so many sites will let you reset your password if you can receive a link via SMS at the phone number on file for the account. Which means anyone who SIM-swaps you then can reset the passwords on those accounts that allow SMS resets (which is a lot, still).</text></item><item><author>toomuchtodo</author><text>Tangentially, the FCC is forcing the hand of mobile carriers on this. T-Mobile &lt;i&gt;just the other day&lt;/i&gt; has updated their policy so that two employees must be present and part of the process to swap a customer’s SIM. The perils of your phone number being your identity.&lt;p&gt;Refreshing to see these active theft and wire fraud prosecutions.</text></item></parent_chain><comment><author>DarylZero</author><text>You must have to pay more than double to bribe two people simultaneously -- since each one then has to rely on an extra person to cover up the corruption.</text></comment>
<story><title>NY Man Pleads Guilty in $20M SIM Swap Theft</title><url>https://krebsonsecurity.com/2021/12/ny-man-pleads-guilty-in-20-million-sim-swap-theft/</url></story><parent_chain><item><author>krebsonsecurity</author><text>That&amp;#x27;s nice to hear. So the SIM swappers have to double their bribes.&lt;p&gt;I think the best solution is to cut the mobile providers out of the equation altogether. I&amp;#x27;ve long advised removing your phone number from anything you can, or at least substituting a voip service that can&amp;#x27;t be social engineered over the phone. Some services don&amp;#x27;t let you use voip services for multi-factor or signup, so your mileage may vary.&lt;p&gt;Also, it&amp;#x27;s important where possible to use types of multi-factor that don&amp;#x27;t rely on your phone number. The tricky part is, so many sites will let you reset your password if you can receive a link via SMS at the phone number on file for the account. Which means anyone who SIM-swaps you then can reset the passwords on those accounts that allow SMS resets (which is a lot, still).</text></item><item><author>toomuchtodo</author><text>Tangentially, the FCC is forcing the hand of mobile carriers on this. T-Mobile &lt;i&gt;just the other day&lt;/i&gt; has updated their policy so that two employees must be present and part of the process to swap a customer’s SIM. The perils of your phone number being your identity.&lt;p&gt;Refreshing to see these active theft and wire fraud prosecutions.</text></item></parent_chain><comment><author>menage</author><text>One of the advantages of using Google Fi as your phone provider on a Google phone: there&amp;#x27;s no SIM, and you have to log in to the phone on your Google account in order to transfer phone&amp;#x2F;SMS service there. So an attacker can&amp;#x27;t use a SMS hijack to steal 2FA codes unless they&amp;#x27;ve already compromised your Google account (which is hopefully a higher bar than convincing some random phone shop employee).</text></comment>