4 ms·

Is there a recommended defense against a SIM Swap attack at the carrier level? Do carriers offer some form of two factor? I suppose the weakest link is the in s

Is there a recommended defense against a SIM Swap attack at the carrier level? Do carriers offer some form of two factor? I suppose the weakest link is the in store associate who just can't be bothered to verify identities.

kube-system 6y ago
Some carriers have security questions they are supposed to ask before making changes to an account. Not sure how well these actually work in practice.
imglorp 6y ago
There should be an explicit lock like there is for credit agencies.
dabernathy89 6y ago
Yes, you can add additional security onto your account - at least with Verizon. I highly encourage everyone to do so. Once enabled, you will need to present photo ID at a corporate Verizon store to allow your phone # to be transferred to a new carrier. Instructions: https://twitter.com/ramsey/status/1235227940054585344 https://twitter.com/ramsey/status/1235227940054585344 My wife got SIM jacked just a few weeks ago and we got extremely lucky that it didn't turn into a bigger problem. They did get a hold of her Venmo account, but fortunately it's not actually linked to our bank account (Venmo restricts the # of users that can link to a single bank account).
- deleted 6y ago
  [deleted]
- dguo 6y ago
  Thanks for the tip! I'm glad to see they've implemented this. Though I'm still very frustrated about how long it took for them to do anything about this problem.
- jtokoph 6y ago
  This doesn’t work because many SIM swaps are now done with stolen corporate credentials or bribed retail employees. They login to the corporate portal and check the box that says “I verified the customer’s ID” and proceed with the sim swap. This only protects you from the old way where a scammer tries to convince well intentioned phone support or retail employees.
dguo 6y ago
One of my relatives suffered three SIM swap attacks over about six months. I asked our carrier after the first two times what we could do to prevent it from occurring again. The answer each time boiled down to "nothing." After the third time, my relative got a new phone number. I'd love to be able to opt in to having to provide a photo id at a physical location in order to complete the SIM swap. Or maybe the carrier can try to call or text the number for some sort of confirmation process. In our case, we never even got a warning that the swap was going to occur. We found out after my relative's email account was compromised. This issue alone is enough to make me want to switch carriers, but AFAIK, all of them do not provide robust protection measures for this issue. I've considered Google Fi, but it might have poor coverage where some of my relatives are.
kyrra 6y ago
(I'm a googler, opinions are my own. I don't work on Fi.). Google Fi provides sim swap attack protection. To bind a Google Fi # to a phone, you need to be able to log into your Google account on that phone (from the Fi app). There is no other way to bind a Fi number to a phone (customer service doesn't even have the power to do this). This means that whatever 2FA you have setup on your Google account is the same protection you get against sim swap attacks.
- johndough 6y ago
  That is good to hear, but I am more worried about google suspending my account and ignoring all appeals for automated reasons. To be fair, this has not happened to me yet (with gmail) or anyone I personally know, but it remains a concern for me due to the high impact such an event could have on my life. Is there any bulletproof way that a non-US citizen could get their account reinstated or at least recover associated accounts?
  - kyrra 6y ago
    (I'm a googler, opinions are my own) Even for US citizen's, there isn't a full-proof way to deal with account recovery. I'd say your account getting locked for incorrect reasons is pretty rare. I think one important thing to know is that account-suspension stories you read on the internet aren't always legitimate cases. While, yes, getting publicity about an account lock can get it a second look, bad actors know this as well. Those who have done "bad" things will use this same approach to try to get their accounts unlocked. Google won't publicly comment on any individual case, so you are getting a one-sided story about why an account was locked, so be skeptical when you are reading them.
Mirioron 6y ago
Even if there is, there are still so many different carriers in the world. I doubt all of them are going to implement safeguards against this, which means that accounts will be at risk as long as websites rely on these phone numbers.
Jimpulse 6y ago
Just looked it up, T-Mobile has a NOPORT account level security protection. It requires that a valid ID is presented in store to port your number to another carrier or swap SIMs.
littldevl 6y ago
Verizon Wireless allows you to block ports and SIM swaps. Open App --> Account --> Account Settings --> Security --> Number Lock.

kube-system 6y ago

Some carriers have security questions they are supposed to ask before making changes to an account. Not sure how well these actually work in practice.

imglorp 6y ago

There should be an explicit lock like there is for credit agencies.

dabernathy89 6y ago

Yes, you can add additional security onto your account - at least with Verizon. I highly encourage everyone to do so. Once enabled, you will need to present photo ID at a corporate Verizon store to allow your phone # to be transferred to a new carrier. Instructions: https://twitter.com/ramsey/status/1235227940054585344 https://twitter.com/ramsey/status/1235227940054585344 My wife got SIM jacked just a few weeks ago and we got extremely lucky that it didn't turn into a bigger problem. They did get a hold of her Venmo account, but fortunately it's not actually linked to our bank account (Venmo restricts the # of users that can link to a single bank account).

deleted 6y ago
[deleted]
dguo 6y ago
Thanks for the tip! I'm glad to see they've implemented this. Though I'm still very frustrated about how long it took for them to do anything about this problem.
jtokoph 6y ago
This doesn’t work because many SIM swaps are now done with stolen corporate credentials or bribed retail employees. They login to the corporate portal and check the box that says “I verified the customer’s ID” and proceed with the sim swap. This only protects you from the old way where a scammer tries to convince well intentioned phone support or retail employees.

dguo 6y ago

One of my relatives suffered three SIM swap attacks over about six months. I asked our carrier after the first two times what we could do to prevent it from occurring again. The answer each time boiled down to "nothing." After the third time, my relative got a new phone number. I'd love to be able to opt in to having to provide a photo id at a physical location in order to complete the SIM swap. Or maybe the carrier can try to call or text the number for some sort of confirmation process. In our case, we never even got a warning that the swap was going to occur. We found out after my relative's email account was compromised. This issue alone is enough to make me want to switch carriers, but AFAIK, all of them do not provide robust protection measures for this issue. I've considered Google Fi, but it might have poor coverage where some of my relatives are.

kyrra 6y ago

(I'm a googler, opinions are my own. I don't work on Fi.). Google Fi provides sim swap attack protection. To bind a Google Fi # to a phone, you need to be able to log into your Google account on that phone (from the Fi app). There is no other way to bind a Fi number to a phone (customer service doesn't even have the power to do this). This means that whatever 2FA you have setup on your Google account is the same protection you get against sim swap attacks.

johndough 6y ago
That is good to hear, but I am more worried about google suspending my account and ignoring all appeals for automated reasons. To be fair, this has not happened to me yet (with gmail) or anyone I personally know, but it remains a concern for me due to the high impact such an event could have on my life. Is there any bulletproof way that a non-US citizen could get their account reinstated or at least recover associated accounts?
- kyrra 6y ago
  (I'm a googler, opinions are my own) Even for US citizen's, there isn't a full-proof way to deal with account recovery. I'd say your account getting locked for incorrect reasons is pretty rare. I think one important thing to know is that account-suspension stories you read on the internet aren't always legitimate cases. While, yes, getting publicity about an account lock can get it a second look, bad actors know this as well. Those who have done "bad" things will use this same approach to try to get their accounts unlocked. Google won't publicly comment on any individual case, so you are getting a one-sided story about why an account was locked, so be skeptical when you are reading them.

Mirioron 6y ago

Even if there is, there are still so many different carriers in the world. I doubt all of them are going to implement safeguards against this, which means that accounts will be at risk as long as websites rely on these phone numbers.

Jimpulse 6y ago

Just looked it up, T-Mobile has a NOPORT account level security protection. It requires that a valid ID is presented in store to port your number to another carrier or swap SIMs.

littldevl 6y ago

Verizon Wireless allows you to block ports and SIM swaps. Open App --> Account --> Account Settings --> Security --> Number Lock.