8 ms·
Preventing the use of SIM farms for fraud: consultation
- ivanstojic 3y agoWhat happens with eSIM devices?
- whypretend 3y agoGreat unanswered question. Nothing mentions "eSIM". I really have no idea. Speculative questions: Maybe there are some number switching, chip level protocol mitigations inherent to the standard? Maybe carriers can push locks or there is remote attestation that could inhibit more than 4 registrations? Will read up. I've never read the eSIM standards.
- maratc 3y agoeSIM device does not usually have a phone number, and it can't send (or receive) SMS.
- jackweirdy 3y agoUnless we are thinking of different technologies, you can use esims for all of that? Just last week I ordered a usmobile.com esim, installed it on my phone, received a +1 415 number and received and sent SMS with it
- whypretend 3y agoWhen an eSIM in a phone is provisioned to a carrier, with some plan, usually it does have a phone number and could send and receive SMS. Though yes you are correct, if you're only thinking of a single chip (eSIM) instead of the system it usually goes in yes, you are be correct - those systems can currently exist. iSIM, integrated eSIM with SOC (cpu, gpu, ram, wireless baseband, eSIM) will eventually be more common in phones. Look up: "remote sim provisioning"
- kiwijamo 3y agoIncorrect, they can have an assigned phone number and can do anything a normal SIM can do. There are SIMs (either physical or eSIM) that do not have a phone number and/or has restrictions on what it can do. It's not the form itself that limits the functionality, it's the mobile network provider who decides what functionality each individual SIM has. E.g. Mobile card payment devices may have a SIM that has no phone number and is data only with connection only permitted via a certain gateway to the payment provider.
- orf 3y ago> SIM farms are devices that can house hundreds of SIM cards, which can send out thousands of scam texts to defraud the UK public of millions of pounds. In addition to sending scam texts, these devices are used by criminals to run scam call campaigns and to post misleading, false or phishing messages on social media in bulk. > Whilst there are some potentially legitimate uses of the technology, these are limited and should not require using more than four SIM cards, based on the number of mobile operators in the UK. We have very limited evidence that there are any legitimate use cases for devices that allow the use of more than four SIM cards, and for all such cases alternative options exist. The justification seems sound. What is the issue here?
- nibbleshifter 3y agoThis is a backdoor way they are trying to introduce mandatory SIM registration.
- dazc 3y agoGovt id is required to purchase a sim card in many EU countries. If the UK Govt decided to implement such a policy based on something like 'security' there wouldn't be a lot of push-back. Let's overlook the fact that such policies just make stolen id a lot more valuable than it is already.
- specproc 3y agoI'm all for it continuing, but it always struck me as wild how you can just pick a UK SIM up at the airport from a vending machine. I don't know of many countries where this is possible.
- nibbleshifter 3y agoI've found that policy trivial to circumvent in most EU countries I've visited (which is most of them). Its also a stupid fucking policy.
- deleted 3y ago[deleted]
- netik 3y agoabsolutely wrong approach. fix this at the carrier level and not client device level.
- petesergeant 3y agoI think you might be right here, but what does that look like exactly? Stop companies distributing cheap SIMs? Force them to get ID from any customer?
- fathyb 3y agoMaybe a standarized national system to report spam, or maybe even as part of the cellular protocol? I never heard of such a system deployed nationally, but I'm wondering if it could help. Most of the time when a spam number calls me, I can find it through spam reports on 3rd party websites by googling it.
- NoZebra120vClip 3y ago> Most of the time when a spam number calls me, I can find it through spam reports on 3rd party websites by googling it. Oh, you mean that you can identify the Caller ID number which the spammer chose to spoof at you?
- fathyb 3y agoNo, it seems most spammers here use cheap SIMs without spoofing (which seems to be what OP is about). They even leave voicemail messages asking to call back. But spoofing is also something that should be fixed. I know it's difficult because of VoIP and backwards-compatibility, but it's not impossible either.
- DANmode 3y ago> Maybe a standarized national system to report spam, or maybe even as part of the cellular protocol? Not government, but, forwarding spam texts to 7726 (SPAM) works for various carriers.
- petesergeant 3y agoGiven that gov.uk is already so surveillance happy, I’m surprised they haven’t just mandated ID cards and then required SIMs to be linked to one of those or a passport
- bombcar 3y agoOr just mandate warmup periods like we do with spam from IPs.
- wkat4242 3y agoYeah I'm surprised a surveillance country like the UK didn't do this yet. Here in Spain they do.
- toomuchtodo 3y agoI see lots of griping in thread, but it seems business as usual in the countries where registration is required. https://www.comparitech.com/blog/vpn-privacy/sim-card-registration-laws/ https://www.comparitech.com/blog/vpn-privacy/sim-card-regist... > The majority of national governments (around 160) require mandatory SIM-card registration, which means you need your real name and personal details to sign up for phone service. And just under 20 of these also require biometrics, e.g. your fingerprints or a facial scan, with eight more countries in the process of implementing such requirements. The biometrics part is unnerving to be sure, but anonymous SIMs or DIDs are incompatible with fraud and spam fighting efforts. If you terminate bad actors, they’ll just keep spinning up more resources.
- costco 3y agoThe interesting thing is despite the rules governments in countries like India or Ghana with strict registration laws will routinely find 3000 SIM cards on raids on simbox operators.
- toomuchtodo 3y agoWho are these SIMs being registered to in these operations?
- danielfoster 3y agoI don’t see any evidence in the proposal that fraud is known to have originated from UK-based SIM farms. Maybe I missed this, but even so I can’t imagine that banning these devices would have any impact on fraud. It would be just as easy to get SIMs that support roaming and text outside the UK, or better yet just use WiFi texting.
- incone123 3y agoDoes WiFi texting not require the involvement of a mobile service provider somewhere along the line?
- danielfoster 3y agoIt does, but you can do it with a UK SIM card outside the UK.
- whypretend 3y agoWhat about the sim farm I use to delegate my SMS OTP codes to? No VOIP numbers don't work for everything, no using the same SIM card doesn't work, no I don't want to worry about running dozens of phones with batteries and no I'm not even sending messages. Local TOTP key as a second factor should be more standard. Especially if I'm already paying for a service you shouldn't need SMS as a crappy veiled proxy for some human verification. Supposed to pretend like this doesn't just force people to use more phones?
- CPLX 3y agoGeniune question - what’s the actual use case here? It can’t be just you personally logging into various services right?
- whypretend 3y agoMitigating account lockout risk across lots of clients. Separate SIM for each client, having account lockouts are unacceptable. Yes, I've had problems with no recourse.
- costco 3y agohttps://smspva.com/ https://smspva.com/ Immensely useful services like this without which for instance people would not be able to scrape social media services at scale.
- whypretend 3y agoThis service wouldn't be useful to me because the number reputation seems poor. Actual delegation would not rely on pooling numbers for increased user per SIM card. It's one client per SIM card.
- DANmode 3y agoIf it was?
- whypretend 3y ago
- efitz 3y agoBanning devices has not historically been a very effective way to prevent crime. I am not an expert in modern mobile network technology so I’ll do something unusual for HN and refrain from suggesting a solution.
- jpalomaki 3y agoAre operators doing spam filtering for outgoing SMS messages? The messaging patterns must be quite different from normal customers. Maybe you could also detect the suspicious amount of messages originating from certain location (cell).
- Nextgrid 3y ago> Are operators doing spam filtering for outgoing SMS messages? That would require actual engineering skill and effort, not to mention reduce revenue as the spam messages still yield them money.
- tjpnz 3y agoWhat is this going to accomplish given that most scammers aren't operating on UK soil?
- whypretend 3y agoEnsuring that everyone is enslaved by their telco and becoming more dependent on their data collection device (phone) on them at all times and subsequent payment infrastructure used to facilitate etc. Avoiding saying no to telcos. Turning me into a criminal for being the best at helping people with their mundane legitimate businesses.
- greatgib 3y agoBanning "devices for more than four SIM cards"... In my opinion, this is again just an excuse reason for a backdoor law to better control the population. 1984 style Ensuring that they can more easily control the lines that you have. Like that they can make mandatory the used of a registered phone number for online registrations like social accounts and be sure that you will not circumvent blocking by opening new lines. Think about it, if you want to solve the problem that they pretend they want to solve: Each subscriber in UK is registered, so that if you open one or 50 lines, the will know you identity the same. So, if you are a scammer or fraudster, they should already be able to arrest and jail you! But take care, because here they only speak about sim, but it will also probably apply to virtual sims and require that you register all your foreign sim cards that did not use to be declared so far...
- danw1979 3y ago> Today, I have published a Fraud Strategy setting out the government’s ambition to cut fraud by 10% from 2019 levels, down to 3.33 million frauds by the end of 2024. Our current gov taking on these kind of moonshots makes you proud to be British.
- winmoz 3y agoWe can all agree that fraudsters preying on the UK citizens are a bad thing, so the intent of the proposal is sound. What is not s the definition of a SIM farm. Any device with more than 4 SIMS would be outlawed. Don't know if you ever watch live TV or video streams from remote places, like breaking news stories, or sports events or civic events? These are pretty uniformly transmitted from the camera to the production control room via IP-video over bonded cellular. The encoders used can carry more the 16 SIMs. Plus bonded cellular is used t provide data connectivity for a whole range of commercial and public service uses. As it stands the proposal would make these legitimate uses criminal offences.
- deleted 3y ago[deleted]