FBI warns of criminals escalating SIM swap attacks to steal millions

The Federal Bureau of Investigation (FBI) says criminals have escalated SIM swap attacks to steal millions by hijacking victims’ phone numbers.

The number of complaints received from the US public since 2018 and reported losses have increased almost fivefold, according to reports received by the FBI through the Internet Crime Complaint Center (IC3) in 2021.

FBI’s warning comes after the US Federal Communications Commission (FCC) announced in October that it started working on rules that would pull the brake on SIM swapping attacks.

The FCC’s move is the result of numerous complaints received from consumers regarding significant distress and financial harm as a result of SIM swapping attacks and port-out fraud.

“The Federal Bureau of Investigation is issuing this announcement to inform mobile carriers and the public of the increasing use of Subscriber Identity Module (SIM) swapping by criminals to steal money from fiat and virtual currency accounts,” the FBI warned.

“From January 2018 to December 2020, the FBI Internet Crime Complaint Center (IC3) received 320 complaints related to SIM swapping incidents with adjusted losses of approximately $12 million. In 2021, IC3 received 1,611 SIM swapping complaints with adjusted losses of more than $68 million.”

The federal law enforcement agency issued another SIM swapping alert three years ago, in March 2019, following an increase in SIM hijacking incidents.

SIM swapping attacks behind millions in losses

SIM swap fraud (also known as SIM hijacking, SIM jacking, or SIM splitting) is a type of account takeover (ATO) fraud that allows scammers to take control of their victims ‘phone numbers.

The crooks do this by tricking phone service providers into swapping a target’s phone number to attacker-controlled SIM cards either by using social engineering or with the help of one or more bribed employees.

After the SIM is ported, the criminals will receive the victims’ calls and messages, making it very simple to bypass SMS-based MFA, steal credentials, and take control of their victims’ online service accounts.

The vast majority of SIM swappers are financially motivated and usually target their victims’ online banking and cryptocurrency exchange accounts to steal money and virtual assets, as well as lock the victims out of their accounts by changing the passwords.

In March 2020, Europol announced it apprehended suspects part of two criminal gangs who stole millions in a streak of SIM swapping attacks.

A network of SIM swappers dismantled at the beginning of 2021 is also believed to have stolen over $100 million worth of cryptocurrency from thousands of victims, including US celebrities.

Last year, US telecommunications provider T-Mobile disclosed a data breach after hundreds of customers were targeted and impacted in a series of SIM swap attacks. In August, T-Mobile said hackers breached its servers, stealing 54 million individuals’ data.

Because such attacks are so profitable for criminals, they’ve also attracted the attention of organized crime, as shown by Europol announcing that an extensive network of cybercriminals with links to the Italian Mafia engaged in SIM swapping attacks that brought them more than €10 million.

The FBI also shared tips on Tuesday regarding how individuals can protect themselves and how mobile carriers can defend their customers from such attacks, as well as info on how to report SIM swapping incidents.