PISIM hijacking is not a new technique in a cybercriminal’s toolbox. In fact, BlackCloak wrote about the topic only a few years ago. Since we last talked about SIM hijacking, however, the number of reported instances of the cybercrime has noticeably risen.

In early February, the FBI issued a warning about the increased number of SIM hijacking attacks. Such attacks are increasingly used to steal money from victims’ digital wallets and virtual currency accounts, according to the alert. 

To put the rise of SIM hijacking into perspective, the FBI’s Internet Crime Complaint Center (IC3) received just 320 SIM hijacking complaints from Jan. 2018 to Dec. 2020, with financial losses totaling around $12 million. In 2021 alone, the IC3 received 1,611 SIM hijacking complaints, accounting for more than $68 million in financial losses.

What is SIM hijacking?

SIM hijacking occurs when cybercriminals take control of the SIM card controlling a victim’s phone number. Cybercriminals have two primary methods to perform such an attack. First, they can social engineer a mobile provider support representative and request the targeted phone number be transferred to a SIM card under their control. 

Another common attack method is to hack into a victim’s mobile carrier account and do a phone number “port.” This moves the phone number from the victim’s account to the attacker’s mobile account of their choosing.  

Once the mobile phone number is in an adversary’s possession, cybercriminals can route calls and texts to devices that they control. This can give them access to email accounts, bank accounts, and cryptocurrency accounts to reset passwords and reroute two-factor authentication codes.

Hackers can access cryptocurrency accounts quickly

Let’s say a cybercriminal has successfully hijacked your SIM card and gained complete control over your phone number. Next, they would need to compromise the email that your crypto account is tied to. This is low hanging fruit for most cybercriminals. Email credentials are frequently publicly available, can be obtained via a data breach, or captured in a phishing scheme. 

Even as more and more people are at heightened alert for malicious emails, over 90% of all cyber attacks begin with email phishing. Compromising crypto wallets is no different. Hackers need to commandeer your account credentials to reset the password to your cryptocurrency accounts.

The entire process can be completed in a matter of minutes. Digital currency can quickly begin to flow into their own wallets. 

Why hackers target cryptocurrencies

Cryptocurrency is decentralized, meaning no one entity has authority over the currency. This can be beneficial when anonymity is warranted, but it is problematic when online fraud and theft comes into play.

When cryptocurrency is stolen, victims have almost no recourse to get their money back. Since cryptocurrency lacks a centralized authority, victims are frequently left on their own to recover their stolen money. 

And the numbers bear it out. All of these factors have resulted in a sharp increase in cryptocurrency theft. A report from Chainalysis found cybercriminals stole $3.2 billion in cryptocurrencies last year, a five-fold increase from 2020.

But there may be help on the horizon. The FBI is launching a “virtual asset exploitation” unit to combat crypto-related crimes, and the agency has been able to successfully recover cryptocurrencies paid out in ransomware attacks. While it may take some time, it looks like there is legitimate progress in handling stolen cryptocurrencies.

What you can reduce your risk of SIM hijacking

The FBI recommends individuals avoid posting about their financial assets online and to never provide mobile number account information over the phone to anyone asking for a password or PIN. 

In addition to the FBI’s advice, BlackCloak recommends users avoid linking any crypto accounts to their personal phone numbers. If you have already done so, remove your phone number as soon as possible.

To limit your risk of falling victim to a SIM hijacking attack, start by protecting your mobile provider account. Make sure the password you use is account is long and complex. It should include capital letters, numbers and symbols and does not contain any common phrases. Do not reuse any passwords you have in place for other services. It is highly recommended to set a PIN for your mobile provider and to use an authenticator app for two-factor authentication.

You can also protect yourself if your phone is stolen. BlackCloak advises our clients to use a SIM PIN, a four-digit code that helps prevent an unauthorized person from accessing your SIM card. When a SIM PIN is activated, a prompt will appear for the code whenever a device is restarted, or a SIM card with a PIN attached is inserted, for the first time. 

For example, if a cybercriminal were to take the SIM card out of a victim’s device and place it into one they controlled, the SIM PIN would block them from accessing it. SIM PINs are an effective way to prevent unauthorized users from compromising your digital currency accounts. It would also stop them from accessing any other sensitive information.

Should you find yourself as a potential victim of SIM hijacking, the FBI recommends contacting your mobile carrier immediately, as well as your financial institution to place an alert on your accounts. 

Be sure to also learn about the additional ways you can protect your phone number from theft, as it will likely always be a data point cybercriminals will have in their sights.