How to Secure Your SIM Card Against Hackers and Fraudsters

You need to be truly concerned about your mobile phone security. Especially when it comes to how to secure your SIM card against hackers. It goes beyond updating your smartphone apps and operating system, or even physical phone security measures. In fact, the biggest threat to your mobile phone lies in how to secure your SIM card against hackers and fraudsters. 

Why? Because your SIM card is a valuable repository of sensitive private information. Your SIM card is a gateway that connects to your online accounts, bank accounts, and other sensitive personal data. Worse still, a hacked SIM card gives illegal access to hackers to monitor your calls and text messages. They could easily use the information they glean from your calls and messages to blackmail, scam or harm you. Your entire contact list are also at risk.

These are enough reasons to secure your SIM card against hackers before they rob you blind or take over you all-too-important valuables linked to your phone number.

Your SIM card Could be Hacked in these 3 Ways

We will explain three major ways in which hackers and scammers gain access to your SIM card and connected devices. Understanding these SIM hacking methods is important in helping you to secure your SIM card against hackers with the urgency it deserves. 

SIM Card Swapping

A very common method of hacking SIM cards is by dubious SIM card swapping (or SIM jacking). Here, the hacker uses trickery and social engineering to take over an unsuspecting owner’s mobile number. He/she does so by calling the victim’s mobile service provider, pretending to be the user himself/herself. The hacker could request for a replacement SIM card with a false back story on needing to upgrade to a new device.

In some cases, the hacker may be in possession of a new SIM card right inside his/her hideout; he/she only needs to convince the mobile provider’s employee(s) to transfer the phone number. He/she would likely supply the victim’s contacts or personal information to convince the mobile service provider’s employee to transfer that phone number to a new SIM card.

Such personal information are usually obtained freely from information exposed on social media, or harvested from suspicious websites where they were carelessly dropped.

And if it works, the victim’s current SIM card will be blocked instantly, cutting him/her off from all phone services, private data, email and social media accounts. And very unfortunately, any requests for a two-factor authentication sent to your mobile number (after attempting to log in to a site with your password) goes directly into the hacker’s falsified SIM.

Thus he/she uses it to access the victim’s online and bank accounts to rob them, and even scam their close contacts and family pretending to be the victim.

SIM Cloning

SIM cloning requires that the hacker has direct physical access to the victim’s SIM card. The target SIM card must be physically removed from the owner’s smartphone by whatever means. And then the hacker clones or copies the unique identifier number on the original SIM card into another blank SIM card. That is accomplished with the aid of a smart card copying software. 

Once the hacker inserts the copied SIM card into his/her smartphone, the victim’s SIM card is rendered useless. And the phone number is gone into possession of the hacker. Thus the hacker now has access into the former phone number owner’s messages, calls, online accounts, bank accounts, and two-factor authentication codes. The hacker may even use his/her victim’s identity and information to scam others. 

Simjacker Attack

The Simjacker attack makes use of a security vulnerability which was not intended to be dangerous from the beginning. It targets the SIMalliance Toolbox browser (also called S@T browser) which is part of the SIM Application Toolkit (STK). STK is used by many mobile phone providers on SIM cards.

The S@T browser is a basic browser that has been in existence for a long time. It was used by phone service providers to access and interact with web applications such as email services. But the popularity of modern web browsers such as Firefox and Google Chrome led many smartphone users to abandon the S@T browser. Nevertheless, this basic browser is still installed on most smartphones and digital devices.

Unfortunately, the Simjacker takes control of the S@T browser (and subsequently the victim’s SIM card) by sending a text message containing a spyware-like code to users. Once a user opens and reads the text message, the spyware-like code takes residence in their phones. It proceeds to monitor and record the phone owner’s calls, messages and physical location data.

The vulnerability was exposed by the US company, AdaptiveMobile Security in 2019. The company further warned that the S@T protocol has been in use by several mobile operators in at least 30 countries spread all over Eastern Europe, North Africa, Asia and the Middle East. Over One Billion people and their devices are at risk, including Android, iPhone, and embedded SIM card phones.

What can Hackers Do with Your SIM Card?

• They can monitor your location using GPS tracking. Because location services require your SIM card to connect to a wireless network and send GPS data needed by certain apps.
• Scammers would easily access your two-factor authentication codes. Thus, they use it to open your online accounts and perform further robbery.
• Hackers and scammers can use your stolen phone number to impersonate you. They proceed to send text messages, make phone calls and interact with social media accounts pretending to be you. And obviously to deceive others into falling victim, who would hold you responsible for any damages until proven wrong.
• Hackers use your stolen phone number to monitor your phone calls and messages. Any sensitive information they obtain through such means will be used to blackmail, scam, or endanger the victim. He/she could even post harmful information about the victim on the internet – an act called ‘doxxing’. 
• Your entire contacts list is exposed to these scammers. Thus, they can embark on targeting your friends and loved ones in order to scam them pretending to be you.
• Your cloud backup storage and all the sensitive information on it can be easily downloaded by hackers in possession of your stolen phone number. That includes your special documents, videos, and pictures.
• Your bank, investment, and crypto accounts are accessible to scammers with a hacked SIM card. They can use SMS authentication codes to access the victim’s financial accounts. They can even reset passwords. The money in such accounts may be emptied within the blink of an eye. 

Is Your SIM Card Hacked? Signs to Watch out For

• You may get notifications to restart your phone. Especially when your smartphone detects that another phone is using the SIM card assigned to it.
• Your phone may stop working. Once your phone number is stolen, your SIM card can no longer access any phone services from your mobile service provider. No more calls, SMS or internet connection. 
• Your phone or SIM card can no longer receive two-factor authentication codes. Because the new device using your phone number now receives the 2FA codes. 
• You are being locked out of your online accounts.
• Your phone or device may report a strange location different from the actual one.
• Unfamiliar messages and numbers may start showing up in your email box, SMS app and phone call history. 
• New apps you did not solicit for may appear on your phone.
• Your data and call bills may become unusually higher than before. 

7 Ways to Secure Your SIM Card Against Hackers  

• Perform a SIM lock on your phone/device. This is totally different from locking your phone with a code, face ID or fingerprint ID. This would require that you know the security PIN given to you by your mobile service provider.

SIM lock can be done as follows:

👉Android: Go to Settings > Lock screen and security > Other security settings > Set up SIM card lock. Switch on the toggle button for the option Lock SIM card. 

👉iPhone: Go to Settings > Cellular > SIM PIN. Enter your existing PIN to confirm, and it will be turned on. 

👉iPad: Go to Settings > Mobile data > SIM PIN. Enter your existing PIN. Then it will be activated. 

• Secure your account with your mobile phone provider by creating a PIN (if such a service is available)
• Use other two-factor authentication methods like the Google Authentication app, in place of the usual 2FA sent to your mobile number. 
• Install a reliable antivirus app on your smartphone. 
• Reduce the amount of personal information you divulge to others online, particularly on social media. You are the best guardian of your privacy. 
• Be serious about physical phone security as well. Keep a close watch over your phone. And ensure it is screen-locked with a strong security code or biometric code (facial, fingerprint, voice or other such codes). Finally, set the screen lock time (auto lock) to the shortest period of time for safety reasons. Just in case your phone gets stolen or lost, a scammer may find it hard to unlock your device to do as he/she pleases within that short time frame.
• Watch out for any suspicious activity surrounding your bank accounts, online accounts, crypto accounts, credit and debit cards. It may come in the form of unknown users or devices attempting to log into any of your accounts, or change the settings. 

Author: Omolola Akinyemi