In today’s hyper-connected world, our phones have become essential to managing everything from banking to social media. But with this convenience comes new risks from cybercriminals looking to exploit our mobile devices. Two of the most common and concerning tactics are SIM swapping and phone spoofing. While they might sound like tech jargon, these schemes can have serious real-world consequences. Imagine receiving a call that appears to be from your bank, warning you of suspicious activity on your account. You panic and provide the requested information, only to find out later that the call was a spoofed number, and your account has now been drained. Or picture suddenly losing all service on your phone, only to discover that a hacker has swapped your SIM card and is now intercepting your two-factor authentication codes, locking you out of all your accounts. In this article, we’ll break down what SIM swapping and phone spoofing are, how hackers use them to their advantage, and, most importantly, how you can protect yourself against these threats.

Phone Spoofing

Phone spoofing is a deceptive technique that masks the caller’s true phone number, making it appear as though the call or text is coming from a different number. This caller ID manipulation is commonly used by hackers and scammers to trick recipients into believing that the communication is from a trusted source, such as a bank, government agency, or known individual. The core of phone spoofing lies in altering the caller ID data, which is facilitated by Voice over Internet Protocol (VoIP) services. These services separate the caller ID from the actual phone line, allowing users to set any number they choose as their caller ID. Various tools and services, such as SpoofCard and Caller ID Faker, enable this manipulation, giving users the ability to disguise their identity during calls or text messages.

On a technical level, phone spoofing involves using VoIP systems to modify the caller ID information transmitted during a call. VoIP technology allows calls to be made over the internet rather than traditional telephone lines, making it easier to change the caller ID data. Through VoIP services, users can enter the number or name they want to appear on the recipient’s caller ID, and the service manages the alteration of this data. Advanced spoofing methods may involve exploiting vulnerabilities in telecommunication protocols like the Signaling System №7 (SS7), although such techniques require more sophisticated knowledge and access to telecommunications infrastructure. Similarly, text spoofing operates by manipulating the “sender” field of an SMS message, making it look as though the message is coming from a different number or a specific name. This can be achieved through SMS spoofing services, SMS gateway software, or more advanced hacking methods.

While spoofing can have legitimate uses, such as protecting privacy, it is often associated with malicious intent. Scammers may use spoofed calls and texts in phishing schemes, known as “vishing” and “smishing” respectively, to create a sense of legitimacy and urgency, convincing victims to divulge personal information or make financial transactions. For example, a spoofed phone number appearing to come from an insurance agency may trick a business owner into revealing sensitive financial information, resulting in a significant theft of funds. Or maybe a spoofed text could mimic a message from a trusted contact or organization, leading the recipient to click on a malicious link or respond with sensitive information. Beyond financial gain, spoofing can also be used for harassment or pranks, where the true identity of the sender remains concealed, making it a versatile tool for various types of cybercrime.

SIM Swapping

SIM swapping relies more on social engineering than on technical manipulations. It is a type of attack where a hacker gains control of a victim’s phone number by tricking or bribing a mobile carrier into transferring the number to a SIM card in the hacker’s possession. This allows the attacker to intercept calls and text messages, enable them to bypass two-factor authentication (2FA), and access the victim’s online accounts. The attack typically begins with the hacker impersonating the victim and convincing the mobile carrier to transfer the phone number to a new SIM card. Hackers often gather personal information about the victim through phishing attacks, data breaches, or by scouring social media to make their impersonation more convincing. In some cases, they may even bribe or coerce employees at mobile carriers to perform the SIM swap on their behalf.

Digging deeper into these techniques, they often use social engineering scripts to guide them through conversations with mobile carrier representatives, ensuring they provide the right answers to security questions. Phone spoofing tools may also be used to make it appear as though the hacker is calling from the victim’s number, further convincing the carrier to approve the transfer. Some attackers use SIM card reader/writers to clone or manipulate SIM cards once they have successfully swapped the number. In more sophisticated cases, malware is used to harvest the victim’s personal information or to take control of their devices, making it easier to execute the attack.

These bad actors are motivated to engage in SIM swapping primarily for financial gain. With control of a victim’s phone number, they can often bypass 2FA and reset passwords for online banking accounts, cryptocurrency wallets, and other financial services, allowing them to steal funds directly. Beyond financial theft, SIM swapping is also used for account takeovers, where hackers lock victims out of their social media, email, or other online accounts, often selling these accounts on the dark web. Additionally, SIM swapping can lead to full-blown identity theft, where the hacker opens new accounts in the victim’s name, applies for loans, or commits other forms of fraud. In some cases, SIM swapping is driven by personal vendettas, with hackers using the tactic to harass, embarrass, or disrupt the lives of their targets.

‍

Combining Forces for Maximum Impact

Phone spoofing and SIM swapping are two different tactics used by hackers, but they can be closely tied together, especially in sophisticated attacks aimed at taking over a victim’s online accounts or stealing information. Both methods exploit weaknesses in communication systems and can be used in tandem to maximize the effectiveness of an attack. Let’s take a look at a common example.

A hacker might use phone spoofing as a precursor to a SIM swap attack. By spoofing the victim’s phone number, the attacker can make calls to the victim’s mobile carrier, pretending to be the victim. This makes the social engineering aspect of the SIM swap more convincing, as it appears to the carrier that the call is genuinely coming from the victim’s phone number. After successfully swapping the victim’s SIM card, the hacker now has control over the victim’s phone number. This control allows them to intercept calls and SMS messages, which are often used for 2FA. With access to these messages, the hacker can bypass security measures on the victim’s accounts. For example, they might spoof the victim’s number to contact their bank or other financial institutions, tricking them into providing access to sensitive information. Alternatively, they could use spoofed messages to impersonate the victim and deceive their contacts into divulging further personal information or transferring funds.

Phone spoofing can also help the hacker disguise their identity after a successful SIM swap. By spoofing the victim’s number, they can make it appear as though the victim is still in control of their phone, even while the hacker is using it to access accounts, transfer money, or conduct other malicious activities. This makes it more difficult for the victim or authorities to trace the attack back to the hacker.

When used together, phone spoofing and SIM swapping create a powerful attack strategy. Phone spoofing helps hackers establish credibility and execute the SIM swap, while the SIM swap itself provides control over the victim’s communications, enabling further exploitation. The combination of these techniques allows hackers to bypass traditional security measures like 2FA, gain unauthorized access to accounts, and carry out extensive identity theft or financial fraud.

Protecting Yourself

To protect against SIM swapping, start by enhancing the security of your mobile carrier accounts. Set up PINs or passcodes to add an extra layer of protection, making it more difficult for unauthorized individuals to gain control over your phone number. Be cautious about sharing personal information, such as your phone number, birthdate, or security question answers, as attackers can use this information to impersonate you and bypass carrier security measures.

U.S. regulations and mobile carriers have implemented specific protections against SIM swapping. For example, the FCC requires wireless providers to notify customers of any SIM changes or port-out requests and to offer free account locks or freezes for both pre-paid and post-paid accounts. Make sure to check with your carrier to learn about what their specific protections are, but here are a few examples:

• Verizon: Customers can lock their SIM from the MyVerizon mobile app.
• T-Mobile: Offers Account Takeover Protection to prevent unauthorized port-outs.
• AT&T: SIM-locks devices to prevent them from being used on other networks and you can lock your SIM card with a PIN code.
• Google Fi: Offers Number Lock, an optional feature that prevents users from transferring their number to another phone.

Opt for app-based authentication methods, such as Google Authenticator or Authy, instead of SMS-based two-factor authentication (2FA), which is vulnerable to SIM swaps since attackers can intercept your SMS codes. The most secure 2FA method, however, is to use hardware security keys, such as YubiKeys, on accounts that are compatible with them. This form of 2FA is the only type that cannot be remotely bypassed because it requires the physical key to be inserted into the computer or phone when logging in. While these keys cannot prevent SIM swapping specifically, they will prevent the attackers from accessing your hardware-protected accounts.

Finally, regularly monitor your accounts for any unusual activity, such as unexpected login attempts or changes to your account settings. Set up alerts or notifications to help detect unauthorized access quickly. If you notice anything suspicious, immediately report it to your service provider or financial institution to minimize potential damage.

If you suspect a SIM swap has occurred, act quickly to protect your accounts. Start by contacting your mobile carrier immediately to report the incident and regain control of your phone number. Be prepared to verify your identity with personal information, account-specific passcodes, or security questions. Request that your account be locked, and ask the carrier to place a fraud alert on it. Next, secure your email and other important accounts by changing their passwords and enabling 2FA with the above methods if not already enabled. Notify your banks and financial institutions to monitor for fraud. It’s also important to inform your contacts to prevent them from being targeted by phishing or other fraudulent messages sent from your compromised number. Finally, report the SIM swap to the Federal Trade Commission (FTC) at IdentityTheft.gov, and consider filing a police report if there’s been financial loss.

For phone spoofing, be wary of unsolicited communications. Stay vigilant against phishing attempts that may come through text messages or phone calls, as these can trick you into disclosing personal details or clicking on harmful links. If you believe you may be receiving a spoofed phone call, end the call and independently verify the caller’s identity by contacting the organization or person they claimed to represent using a known and trusted contact method. For example, if the caller claimed to be from your bank, use the official phone number on your bank’s website to reach them. There are also various call-blocking apps, such as Robokiller, that can help filter out potential spam or spoofed calls.

Conclusion

Both SIM swapping and phone spoofing represent significant threats, exploiting different aspects of communication and authentication systems to compromise your personal security. SIM swapping allows attackers to gain control of your phone number and bypass security measures, leading to potential financial theft and identity fraud. On the other hand, phone spoofing involves manipulating caller ID to deceive individuals into sharing sensitive information or falling for scams. While these techniques operate differently, they can be used in conjunction to create a powerful and dangerous attack strategy.

A multi-layered approach to security is the best way to protect yourself from these threats. Strengthen your mobile carrier account with PINs or passcodes, prefer app-based or hardware-based 2FA methods over SMS, and be cautious about sharing personal information online. Regularly monitoring your accounts and staying alert to suspicious communications will help you identify and address these threats early on. A little bit of vigilance and some extra security measures will help you rest-assured that you won’t be falling for these oh-so-common phone scams any time soon.

‍

References

“CLI Spoofing & Robocalling.” Mobileum, Mobileum, 2024, www.mobileum.com/products/risk-management/fraud-management/cli-spoofing-robocalling/.

Fogerlog. “Kroll Employee Falls Victim to Sim Swap, Exposes Crypto Investor Data.” Phishing Tackle, Phishing Tackle Limited, 7 Sept. 2023, phishingtackle.com/articles/kroll-employee-falls-victim-to-sim-swap-exposes-crypto-investor-data/.

“Report Identity Theft and Get a Recovery Plan.” IdentityTheft.Gov, Federal Trade Commission, 2024, www.identitytheft.gov/.

“What Is a Sim Swap?” Yubico, Yubico, 2024, www.yubico.com/resources/glossary/sim-swap/.

About the Authors

Grace Dees is the Cybersecurity Business Analyst at Resonance Security. She specializes in the intersection of traditional and Web3 security by bridging the gap between technology and business objectives to deliver impactful solutions aligned with client needs.

Michał Bazyli is a cybersecurity expert and a member of the Resonance Security team specializing in both Web2 and Web3 cybersecurity.

They are both highly dedicated to enhancing cybersecurity through a holistic approach.