SIM swap fraud cases force bank to improve security

Two major high street banks will change security procedures after journalists  demonstrated how to carry out SIM swap fraud attacks.

The BBC reported that two major high street banks will adopt new security measures to protect their customers. The decision to modify the security procedures follows the scoop made by two journalists from BBC Radio 4’s You and Yours programme that broke into an account online and removed money.

Cybercriminals are increasingly targeting bank customers with different techniques, one of them is known as ‘SIM swap fraud.’

A SIM swap fraud is a type of fraud that overwhelms the additional security measures introduced by banks to protect customer transactions. Basically cyber criminals are able to transfer cash from a victim’s account by accessing one-time pin codes and SMS notifications.

Criminal organizations obtain a customer’s bank details by launching a phishing campaign, or by purchasing them in the underground market.

At this point, the criminals open a parallel business account with the same victim’s bank, in the customer’s name. This is possible because the procedure involves fewer security checks when the victim is already a customer.

The criminals use answers to security questions obtained from the analysis of the victim’s social media accounts, to contact the victim’s mobile phone provider, posing as the customer, to report that their mobile device is lost or damaged.

They demonstrate their identity, answering basic security questions, this causes the cancellation of the old SIM and the activation of new one. From then the criminals can operate with the victim’s mobile account, intercepting or initiating calls, texts and authorizations that could allow them to transfer cash.

The cybercriminals can also request that security settings are changed to lock out the victim from the account.

Recently bank customers’ accounts have been successfully hacked with the SIM swap fraud technique, several victims reported the crimes to the You and Yours programme.

“You and Yours has been contacted by dozens of people affected by the scam. All say they have never revealed their security details to anyone, and the that first they knew something was wrong was their mobile phone going dead.” reported the BBC.

You and Yours producer Natalie Ms Donovan is a customer of the NatWest and decided to investigate on the SIM swap fraud cases.

She used her bank account as an experiment and her colleague Shari Vahl was able to break into her account without having specific information such as the banking customer number, PIN or any passwords.

“I did not know her mother’s maiden name, her pet’s name or her first school, and yet I was still able to change her PIN and password to lock her out of her own account.” continues Shari Vahl 

In the experiment, the attacker only transferred £1.50 to his bank account by controlling the of Natalie Donovan ‘s mobile phone.

The journalists reported the issue to the NatWest, owned by Royal Bank of Scotland. Representatives from the Royal Bank of Scotland confirmed that that the systems for both banks would be changed as a direct result of the You and Yours investigation.

“This is a cross-industry problem, particularly with us, and the telecom companies. We working with Financial Fraud Action UK to make sure we’re communicating with each other … to make sure mobile phone security is as strong as it possibly can be.” said Chris Popple, managing director of NatWest Digital.

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(Security Affairs – SIM swap fraud, banking)

[adrotate banner=”5″]

[adrotate banner=”13″]