SIM swapping
A fraud in which an attacker gets the carrier to transfer the victim's number to a card the attacker holds, in order to intercept SMS verification codes and drain the victim's accounts.
SIM swapping consists in persuading a mobile carrier, through social engineering, forged documents or an employee's complicity, to transfer a victim's phone number to a SIM card controlled by the attacker. From then on, every call and message meant for the victim reaches the attacker, including one-time codes sent by SMS to validate a login or a bank transaction. The attack thus bypasses two-factor authentication in its most common form, and is used to take over email accounts, cryptocurrency platforms and bank accounts, or to impersonate an executive. For insurance it has two consequences. It lowers the value of an SMS second factor, which underwriters now distinguish from phishing-resistant methods such as physical keys or apps. And it raises a liability question among the victim, its bank and the carrier, whose verification obligations before any line transfer regulators have begun to strengthen.
The FBI recorded about 1,600 SIM swapping complaints in 2021, with reported losses of about 68 million dollars, compared with about 12 million over the previous three years combined. In November 2023, the US Federal Communications Commission required carriers to authenticate customers before any line transfer.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.