Spanish Police Arrest SIM Swappers Who Stole Money from Victims Bank Accounts

Spain’s National Police Agency, the Policía Nacional, said last
week it dismantled an unnamed cybercriminal organization and
arrested eight individuals in connection with a series of SIM
swapping attacks that were carried out with the goal of financial
fraud.

The suspects of the crime ring masqueraded as trustworthy
representatives of banks and other organizations and used
traditional phishing and smishing techniques to obtain personal
information and bank data of victims before draining money from
their accounts.

“They usurped the identity of their victims through the
falsification of official documents and tricked employees of
telephone stores into getting the duplicate of SIM cards, cards
where they received security confirmation messages from banks that
allowed them to empty their victims’ accounts,” the authorities
said^[1].

Seven of the arrests were made in Barcelona and one in Seville.
As many as 12 bank accounts were frozen as part of the illicit
operation. The first known instance of fraud attributed to the gang
is said to have occurred in March 2021.

SIM swapping, also known as SIM hijacking^[2], is a malicious
technique wherein criminal actors target mobile carriers to gain
access to victims’ bank accounts, virtual currency accounts, and
other sensitive information. The SIM swap is often facilitated
through social engineering, insider threat, or phishing
techniques.

The scheme involves an attacker impersonating a victim and
tricking the mobile carrier into switching the victim’s mobile
number to a SIM card under their control. Alternatively, this can
also be achieved by bribing an employee of the mobile carrier or
tricking the employees into downloading malware used to break into
systems and conduct the SIM swaps.

Once the phone numbers are ported, threat actors leverage the
“identity” to perform account resets, bypass SMS-based two-factor
authentication protections, and seize control of the target’s
online accounts.

A spike in SIM swapping fraud

Over the years, SIM swapping has evolved into an increasingly^[3]
prevalent^[4]
form of cybercrime, causing theft to the tune of millions of
dollars from victims’ cryptocurrency wallets and bank accounts. In
November 2021, U.S. prosecutors indicted^[5]
a U.K. national for orchestrating a SIM-swapping attack^[6]
to siphon $784,000 worth of cryptocurrency.

Then in December 2021, a sixth member associated with an
international hacking group known as The Community was sentenced^[7]
in connection with a multimillion-dollar SIM swapping
conspiracy.

The arrests come as the U.S Federal Bureau of Investigation
(FBI) said^[8]
that from January to December 2021, it received 1,611 SIM-swapping
complaints that resulted in adjusted losses of more than $68
million. In comparison, the agency received 320 complaints related
to SIM-swapping incidents from 2018 to 2020, with adjusted losses
of about $12 million.