Europol Arrests 26 SIM Swapping Fraudsters For Stealing Over $3 Million

The law enforcement agencies arrested 12 and 14 people in Spain
and Romania, respectively, as part of a joint operation against two
different groups of SIM swappers, Europol said.

The development comes as SIM swapping attacks are emerging as
one of the biggest threats to telecom operators and mobile users
alike. The increasingly popular and damaging hack is a clever
social engineering trick used by cybercriminals to persuade phone
carriers into transferring their victims’ cell services to a SIM
card under their control.

The SIM swap then grants attackers access to incoming phone calls,
text messages, and one-time verification codes (or one-time
passwords) that various websites send via SMS messages as part of
the two-factor authentication (2FA) process.

As a result, a fraudster can impersonate a victim with an online
account provider and request that the service sends account
password-reset links or authentication code to the SIM-swapped
device controlled by the cybercriminals, using which the bad actor
can reset the victim account’s log-in credentials and access the
account without authorization.

The criminal gang in Spain, believed to be part of a hacking
ring, is said to have orchestrated more than 100 such attacks,
stealing between €6,000 ($6,700) and €137,000 ($153,518) from bank
accounts of unsuspecting victims per attack.

In addition to leveraging malicious Trojans to steal victims’
banking credentials, the SIM swappers went on to apply for a
duplicate SIM card by contacting their mobile service providers and
providing fake documents. Upon activation of the duplicate SIMs,
the criminals allegedly made fraudulent transfers from the victims’
accounts using the authentication codes the banks sent to the
phones for confirmation.

The apprehended crime gang in Romania, which managed to steal
over €500,000 ($560,285) from unsuspecting victims in Austria,
employed similar tactics to take over their phones and withdraw
money at cardless ATMs.

This is not the first time law enforcement has tackled the threat.
Last November, two Massachusetts men were arrested for employing
SIM swapping attacks to hijack victims’ social media accounts and
steal more than $550,000 in cryptocurrency.

Although these kinds of attacks are unlikely to go away any time
soon, there are plenty of things consumers can do to keep
themselves safe: set up a PIN to limit access to the SIM card,
delink phone numbers from online accounts, and use an authenticator
app or a security key to secure accounts.

And, if you suspect you’re a victim of SIM swapping, it’s
recommended that you contact your service provider, monitor your
bank accounts for any suspicious transaction, and immediately
change your passwords.