Freezing Your Mobile Account

Everyone has (or is at least assumed to have) a mobile phone these days. And since our mobile phones are directly associated with us, our phones are often used as a stand-in for us when our identity needs to be verified. This is usually done via a text message, but sometimes with a phone call. Note also that when you call a service provider for support, your phone number is often used to identify you, too. They can see what number you’re calling from, and if it matches the number on your account, that is often enough to access the system – and your information.

The significance of this hasn’t been lost on the bad guys. If they can somehow take over your mobile account, they can pretend to be you and gain access to many of your accounts. For example, if they can guess your password or bypass the password authentication step, they can use a cloned phone to receive your two-factor authorization (2FA) code.

With this ability, they can try to reset the passwords on any other account that uses text messaging for the 2FA codes. Which is why I recommend avoiding this method whenever you can – use an authenticator app instead. This attack is referred to as SIM swapping or sometimes SIM jacking – and in recent years, the use of this technique to commit fraud has gone through the roof.

Recognizing Account Takeover

We’re going to focus on how to prevent SIM swapping, but let’s quickly talk about how you might know if your account has been hijacked. If you suspect your mobile account has been compromised, you should try to recover it immediately. The bad guys will be trying to take over as many of your other accounts as they can until you regain control. Your best bet is to call your carrier’s support line. If you’re put on hold, try locking your account while you wait (see below).

There are a few common ways your account might be taken over, but the most popular methods involve convincing, coercing or even bribing an employee at the mobile operator to authorize a “port out” operation. It may be as simple as convincing your carrier that your old device was lost or stolen and you need to enable your number on the new phone you just bought.

However someone manages to pull off a SIM swapping attack, the attacker will have transferred your mobile number to a new device – one that they control. As soon as this transfer occurs, the cellular features of your device will stop working. Evidence of this will include things like:

• Your phone suddenly has no cell service, possibly in “SOS” or “Emergency calls only” mode
• You can no longer send or receive SMS messages (though messaging apps may still work on WiFi)
• You can no longer make or receive voice calls (though video/voice apps may still work on WiFi)
• You may have gotten an email, text message or pop-up indicating a new device is in use
• If they are attempting to take over other accounts, you may be getting emails about password changes or two-factor authentications that you didn’t initiate.

Locking Your Mobile Account

In the past, mobile carriers implemented PIN codes on your account that are supposed to prevent SIM swaps and port-outs. I wrote about them here. This is still a good idea to turn on, I think. It’s a less restrictive version than the newer account lock feature. From what I’ve read, it sounds like this account PIN is only enforced by the employees – they’re supposed to ask you for it before making major changes. But they’re also free to skip this step.

The newer account lock feature is more like freezing your credit. If you enable this, it prevents anyone from making changes to your account – even the provider’s employees, supposedly. I’d have to bet that there must still be some way to recover your account from the provider side, but it may require a lot more effort or a much more senior employee.

Anyway, if you enable this account lock, it should not only prevent SIM swapping or porting your number to a new device, but it will also prevent adding or removing authorized users from your account, adding a new line, upgrading a device, or changing billing information.

You can get instructions for these US carriers here: AT&T, Verizon, and T-Mobile. If you’re outside the US or use a different carrier, try doing a web search for “(carrier) SIM lock” or “(carrier) account lock”.