Is industry inertia keeping SIM-swap fraud alive?

Issue 8 2021 Security Services & Risk Management

SIM-swap fraud has been around for decades and according to the latest SABRIC figures, incidents increased 91% year-on-year when looking at digital banking fraud across all platforms. But why, with all the advancements in technology, are we still dealing with this relatively unsophisticated, but rampant fraud type?

Lincoln Naicker.

Lincoln Naicker, product owner at Entersekt, explores how we could lower our risk to this perennial and costly threat. “The most important thing to recognise is that SIM swaps have a very important part to play in the mobile network industry. Mobile network operators (MNOs) sit at the centre of an extended ecosystem and impact many other sectors, not least of all the financial one. And although there has been a seismic shift in the technology in mobile apps and other digital channels, the SIM has remained fairly unchanged.”

Naicker points out that SIM-swap fraud remains a largely manual process with social engineering at the heart of most of the criminal efforts. Another big problem is that, at the moment, clients will be asked to challenge a SIM swap after the fact, rather than the MNOs proactively reaching out to the client to verify that the SIM-swap request actually came from them before proceeding.

“The US regulator is leading the charge in changing this and is proposing new requirements for phone carriers to authenticate a person’s identity before transferring their number to a new phone. This is timeous because Covid-19 has amplified digital and mobile banking and with over 90% smartphone penetration, we are all beholden to mobile networks for our digital financial lives.”

Naicker says there may need to be better local regulation to effect change, although he is quick to point out that the current method is low-friction and offers MNOs a better customer experience.

“MNOs want to keep the customer experience as smooth as possible. If you put too many roadblocks in the path of the cellphone owner, they may simply migrate to another provider and so the incentive to add additional security layers is not immediately obvious. However, when it comes to reputation, SIM-swap fraud will eventually impact your bottom line,” he warns.

A collective solution may be the answer

Minimising SIM-swap fraud requires a multi-layered solution. Naicker believes that the first issue that needs addressing is how MNOs onboard customers.

“We need greater cooperation between the MNOs when it comes to onboarding. The verification process should be augmented using other technologies such as voice biometrics. If all players could agree on better security at this early stage, we would already have made progress,” he says.

The second piece to the puzzle lies with organisations’ ongoing reliance on SMS one-time passwords (OTPs). Naicker says SMS OTPs are not secure and fraudsters know this.

“We have seen dramatic results at companies where we have helped them remove SMS OTPs as part of their authentication offering. We should remember that the industry rolled out SMS OTPs when we realised that username and passwords were not sufficient. But now we know that SMS OTP should not be used for anything tied to personal or financial information. It’s simply not secure enough,” Naicker states.

He acknowledges that this cannot happen overnight and suggests that, in the shorter term, companies can augment the authentication process with SIM-swap detection technologies or use mobile apps that rely on device integrity.

Finally, Naicker suggests that beyond industry cooperation, our regulators need to look at introducing guidelines and standards that will address SIM-swap fraud at the entry point.

Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

PTT radios keep FM teams connected and safe
Security Services & Risk Management
If facilities management tasks are essential to the organisation’s operations, then a business critical communications system such as a two-way radio network should be considered.

Health and safety compliance online
Security Services & Risk Management
An automated, cloud-based solution that provides a transparent, collaborative workflow platform to eliminate the manual complexities of health and safety document management, contractor management, and any management compliance.

Taking the hard work out of managing a workforce
Security Services & Risk Management
By using integrated employment management services, organisations can turn their full attention to expanding operations by working towards growth goals and future plans.

Ongoing cybersecurity with a click
Technews Publishing Editor's Choice Cyber Security Security Services & Risk Management
Maintain your cybersecurity posture with web services from Pretect designed to keep your IT infrastructure optimally protected 24 x 7.

The Complete Manual on CCTV Management
Technews Publishing Editor's Choice CCTV, Surveillance & Remote Monitoring Security Services & Risk Management
Sonja de Klerk, retired Brigadier from the SAPS Forensic Science Laboratory has written a book on managing your CCTV systems to optimise the value of it as evidence.

Russia/Ukraine war and its effect on financial institutions
Technews Publishing Editor's Choice Security Services & Risk Management Financial (Industry)
ASIS SA’s treasurer, Erica Gibbons, highlights some of the effects financial institutions should look out for as a result of the war between Russia and the Ukraine.

The role of drones in farm protection
Technews Publishing Agriculture (Industry) Security Services & Risk Management
Ending his series on preparing for and preventing farm attacks, Laurence Palmer discusses the role of drones and offers a free security risk assessment template for downloading (link at the end of the article).

AURA and FNB partner to keep customers safe
News Security Services & Risk Management
FNB banking customers can now access instant emergency response services, anywhere, anytime, via the FNB banking app.

Over 50% growth in use of digital documents between 2022 and 2026
Access Control & Identity Management Security Services & Risk Management
The number of users of digital identity documents is expected to exceed 6,5 billion globally in 2026, enabling rapid advances in eGovernment services.

Seven risk drivers in the tech and telecoms sector
Security Services & Risk Management
Jody Yee discusses some of the main drivers behind the top risks facing the sector, as ranked by Allianz Risk Barometer respondents – from the spectre of cybercrime to the acute talent shortage.