SIM swap fraud expands

June 2019 News, Cyber Security, Financial (Industry)

During Kaspersky Lab’s annual Cyber Security Weekend that took place in Cape Town, South Africa, Kaspersky Lab experts discussed the widespread growth of mobile payments across the globe and the many cyber risks that surround such technology. Especially the recent SIM swap fraud wave, which has become very common in Africa and the wider region. In South Africa this type of fraud more than doubled in the last year, according to a report (www.securitysa.com/*SABRIC1) from the South African Banking Risk Information Centre (SABRIC).

A SIM swap fraud happens when someone convinces your carrier to switch your phone number over to a SIM card that a criminal possesses. In some cases, there are carrier’s employees working together with criminals. By diverting your incoming SMS messages, scammers can easily complete the text-based two-factor authentication checks that protect your most sensitive accounts in financial services, social networks, webmail services and instant messengers.

Many African countries are suited to mobile payment methods. In fact, research notes that at the end of 2017, there were 135 live mobile money services across the sub-Saharan African region, with 122 million active accounts (www.securitysa.com/*GSMA1). While payment methods through mobiles offer a convenience that is hard to debate, Kaspersky Lab research shows that mobile payments and the banking system are suffering a wave of attack – mostly powered by SIM swap fraud – and people are losing their money as a result.

This type of attack is used to not only steal credentials and capture one-time passwords (OTPs) sent via an SMS, but also to cause financial damage to victims, resetting the accounts on financial services, allowing the fraudsters access to currency accounts not only in banks but also in fintechs and credit unions. Fraudsters are also using it as a way to steal money using WhatsApp, loading the messages in a new phone, contacting the victim’s contacts asking for money, simulating an emergency situation.

“Despite financial inclusion services prospering, the flip side to this is that it opens up a world of opportunities to cybercriminals and fraudsters who are using the convenience a mobile phone offers to exploit and poke holes in two-factor authentication processes. Frauds using SIM swap are becoming common in Africa and Middle East, affecting countries like South Africa, Turkey and UAE. Countries like Mozambique have experienced this firsthand. The implemented solution, by banks and mobile operators in Mozambique, as a result, is something I believe we must learn from and encourage other regions to investigate and apply, among other aspects, to mobile payment methods of the future – as a way to ensure that mobile phones do not become an enemy in our pockets,” said Fabio Assolini, senior security researcher of Kaspersky Lab.

The total money lost in the attacks varies by country: there are extreme cases, such as one in the United Arab Emirates, where one victim lost $1 million, while in South Africa one victim reported losing $20 000. “On average fraudsters can steal $2500 to $3000 per victim, while the cost to perform the SIM swap starts with $10 to $40,” concludes Assolini.

In order to protect the growing mobile digital life and payment methods, Kaspersky Lab recommends the following key considerations:

• Voice and SMS methods avoided as authentication methods for payments – OTPs in mobile apps like Google Authenticator or the use of physical tokens should be used.

• Biometrics – there is no better authentication than that of a physical characteristic. Voice authentication is an option that can be investigated further.

• An automated ‘Your number will be deactivated’ message – to be shared upon SIM swap request. This will support the user to report the activity, if it is not legitimate, faster.

• Activate 2FA on WhatsApp – in an attempt to minimise WhatsApp hijacking, activating two-factor authentication using a six-digit PIN on your device is critical. This supports the user in having an additional layer of security on the device.




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

TAPA: The role of an effective treasury function in business risk management
June 2019, Technews Publishing , News
Neil Le Roux, the Founder of Diligent Advisors will speak at the TAPA SA (Transported Asset Protection Association) annual conference on 26 July 2019.

Read more...
From the editor's desk: Of sore feet and new websites
June 2019, Technews Publishing , News
I hope everyone has recovered from the hustle and bustle of Securex. This year was once again an exhausting event and now we’re left with following up. For Hi-Tech Security Solutions it was a good show ...

Read more...
Where are your crown jewels?
June 2019, Wolfpack Information Risk , Commercial (Industry), Cyber Security, Security Services & Risk Management
Understanding what data they store and analyse is gaining increasing urgency for organisations that are now accountable to new(ish) privacy regulations such as the GDPR and our PoPIA.

Read more...
Axis 7th generation ARTPEC chip
June 2019, Axis Communications SA , Editor's Choice, CCTV, Surveillance & Remote Monitoring, Cyber Security
Axis has launched its 7th generation ARTPEC chip, optimised for network video, to improve all the signature Axis technologies created to address difficult light conditions.

Read more...
Does green cost more?
June 2019 , News, Commercial (Industry)
GBCA, ASAQS and UP launch the 2019 edition of Green Building in South Africa: Guide to Costs & Trends.

Read more...
Partnership to reduce farm violence and agricultural crime
June 2019, Fidelity ADT Security , News, Security Services & Risk Management, Agriculture (Industry)
Agri SA has partnered with Fidelity ADT, a subsidiary of the Fidelity Services Group, to offer a range of services and products to its members and the rural community.

Read more...
The safest way to pay
June 2019 , Security Services & Risk Management, Financial (Industry)
Establishing a relationship of mutual trust between a bank and a customer is crucial. It creates a secure foundation, while giving customers the confidence to engage without security concerns.

Read more...
Centurion announces new board of directors
June 2019, Centurion Systems , News, Access Control & Identity Management
After more than 30 years at the helm of access automation manufacturer, Centurion, co-founder Pat Dickens stepped down as the company’s MD at the end of March, with current sales and marketing director Richard Rohman being named as his successor.

Read more...
Kaspersky Lab to open office in Kigali, Rwanda
June 2019, Kaspersky Lab , News, Cyber Security
Kaspersky Lab has announced plans to open a new office in Kigali, Rwanda, to support the rapid growth of its business in East Africa.

Read more...
Fully automated cash logistics
June 2019 , News, Security Services & Risk Management
Cash management company, Izicash, announced its adoption of Transtrack, a software solution, supported by a South African company, AllCash, which streamlines the cash logistics process.

Read more...