Since April 2019, there have been more than 300 cases in the UK of attacks in which people try to fraudulently obtain codes that would let them gain control of someone鈥檚 mobile number, the UK鈥檚 data watchdog has revealed in figures that suggest the practice is becoming more common.
The process of SIM-jacking, or SIM-swapping, involves an attacker contacting a person鈥檚 mobile network operator and fraudulently obtaining a porting authorisation code (PAC) enabling them to switch the victim鈥檚 phone number to another phone on a different network.
UK-based food-writer Jack Monroe recently after someone managed to hijack her mobile number.
Advertisement
Figures released under freedom of information rules to 快猫短视频 by the UK Information Commissioner鈥檚 Office (ICO) show that there were 鈥渙ver 300鈥� reports of PAC fraud since the start of April 2019. The watchdog told privacy campaigners last month that there had been 399 cases in total since the start of April 2018, which means most reports have been in the past nine months.
Devastating
鈥淪IM-swap fraud is devastating, as we saw with Jack Monroe. There is the harm. You mustn鈥檛 just think in terms of financial harm, there鈥檚 the anxiety and there鈥檚 the distress this causes, the absolute inconvenience while you鈥檙e without your phone,鈥� says data protection consultant Pat Walshe at Privacy Matters.
It isn鈥檛 clear how many of the 300-plus cases of PAC fraud since April involve SIM-jacking. The ICO says it only identified 11 cases with the term, but says the figure can鈥檛 be taken as reliable because it may have missed variations on the phrase when searching its records.
鈥淲e don鈥檛 know which operators have reported what and we don鈥檛 know whether the fraudulently obtained PACs [number] is in fact SIM-swap fraud. We can only assume it is,鈥� says Walshe.
Figures released by the City of London Police suggest that there is a growing problem. The number of annual PAC fraud reports to the national Action Fraud website and helpline .
Security clearance
SIM-jacking typically works by someone calling up a victim鈥檚 mobile network operator, armed with as much personal information about the person as possible. In Monroe鈥檚 case, for example, her date of birth was available on Wikipedia. The assailant then uses that information to attempt to pass security clearance with the operator in order to have them read out the PAC. That can then be used to port the number onto another SIM, giving the attacker control of the number.
The ICO doesn鈥檛 say how many cases were successful. Attempts by 快猫短视频 staff to mimic the process 鈥� by trying to obtain a PAC for their own number using just their name, mobile number and date of birth 鈥� were rebuffed. One network operator wouldn鈥檛 give out the PAC without the caller reading out a code sent via text to the number to be ported. Another declined to give out a PAC via web chat, and a third wouldn鈥檛 allow the caller to proceed without a postal address.
However, some attempts clearly are succeeding in the UK, as Monroe鈥檚 case demonstrates, and globally, with the technique used to . Mobile numbers have increasingly become the main way for companies and governments to authenticate a person鈥檚 identity, raising the stakes for losing control of the number.
Walshe, who worked for two decades in the mobile industry, says there is insufficient data being collected on the problem. He also says the sector isn鈥檛 doing enough to tackle the issue. One of the solutions he prefers is networks sending a verification text to the original number. He says security checks shouldn鈥檛 be using data that could be gleaned online. 鈥淣o company should be asking for DOB and mother鈥檚 maiden name, [which are often a] matter of public record.鈥�
Trade body Mobile UK said the issue is out of its remit and is a matter for individual networks.
