Washington ranks 6th in US for SIM card swapping scam

There is another kind of scam out there that targets your information — by getting the information off your phone’s SIM card. And unfortunately, according to stats from the FBI’s Seattle Division, Washington is the sixth-highest state in the nation for reports of SIM-swapping.

SIM cards are the little cards in the backs of our cell phones that we all likely forget about unless we take the backs of our phones off. They may be tiny, but the cards hold a treasure trove of data.

Nationwide phone scam sends texts about fake COVID-19 stimulus payment

“There’s a lot of information on your SIM card itself, … such as your text messages, all of the mobile data that’s going back and forth for the service provider, … a lot of your contact information, a lot of your passwords,” said L.T. Chu, senior supervisory intelligence analyst for the FBI Seattle Division. “A lot of information could be stored on a very, very small chip.”

Once criminals have that data, they can steal your identity and get into your accounts.

Criminals get access to people’s SIM cards by hacking cell phone companies — through phishing emails, for example — and stealing customers’ information.

If your SIM card has been compromised, you will notice some clues, Chu said. Very quickly, your phone will stop functioning properly; you will not be able to get on the internet or make calls. If that happens, contact your cell phone company to see if there is a problem they can explain. If there is not, then report the crime to your local FBI field office and ic3.gov. Change your passwords, and contact your bank to let them know your accounts have been compromised.

The good news is that there are ways you can make sure that if someone does hack your phone service provider, you will not be as much of a target because your information is not out there.

“If you’re getting cold-called for information such as passwords or PINs from someone claiming to be a mobile service provider, certainly don’t give that information out,” Chu said.

If that happens, hang up immediately and call your cell phone company.

“Most mobile service providers, if not all, will never ask for that information without a reason,” Chu said. “So they won’t cold-call you; you would have to call them.”

Never post personal data online, such as phone numbers, addresses, or information about buying cryptocurrency. Also, be careful of “fun” quizzes on social media that ask you for seemingly harmless personal information such as the name of your first pet or the first concert you attended; these kinds of questions can also serve as security questions for accessing bank accounts.

Use biometric multifactor authentication for your accounts if possible, such as a fingerprint or face scan. Text message authentication can be used by a criminal who gets access to your phone, but something attached to you cannot be replicated.

Do not use the same password for each site. It can be hard to remember many different passwords, so Chu suggests using a password bank.

“It may sound counterintuitive, where if that one password account or bank is compromised, then all your accounts are compromised,” Chu said. “But if you use strong multifactor authentication, … it’s a lot better than using the same weak passwords for multiple accounts.”

Follow @NicoleKIROFM