Chapter 29: SIM Swapping: The Silent Hijack

Imagine the following scenario for a moment: you are sitting in a coffee shop, enjoying a quiet Friday morning. The phone is lying on the table, silent. Suddenly, you notice something strange. Instead of the LTE or 5G signal bars that should appear, the laconic and ominous text appears: "No Service." You turn it off and on again, remove the SIM card and reinsert it, thinking to yourself that it is a local outage of the cellular company. You connect to the coffee shop's Wi-Fi to check if there are reports of a national outage, and find nothing.

What you don't know at that moment is that tens of kilometers away from you, at a busy cellular booth or through a sophisticated phone call to customer support, someone has just "stolen" your digital identity. They didn't steal the physical device; they stole your phone number. Within minutes, the number you use for work, family, and most importantly, for authentication with banks and email accounts, has become the attacker's weapon. This is "SIM Swapping" – one of the quietest, most sophisticated, and most destructive frauds of the modern era.

The following scenario is an educational example based on common fraud patterns. The characters and events are for illustration purposes only.

The Quiet Before the Storm: Eitan's Story

Eitan was what one might call a "conscious user." He worked in software development, had complex passwords for every account, and always made sure to enable "two-factor authentication" (2FA) wherever possible. He felt secure. After all, the bank always sends him an SMS code before any unusual transaction, right?

On Tuesday at 2:15 PM, Eitan's phone stopped receiving signal. Eitan, who was engrossed in writing code, didn't attribute much importance to it. "Probably infrastructure work by the telecom company again," he muttered to himself. Only an hour later, when he tried to make an urgent call and saw that the device was still in "No Service" mode, he began to suspect. He called his cellular company's customer support from a work friend's phone.

"Hello, my phone number isn't working," Eitan told the representative.

"I see here that you requested to replace your SIM card about an hour ago at one of our branches," the representative replied naturally.

Eitan felt a chill. "I didn't request to replace any SIM. Did someone impersonate me?"

"The customer who arrived presented an ID card and answered the identification questions," the representative insisted. "Your old SIM was canceled and the new one was activated."

At that moment, Eitan realized he was in trouble, but he still didn't understand the magnitude of the disaster. He ran to the computer and tried to log into his email account. "Incorrect password," the system informed him. He tried to perform a password recovery via phone – but the code was sent to the attacker's device. He tried to log into his bank account, where he discovered that access was blocked after multiple attempts. When he finally managed to contact the bank's security desk via landline, it turned out that in this scenario the damage had already been done: bank transfers for significant amounts could be made to accounts of "new contacts" added just minutes earlier.

How did this happen? The attacker didn't need Eitan's password. They only needed his phone number. Once the number was under their control, all the security mechanisms Eitan relied on – those SMS codes sent for authentication – became the key that opened all the doors for the attacker.

Anatomy of a Hijack: How Does Your Mobile Change Sides?

To understand SIM swapping fraud, one must understand the critical role of the phone number in our digital identity. The phone number is not just a means of contact; it has become an "identity anchor." Almost every online service – from Facebook and Google to banks and credit card companies – uses the phone number as a means for password recovery or as a second factor for authentication.

SIM Swapping fraud is not a technological hack into your phone. It is "social engineering" directed at a weak link in the chain: the telecom company. The attacker collects information about you from social networks, leaked databases, or through "phishing." They obtain your full name, ID number, date of birth, and sometimes even the last four digits of your credit card.

Equipped with this information, the attacker contacts the cellular company in two main ways:

1. Telephone Impersonation: The attacker calls the service center, claims their SIM was lost or damaged, and goes through the identification process with the representative (which usually relies on the same personal details they obtained). They request to transfer the number to a new SIM card in their possession.
2. Physical Appearance: The attacker arrives at a cellular kiosk, sometimes with a forged ID card bearing the victim's details but with the attacker's photo. The representative at the kiosk, who is sometimes busy or not sufficiently trained in detecting forgeries, performs the replacement on the spot.
3. "Inside Job": In more severe cases, attackers have collaborators within telecom companies – junior employees who receive bribes to perform SIM replacements without any identification process.

Once the operation is performed, the SIM in your device disconnects from the network. It becomes a worthless piece of plastic. At that very moment, the attacker's device becomes "your phone." It starts receiving all SMS messages intended for you, including intercepted authentication codes. From here, the path to taking over email accounts, social media, and bank accounts is short and painful.

The Legal Battle: Liability of Telecom Companies and Banks

Here we enter a legal minefield. Who is responsible for the damage? Is it the client who didn't protect their details? The cellular company that allowed the replacement? Or perhaps the bank that didn't detect that the code was sent to a new SIM card?

In the Israeli legal system, this issue is complex. On one hand, telecom companies claim they provide communication services, not information security services to banks. On the other hand, they hold immense power over our digital identity. The Privacy Protection Law, 5741-1981, and its regulations impose obligations on those who manage databases, but SIM swapping fraud poses new challenges.

When examining the responsibility of the bank, we must recognize the Payment Services Law, 5779-2019. This law regulates liability in cases of "unauthorized use" of payment instruments. In principle, the law tends to protect the client, unless it is proven that the client acted fraudulently or provided the payment instrument or authentication code to another person under circumstances of gross negligence. The fascinating legal question is: Is hacking a SIM considered "providing the authentication code"? The legal analysis may lead to the conclusion that the client provided nothing – the code was stolen from them through the alleged negligence of a third party.

Regarding cellular companies, liability may arise under tort law. A telecom company that allows a SIM replacement without proper identification, or while ignoring warning signs, may be considered negligent in its duty. There is an increasing legal trend to recognize that telecom companies must exercise heightened precautionary measures, as they are aware that the phone number currently serves as the key to the client's digital identity.

However, it is important to emphasize: the possibility of recovering funds depends on the circumstances of the case. Banks and insurance companies may argue that the client was negligent in not protecting their identity details or acted with carelessness that led to the initial data leak. Each case must be examined on its own merits: Did the cellular company act according to Ministry of Communications procedures? Did the bank detect an unusual pattern of activity? Did the client report it immediately upon the line being disconnected?

The Day After: Identity Restoration and Future Protection

If a person falls victim to SIM swapping, time is their greatest enemy. Every passing minute allows the attacker to deepen the penetration. But beyond the immediate actions, the big question arises: how to prevent this in advance?

The great paradox of modern information security is that what is perceived as "strong authentication" – SMS – has become one of the weakest links. Security experts, and I as well throughout my professional years, recommend considering a move from SMS-based authentication to authenticator app-based authentication (like Google Authenticator or Microsoft Authenticator) or using physical security keys. These apps generate the code inside the device itself, and it is not dependent on the cellular network.

In addition, some cellular companies allow adding a "secret code" or an additional password that is required for every account action, including SIM replacement. This is an additional layer of protection that is recommended to consider activating.

From a legal perspective, it is recommended to document the chain of events. Every call with the cellular company, every message from the bank, every failed login attempt. This documentation may serve as a basis for examining future legal options. In a world where our identity is digital, there is a growing expectation from the entities safeguarding the information to act with a high level of care.

Warning Signs: When Should You Be Suspicious?

• Sudden Loss of Signal: The phone shows "No Service" or "Emergency Calls Only" where there is usually excellent reception.
• Strange Text Messages: Receiving an SMS announcing a change in account settings or a request for a SIM replacement that you did not perform.
• Inability to Log Into Accounts: Your email or social media passwords suddenly do not work, even though you haven't changed them.
• Alerts from the Bank: Messages about "adding a new payee" or "performing a transfer" that you are not familiar with.

What to Do Immediately: Emergency Actions

1. Contact the Cellular Company Immediately: Use another phone, arrive physically at the branch, and stop the new SIM. Request to restore the number to your control and inquire about options for locking the account with an additional password.
2. Notify Banks and Credit Cards: You can request a freeze on accounts and credit cards as a precautionary measure.
3. Change Critical Passwords: From a clean and secure computer, change the passwords for your primary email account and enable two-factor authentication that is not based on SMS if possible.
4. File a Police Report: This is a significant step for dealing with financial institutions. It is recommended to keep a confirmation of filing the complaint.
5. Monitor Accounts: Closely track every movement in your accounts and check if further impersonation attempts were made.

Legal Aspect: Summary of Liability

In the case of SIM swapping fraud, liability may be divided between several parties, depending on the circumstances:

• Cellular Company: May be found liable if it is proven that they were negligent in the identification process or failed to act according to the mandatory professional guidelines in this matter.
• Bank / Financial Institution: Subject to the Payment Services Law. In certain circumstances, the financial institution may be required to reimburse funds, unless it is proven that the client acted with gross negligence. In possible scenarios, the parties may consider a settlement after examining the evidence.
• Client: The client is expected to act with reasonable care and report without delay from the moment they discovered their line was disconnected. The level of care and rapid reporting are factors that will be taken into account when examining the division of liability.

In conclusion, SIM swapping illustrates that in the digital world, we must take diverse precautionary measures. It is recommended not to rely on the phone number as a single key for accessing sensitive information and financial accounts.