Here is a guide to help you prevent and protect yourself against the threat of hackers taking control of your phone number in order to break into your online accounts.
Hackers have targeted Instagram users with short or unique usernames, as well as Bitcoin holders. To steal the victim’s accounts or cryptocurrency, hackers first enter the targets’ cell phone numbers, which gives them the ability to reset the passwords of any account associated with a given number.
This type of hack is known as a porting scam – a term derived from the concept of porting a number from one carrier to another – and is also called SIM swapping or SIM hijacking. A hacker who used to swap SIM cards told me that it happened “all the time,” even though telecom providers have been aware of this attack method for years. According to T-Mobile, hundreds of people have been affected by this scam. Over the past few months, Motherboard has spoken with more than 30 victims whose numbers were stolen. In addition to her Instagram account, one SIM swapping victim I spoke with had her Amazon, eBay, PayPal, Netflix and Hulu accounts hacked.
“Our phones are our greatest vulnerability,” she told me.
So what can you do to protect yourself?
Ultimately, this hack relies on scammers deceiving the carrier’s technical support, and if company representatives fall for the trick, it’s important to remember that there is only so much you can do. The good news is that you can make it much harder for hackers to steal your phone number. And, even more importantly, you can take steps to limit the damage in case they manage to steal it anyway.
Here’s how.
STRENGTHEN YOUR ACCOUNT SECURITY
Faced with the growing number of attacks on customer accounts, the major mobile carriers in the United States have introduced new security features designed to make it harder for hackers to take over accounts and phone numbers.
AT&T allows customers to add an authentication code to their accounts. This credential is separate from the password customers use to log into their online accounts. This authentication code will be required to make significant changes to the account, such as transferring the number to another SIM card.
Verizon says every customer must now have a PIN or password as the “primary authentication” method when contacting a call center. This PIN is similar to the authentication code AT&T customers can set up, as it is used when communicating with Verizon’s technical support and provides an extra layer of security.
Last year, T-Mobile began offering a “port validation feature” to protect against these attacks. It is essentially an authentication code, separate from the usual password for accessing the online account, that is required whenever someone attempts to make changes to the account, such as getting a new SIM card. Ask a T-Mobile representative to add this code to your account. This can protect you from a hacker who may pose as you, or from a scammer trying to use a fake identity in a T-Mobile store, since they should still be required to provide the code.
Sprint also offers customers a separate PIN to provide when swapping SIM cards, in addition to the option of answering a security question.
We recommend that you call your provider directly, tell them that you are worried that criminals could take over your phone number, and ask them about all the additional security measures you can take to protect your account.
DO NOT LINK YOUR PHONE NUMBER TO YOUR ONLINE ACCOUNTS
Once hackers steal your phone number, they use it to reset the password of any online account associated with the number. In many cases, this bypasses two-factor authentication. This is why controlling a phone number is so powerful.
If possible, remove your phone number from any account that might interest hackers. You can still associate a phone number with these accounts, but we suggest using a VoIP number, such as a Google Voice number, which is immune to SIM card hacking. Of course, you must also protect this number by using a unique password, two-factor authentication on the account, and making sure it doesn’t expire if you don’t use it regularly.
To remove your phone from your Gmail account, go to myaccount.google.com, sign in (if necessary), then click Personal info & privacy and Personal info. If you have your number listed, remove it. Also make sure you don’t have a phone number listed under Account recovery options. Instead, add an authenticator app such as Google Authenticator for two-factor authentication.
If you really want to have a number, we suggest creating a new Google Voice number – from a different Gmail account, ideally a dedicated one – and using that number. Note that Google Voice is only available in the United States, so anywhere else you will need to try another VoIP service. (Tip: always create and save recovery codes when you enable two-factor authentication .)
To remove your phone from your Microsoft account, go to account.live.com, access Security, then click Update info under Update your security info. If you have a phone number, remove it, unless it is a Google Voice number or another VoIP number.
If you use an Apple device, go to appleid.apple.com, sign in, then click Edit next to the Security section. Add your Google Voice or VoIP number as a trusted phone number, then remove your usual phone number, if applicable. For iMessage and FaceTime, you still need to provide your actual mobile number, but you can use a different one as your trusted phone number.
On Twitter, click your avatar, go to Settings and privacy, then go to Mobile in the menu on the right. If you have enabled two-factor authentication, you will need to provide a number. For this reason, we suggest providing a VoIP or Google Voice number so that hackers cannot swap it out. It is also possible to simply use an authenticator app or a security key and completely remove your number from Twitter’s phone settings.
The situation is similar for Instagram: from the mobile app, tap your avatar, then Edit profile, and replace your number with a VoIP or Google Voice number. Unlike Twitter, it is not possible to completely remove your phone number from Instagram without disabling two-factor authentication.
For Facebook, select Settings under the drop-down arrow at the top right. First, click Mobile in the menu on the right and remove your phone number. Now add your Google Voice or another VoIP number. Then go to Security and Login (also in the menu on the right), click Edit next to the Use two-factor authentication option, and make sure your new VoIP or Google Voice number is present.
Finally, for Amazon, click Accounts & Lists, then Your Account. Next, click Login & Security, enter your password and check whether your number is listed there. If it is, you know the drill: replace it with your VoIP or Google Voice number.
We suggest doing the same for PayPal, eBay, Netflix and other similar accounts, as well as for your bank of choice.
