Meet the hackers who trade in stolen Instagram handles and cryptocurrency in a shadowy, bustling underground market for hijacked accounts and usernames. Their victims’ weakness? Their phone numbers.
SIM swapping is a little-known but growing threat. To learn how to keep hackers from stealing your phone number, read our guide on how to protect yourself from these attacks.
It seemed like any other warm September night in the suburbs of Salt Lake City. Rachel Ostlund had just put her kids to bed and was getting ready to go to sleep herself. She was sending a text message to her sister when, unexpectedly, her cell phone lost service. The last message Rachel received was from T-Mobile, her carrier. The SIM card for her phone number had, the message read, been “updated.”
Rachel did what most people would have done in this situation: she turned her phone off and back on again. It didn’t help.
She climbed the stairs and told her husband Adam that her phone wasn’t working. Adam tried calling Rachel’s number from his cell phone. It rang, but the phone in Rachel’s hands didn’t light up. No one answered. Meanwhile, Rachel logged into her email and noticed that someone was resetting the passwords of several of her accounts. An hour later, Adam received a call.
“Put Rachel on the phone,” a voice on the other end of the line demanded. “Now.”
Adam said no and asked what was going on.
“We’re fucking you, we’re raping you, and we’re destroying your life,” the caller said. “If you know what’s good for you, put your wife on the phone.”
Adam refused.
“We’re going to destroy your credit,” the person continued, naming members of Rachel’s and Adam’s families along with their addresses, information the couple believes was obtained from Rachel’s Amazon account. “What would happen if we hurt them? What would happen if we destroyed their credit and then left them a message saying it was because of you?
“We’re fucking you, we’re raping you, and we’re destroying your life.”
The couple didn’t know it yet, but they had just become the latest victims of hackers who hijack phone numbers in order to steal valuable Instagram usernames and sell them for Bitcoin. That night in late summer 2017, the Ostlunds were talking to two of these hackers, who had taken over Rachel’s Instagram account, whose handle was @Rainbow. They were now asking Rachel and Adam to give up her Twitter account @Rainbow.
On the thriving underground market for stolen social media and gaming handles, a short, unique username can go for anywhere from $500 to $5,000, according to people involved in the trade and a review of listings on a popular marketplace. Several hackers involved in the market claimed that the Instagram account @t, for example, recently sold for about $40,000 in Bitcoin.
Has your phone or Instagram been hacked? Tell us your story.You can securely contact this journalist on Signal at +1 917 257 1382, on OTR chat at [email protected], or by email at [email protected].
By hacking Rachel’s phone number, the hackers were able to take over not only her Instagram account, but also her Amazon, eBay, PayPal, Netflix, and Hulu accounts. None of the security measures Rachel had taken to secure some of these accounts, including two-factor authentication, mattered once the hackers gained control of her phone number.
“It was a very tense night,” Adam recalled. “I can’t believe they had the nerve to call us.”
IMAGE: SHUTTERSTOCK
A SIMMERING THREAT
In February, T-Mobile sent a mass text message warning customers about a “sector-wide” threat. According to the company, criminals are increasingly using a technique called “port-out scam” to target and steal people’s phone numbers. The scam, also known as SIM swapping or SIM hijacking , is simple but extremely effective.
First, criminals call a mobile carrier’s technical support number pretending to be their target. They tell the company employee that they have “lost” their SIM card, asking for their phone number to be transferred or ported to a new SIM card that the hackers already possess. With a bit of social engineering – perhaps by providing the victim’s Social Security number or home address (which is often available thanks to one of the many data breaches of recent years) – the criminals convince the employee that they are who they claim to be, at which point the employee transfers the phone number to the new SIM card.
Game over.
“With someone’s phone number,” a hacker who performs SIM swapping explained to me, “you can access every account they own within minutes, and they can’t do anything about it.”
A SCREENSHOT OF THE TEXT MESSAGE RACHEL OSTLUND RECEIVED WHEN HACKERS TOOK OVER HER PHONE NUMBER.
From that point on, the victim loses service, since only one SIM card can be connected to the mobile network with a given number at a time. And hackers can reset the victim’s accounts and often bypass security measures, such as two-factor authentication, by using the phone number as a recovery method.
Some services, including Instagram , require users to provide a phone number when setting up two-factor authentication, a requirement that unexpectedly gives hackers another way into an account. Indeed, if hackers take over a target’s number, they can bypass two-factor authentication and log into their Instagram account without even knowing the account password. ( Check out our guide on protecting your phone number and the accounts linked to it from hackers .)
Eric Taylor, a hacker formerly known as CosmoTheGod , used this technique for some of his most famous exploits, such as the time he hacked the email account of CloudFlare’s CEO in 2012. Taylor, who now works for the security firm Path Network , told me that having a phone number linked to one of your online accounts makes you “vulnerable to 13- to 16-year-olds who take over your accounts simply by grabbing your phone less than five minutes after calling your damn carrier.”
“It happens all the time,” he added.
Have a tip? You can contact this journalist securely on Signal at +1 917 257 1382, via OTR chat at [email protected], or by email at [email protected].
Roel Schouwenberg, director of intelligence and research at the Celsus Advisory Group, has researched issues such as SIM swapping, bypassing two-factor authentication, and the misuse of account recovery mechanisms. In his view, no phone number is completely secure, and consumers need to be aware of this.
“Any type of number can be ported,” Schouwenberg told me. “A determined, well-resourced criminal actor will be able to gain at least temporary access to a number, which is often enough to carry out a heist.”
It’s troubling, because cell phone numbers have become the “master keys” to our entire online identity, as he explained in a blog post last year.
“Most systems are not designed to deal with attackers taking over phone numbers. This is really very serious,” Schouwenberg wrote. “Our phone number has become an almost irrevocable identifier. It was never designed to be one, just as Social Security numbers were never designed to be references. A phone number today provides the key to the kingdom for most services and accounts.”
What hackers do once they control your phone number depends precisely on what they are looking for.
“I take their money and live my life”
If your bike is stolen, you should check Craigslist to see if someone is selling it on the black market. If your Instagram account is stolen through a SIM swap, you should check OGUSERS.
At first glance, OGUSERS looks like any other forum. It has a “spam / joke” section and another for discussing topics such as music, entertainment, anime, and games. But the most important and most active part is the marketplace where users buy and sell gaming and social media handles, sometimes for thousands of dollars.
In a recent post, someone sold the Instagram account @Bitcoin for $20,000, according to one of the forum’s administrators. In a listing still online as of June 13, a user advertised the sale of @eternity on Instagram for $1,000.
These are just two examples of the kind of accounts for sale on OGUSERS. The forum was launched in April 2017 to give people a place to buy and sell “OG” usernames. (The forum takes its name from the slang term OG, short for “original gangster”.) An OG on a social network is a username considered cool, perhaps because it is a single word like @Sex, @Eternity, or @Rainbow. Or perhaps because it is a very short handle, such as @t or @ty. Celebrities have also been targeted.
A SCREENSHOT OF SELENA GOMEZ’S INSTAGRAM ACCOUNT AFTER ITS HACK.
In August of last year, for example, hackers took over Selena Gomez’s Instagram account and posted nude photos of Justin Bieber. The display name on Gomez’s account was also changed to “Islah,” identical to that used at the time by a person affiliated with OGUSERS and using the username Islah. According to hackers on OGUSERS, the people claiming responsibility for the Gomez hack said they did it by taking over the cell phone number linked to the singer-actress’s Instagram account, which had 125 million followers at the time of writing.
“Holy shit, they really hacked the most-followed person on Instagram,” commented a member of OGUSERS in a thread titled “RIP SELENA GOMEZ.”
A spokesperson for Gomez declined to comment by email.
