SIM Swap Scam

[JJ All Day]

Sharing these information to the community:

SIM SWAP SCAM involves the following:

Getting the Internet Banking Login Credentials of the Victim

The internet banking login credentials (username and password) of a victim are typically stolen through a phishing attack. Other methods in which these can be attained include pharming, computers in public areas (such as internet cafés) which record sensitive information, keystroke logging software, or malware which provides criminals access to a victim’s computer.

Phishing and pharming are two methods being used by the criminals via the Internet. Their difference is: phishing involves getting a user to enter personal information via a fake website; while, pharming involves modifying DNS entries, which causes users to be directed to the wrong website when they visit a certain web address.

There are mainly two groups of the criminals: one group that uses phishing or other methods which they will personally use to steal money later; and, another group that uses pharming and sold the stolen data to their fellow criminals. While the phishing and the pharming groups/criminals operate in countries across the world, their fellow criminals who eventually steal the money are based in the Philippines.

Duplicating the SIM Card of the Victim

Armed with the victim’s internet banking login credentials which can now access sensitive information like bank accounts, e-mail address and mobile number, a SIM swap is needed before enrolling a third-party account to be used as beneficiary/conduit of fund transfers. [Note: A one-time password sent to the mobile number is used to enroll third-party account.]

The SIM swap can happen if the criminal is able to convince a Telco Agent/Help Desk that he/she is dealing with the owner of the mobile number (after answering customer identification questions or submitting fake ID/s). A new SIM card is then issued to the criminal in replacement of the “lost” one.

The criminal, now introducing him/herself as a Telco Agent, will call the victim (whose cellphone signal suddenly disappeared) that his/her mobile number was erroneously blocked/deactivated; that the Telco is working on it to restore the cellphone signal/reactivate the mobile number in the next 24 to 36 hours.

Linking a Third-Party Account as Beneficiary of Fund Transfers from the Bank Account of the Victim

The criminal will refer to the one-time password (sent to the mobile number with the new SIM card) to enroll third-party account, which, later on, will be used as recipient account of funds to be transferred from the bank account of the victim.

Access of the criminal to third-party/conduit account is either the result of: (1) opening a new bank account using fake IDs and bogus information; (2) skimming an ATM card; or, purchasing an ATM card from a person to whom it belongs (at a price higher than the deposit, of course).

Transferring and Withdrawing the Money

Fund transfers and withdrawals were often transacted shortly before and after midnight (2 days) to maximize, as applicable, the daily fund transfer and withdrawal limits of the accounts for at least two (2) days prior to discovery.

[Walter]

Sharing these information to the community:

SIM SWAP SCAM involves the following:

The criminal, now introducing him/herself as a Telco Agent, will call the victim (whose cellphone signal suddenly disappeared) that his/her mobile number was erroneously blocked/deactivated; that the Telco is working on it to restore the cellphone signal/reactivate the mobile number in the next 24 to 36 hours.

How can the person be contacted when the SIM card is not working anymore? Won't the person notice that the number calling is not a trunkline number?

- - - - - - - - - - - - - - - - - - - - - -

Sharing these information to the community:

SIM SWAP SCAM involves the following:

The criminal, now introducing him/herself as a Telco Agent, will call the victim (whose cellphone signal suddenly disappeared) that his/her mobile number was erroneously blocked/deactivated; that the Telco is working on it to restore the cellphone signal/reactivate the mobile number in the next 24 to 36 hours.

How can the person be contacted when the SIM card is not working anymore? Won't the person notice that the number calling is not a trunkline number?

[JJ All Day]

Good point.

There are reported cases wherein the victim narrated that he/she was contacted at office/land line number; thus, he/she just waited for his/her signal to restore. Only to find out in the end that she was already victimized.

There is also a case wherein before nangyari ang SIM swap, the criminal kept on making calls and sending text messages to the victim; until the latter was irritated and turned off her cellphone.

[kimbon]

Phewww!! hirap talagang kumita ng pera ngayon. dati yung pasa load modus operandi ngayon sim swap naman. kaya ayaw na ayaw kong mag-online transaction using CP o sa laptop as precautions lang.

[kimbon]

How can the person be contacted when the SIM card is not working anymore? Won't the person notice that the number calling is not a trunkline number?

- - - - - - - - - - - - - - - - - - - - - -



How can the person be contacted when the SIM card is not working anymore? Won't the person notice that the number calling is not a trunkline number?

baka naman tinawagan nya muna bago na cut off ang line? I experienced on several occasion someone was calling me without registering his nos in my cp.

- - - - - - - - - - - - - - - - - - - - - -

How can the person be contacted when the SIM card is not working anymore? Won't the person notice that the number calling is not a trunkline number?

- - - - - - - - - - - - - - - - - - - - - -



How can the person be contacted when the SIM card is not working anymore? Won't the person notice that the number calling is not a trunkline number?

baka naman tinawagan nya muna bago na cut off ang line? I experienced on several occasion someone was calling me without registering his nos in my cp.

[dreamur]

Mas mahirap kung un confidential sim mo ang ma-swap and the other guy set up a date with your gf pretending he was you. :D

[dreamur]

....or your wife managed to get a replacement sim for your personal number and your gf is already texting sweet nothings to you wife!

[Juan Martinez]

menage a trois bro? is it immoral? 😯

[dreamur]

menage a trois bro? is it immoral? 😯

Lol bro! 11th commandment shall apply - thou shall deny.

[dreamur]

Lol bro! 11th commandment shall apply - thou shall deny.

Sabi da kabilang thread, depende daw sa culture and location mo un morality.

[JJ All Day]

hahaha di pa din naka get over.

baka ma OT na naman tayo dito =)

[JJ All Day]

Mas mahirap kung un confidential sim mo ang ma-swap and the other guy set up a date with your gf pretending he was you. :D

Confidential sim for GF? Does it mean may regular sim for WIFE? Bwahaha!

[JJ All Day]

....or your wife managed to get a replacement sim for your personal number and your gf is already texting sweet nothings to you wife!

oops! already got answer to my question hehe

[Monseratto]

[_Cathy_]

This is really scary. It is possible for 2 SIMs with the same number to work??? This is one reason why I do not link my mobile to my email accounts.

Also, is there such a thing a mobile phone banking? Maybe it is not safe anymore to provide your mobile number to the bank

[StockEngine]

This is really scary. It is possible for 2 SIMs with the same number to work??? This is one reason why I do not link my mobile to my email accounts.

Also, is there such a thing a mobile phone banking? Maybe it is not safe anymore to provide your mobile number to the bank

These hackers do profiling. Obviously they know which persons to target. They probably hacked a database of a bank or of globe's. They won't waste targeting a person who doesnt have any funds.

[_Cathy_]

These hackers do profiling. Obviously they know which persons to target. They probably hacked a database of a bank or of globe's. They won't waste targeting a person who doesnt have any funds.

So how can users with funds protect themselves. Internet banking is very convenient but maybe it is not safe anymore

I have passbook accounts with no ATMs or mobile notification That is still the safest pa rin.

[jut703]

All my bank accounts are tied up to my phone. They're phone dependent rather than SIM-dependent though.

The only time my accounts will get compromised is if my phone gets stolen, and they figure out my passwords.

Phishing sites are a great risk for those who do online banking through their laptops. But with a phone app, it's quite difficult to mistake the real banking app from a fake one.

As with any new technology, there are always risks. But with the extreme convenience of online banking apps, I can't imagine going back to the olden days where I had to go to a bank just to transfer money to another account, or invest more funds into UITFs, or transfer money to my stocks account.

[_Cathy_]

How is it phone dependent? I get a mobile alert for movements in my bank account.

How do I know if I downloaded the official banking app on play store?

[jut703]

How is it phone dependent? I get a mobile alert for movements in my bank account.

I have to login to my app before I get to do any transactions. Even without my sim, I can log in to my app. Conversely, even if crooks have my sim, but not my login details, they can't access my account. This is with BPI.

For BDO, aside from needing login details, they will also send you an OTP in order to log in. But if you only have an OTP but no login details, you still cant log in.