Mobile Porting/Sim Swap

This may happen one of two ways: 

1. Unauthorised Mobile Porting – porting is a legitimate service that allows customers to transfer a mobile number from one telecommunication provider to another. An Unauthorised Port occurs when a criminal contacts a different telephone provider, sets up an account with them and requests to have your number brought over from your current provider. 
2. SIM Swap – the criminal contacts your existing provider and requests to activation of a new SIM card with your number. 

Once a mobile number has been successfully taken over, criminals will receive your text messages, including those containing password resets and verification codes (often referred to two-factor authentication or multi-factor authentication codes). This then gives them access to your existing online accounts, with banking and email accounts being major targets. 

‍

Detection 

A typical indicator of an Unauthorised Port or SIM Swap is an SOS message on your mobile phone, indicating a loss of phone coverage or reception. SOS in this instance means that your network provider is no longer providing service to your device. Other common indicators include being locked out of accounts such as Internet banking, emails, social media, or other services that rely on password reset or verification codes. 

You may also begin to receive emails welcoming you to your new telecommunications provider, or from financial institutions notifying you of updates to your contact details or other account details. Or you may find that you are no longer able to access your email, banking or other online accounts as the passwords have been changed.

Please Note: If you receive a text from your mobile provider (or another telecommunications provider) that your number is about to be ported, respond immediately to the company who have sent the text as you may be able to stop the port. 

‍

Prevention 

• Use multi-factor authentication wherever possible, including using authenticator apps, touch ID, Face ID or biometrics as part of account access requirements.
• Consider downloading your banking App onto your mobile device. Most banking Apps provide the ability to temporarily freeze your accounts and cards.
• Check if your financial institution has multi-factor authentication options that do not rely on using your mobile number for security codes. 
• Make a list of accounts that send text messages to your mobile for security purposes.
• Do not treat your email account as data storage – periodically clean out your emails (inbox/outbox/sent and other folders). A common precursor to an Unauthorised Port or SIM swap is the criminal gaining access to the individual's email account.
• Never provide personal details over the phone to unsolicited callers. 
• Do not click on links in emails or text messages until you verify validity. 

Response 

• Freeze access to your bank accounts via your banking App and call your financial institution(s) immediately to alert them to the risk.
  
• Disable SMS as a password reset or verification code recovery method (or change the contact number) for online accounts. Start with email account. 
• Contact your telecommunication provider and find out if your number has been ported to another provider or if there has been a fraudulent SIM Swap. 
• If the number was ported, request your telecommunication provider submit a ‘reversal of an unauthorised port’. 
• If you experienced a SIM Swap tell your provider to shut down the active SIM and provide you with a replacement SIM, then tighten security as a prevention. 
• Request from the telecommunication provider what credentials were used by the criminal to allow the port or SIM swap to occur.
• Report any fraud that has occurred as a result of the port or SIM swap to the police.

For additional support or information, contact IDCARE by submitting a Get Help Form or call 1800 595 160 (Aus) or 0800 121 068 (NZ).

‍