SIM Swapping: A Growing Threat to Identity Theft and Financial Security

Close-up of a smartphone with two SIM cards ready for installation. Eric Council has recently entered a guilty plea in the United States District Court for the

A close-up of a smartphone with two SIM cards ready for installation.

Eric Council has pleaded guilty in the United States District Court for the District of Columbia to conspiracy to commit aggravated identity theft. The charges stem from his role in a hacking incident that targeted the X, formerly Twitter, account of the Securities and Exchange Commission (SEC).

The hackers sent false tweets from then-SEC Chairman Gary Gensler's account, falsely stating that the SEC had authorized Bitcoin exchange-traded funds (ETFs). The false tweets caused Bitcoin's price to increase by over $1,000, quickly allowing Council's accomplices to make a profit. However, Gensler quickly announced that the tweets were not real and that the SEC account had been hacked, causing Bitcoin's value to drop by more than $2,000, by which time the damage had been done.

Exchange traded funds operate similarly to mutual funds, offering individuals an easy way to invest in assets such as gold, junk bonds or cryptocurrencies, without purchasing the underlying assets directly. Ironically, the SEC approved 11 Bitcoin exchange-traded funds the day after the incident.

The SEC's X account was protected not only by a username and password, but also by dual factor authentication. This method sends a code to the user's cell phone each time they access the account, ensuring identity verification and protecting against unauthorized access. However, as this case demonstrates, dual factor authentication can be bypassed using a technique known as SIM swapping.

A Subscriber Identity Module, commonly known as a SIM card, is an integrated circuit that stores subscriber information necessary for authentication on mobile devices such as cell phones. SIM cards can be moved between different devices, especially when users upgrade to new phones. SIM swapping is a criminal activity in which an individual convinces a phone carrier to transfer the victim's SIM card to a device controlled by the hacker.

With increasing numbers of financial transactions, including online banking, being conducted via cell phones, identity theft is on the rise. Criminals who gain access to their victims' SIM cards can intercept security verification codes sent via text messages, rendering online banking insecure. This enables identity thieves to drain their victims' bank accounts and cause significant financial distress.

In this case, another conspirator identified the legitimate user associated with the cell phone number used for dual factor authentication of the @SECgov X account and provided Council with the essential personal information, which he used to create a counterfeit ID on his portable printer. With the fake ID in hand, Council visited an AT&T store and successfully convinced an employee to issue a replacement SIM card. He then purchased an iPhone and inserted the new SIM card, facilitating the hack of the @SECGov X account.

Council's sentencing is set for May 16, 2025, where he could face a maximum sentence of five years in prison, a fine of $250,000, and up to three years of supervised release.

To protect against SIM swapping, the most effective measure is to set up a PIN or password for accessing your mobile service provider account. This precaution helps deter a criminal from impersonating you to your carrier and persuading them to transfer your SIM card merely by providing personal information or answering security questions.

AT&T allows users to set up a passcode for their accounts that differs from their online login password. The SIM card cannot be swapped without this passcode.

Verizon permits customers to create a PIN or password for authentication when contacting customer service.

T-Mobile provides the option to set up a passcode, separate from the one used for online account access, which must be used when making account changes like swapping a SIM card. This security measure not only protects against criminals attempting to change the SIM card via a phone call, but also prevents anyone with fraudulent identification from making changes at a T-Mobile location.