SIM交换：对身份盗用和金融安全的威胁日益严格

带有两张SIM卡的智能手机的特写，可以安装。埃里克理事会最近在美国地方法院犯有认罪。

A close-up of a smartphone with two SIM cards ready for installation.

智能手机的特写镜头和两张SIM卡准备安装。

Eric Council has pleaded guilty in the United States District Court for the District of Columbia to conspiracy to commit aggravated identity theft. The charges stem from his role in a hacking incident that targeted the X, formerly Twitter, account of the Securities and Exchange Commission (SEC).

埃里克议会在美国地方法院认罪，哥伦比亚特区串谋犯有严重的身份盗用。这些指控源于他在一个针对X（以前是Twitter）证券交易委员会（SEC）的X（以前是Twitter）的黑客事件中的角色。

The hackers sent false tweets from then-SEC Chairman Gary Gensler's account, falsely stating that the SEC had authorized Bitcoin exchange-traded funds (ETFs). The false tweets caused Bitcoin's price to increase by over $1,000, quickly allowing Council's accomplices to make a profit. However, Gensler quickly announced that the tweets were not real and that the SEC account had been hacked, causing Bitcoin's value to drop by more than $2,000, by which time the damage had been done.

黑客从当时的董事长加里·加斯勒（Gary Gensler）的帐户中发送了虚假推文，错误地指出，SEC已授权了由比特币交易所交易的资金（ETF）。虚假的推文导致比特币的价格上涨了1,000美元以上，很快就允许理事会的同伙获利。但是，Gensler迅速宣布这些推文不是真实的，并且SEC帐户已被黑客入侵，导致比特币的价值下降了2,000美元以上，到那时损失了。

Exchange traded funds operate similarly to mutual funds, offering individuals an easy way to invest in assets such as gold, junk bonds or cryptocurrencies, without purchasing the underlying assets directly. Ironically, the SEC approved 11 Bitcoin exchange-traded funds the day after the incident.

交易所交易的基金与共同基金的运营相似，为个人提供了一种简单的方式，可以在不直接购买基础资产的情况下对黄金，垃圾债券或加密货币等资产进行投资。具有讽刺意味的是，事件发生后的第二天，SEC批准了11个比特币交易所交易的资金。

The SEC's X account was protected not only by a username and password, but also by dual factor authentication. This method sends a code to the user's cell phone each time they access the account, ensuring identity verification and protecting against unauthorized access. However, as this case demonstrates, dual factor authentication can be bypassed using a technique known as SIM swapping.

SEC的X帐户不仅受用户名和密码的保护，而且还受双重因素身份验证的保护。此方法每次访问帐户时，都会将代码发送给用户的手机，以确保身份验证并防止未经授权的访问。但是，正如这种情况所证明的那样，可以使用称为模拟交换的技术绕过双重因子身份验证。

A Subscriber Identity Module, commonly known as a SIM card, is an integrated circuit that stores subscriber information necessary for authentication on mobile devices such as cell phones. SIM cards can be moved between different devices, especially when users upgrade to new phones. SIM swapping is a criminal activity in which an individual convinces a phone carrier to transfer the victim's SIM card to a device controlled by the hacker.

订户身份​​模块（通常称为SIM卡）是一个集成电路，可存储在移动设备（例如手机）上进行身份验证所需的订户信息。 SIM卡可以在不同设备之间移动，尤其是当用户升级到新手机时。 SIM交换是一项犯罪活动，其中个人说服电话承运人将受害者的SIM卡转移到由黑客控制的设备上。

With increasing numbers of financial transactions, including online banking, being conducted via cell phones, identity theft is on the rise. Criminals who gain access to their victims' SIM cards can intercept security verification codes sent via text messages, rendering online banking insecure. This enables identity thieves to drain their victims' bank accounts and cause significant financial distress.

随着通过手机进行的包括在线银行在内的金融交易数量越来越多，身份盗用正在上升。访问受害者的SIM卡的罪犯可以拦截通过短信发送的安全验证代码，从而使网上银行业务不安全。这使身份盗贼能够消耗受害者的银行帐户并造成严重的财务困扰。

In this case, another conspirator identified the legitimate user associated with the cell phone number used for dual factor authentication of the @SECgov X account and provided Council with the essential personal information, which he used to create a counterfeit ID on his portable printer. With the fake ID in hand, Council visited an AT&T store and successfully convinced an employee to issue a replacement SIM card. He then purchased an iPhone and inserted the new SIM card, facilitating the hack of the @SECGov X account.

在这种情况下，另一位同谋确定了与用于双重因子二重要验证@Secgov X帐户的手机号码相关的合法用户，并为理事会提供了基本个人信息，他用来在其便携式打印机上创建假冒ID。借助伪造的ID，市议会访问了AT＆T商店，并成功说服了一名员工发行替换SIM卡。然后，他购买了iPhone并插入了新的SIM卡，从而促进了@Secgov X帐户的黑客攻击。

Council's sentencing is set for May 16, 2025, where he could face a maximum sentence of five years in prison, a fine of $250,000, and up to three years of supervised release.

理事会的宣判定于2025年5月16日，他可能面临最高五年徒刑，罚款25万美元，最高三年的监督释放。

To protect against SIM swapping, the most effective measure is to set up a PIN or password for accessing your mobile service provider account. This precaution helps deter a criminal from impersonating you to your carrier and persuading them to transfer your SIM card merely by providing personal information or answering security questions.

为了防止SIM卡交换，最有效的措施是设置用于访问移动服务提供商帐户的PIN或密码。这种预防措施有助于阻止犯罪分子将您冒充您的承运人，并说服他们仅通过提供个人信息或回答安全问题来转移您的SIM卡。

AT&T allows users to set up a passcode for their accounts that differs from their online login password. The SIM card cannot be swapped without this passcode.

AT＆T允许用户为其帐户设置密码，该帐户与其在线登录密码不同。如果没有此密码，就无法交换SIM卡。

Verizon permits customers to create a PIN or password for authentication when contacting customer service.

Verizon允许客户在与客户服务联系时创建PIN或密码以进​​行身份​​验证。

T-Mobile provides the option to set up a passcode, separate from the one used for online account access, which must be used when making account changes like swapping a SIM card. This security measure not only protects against criminals attempting to change the SIM card via a phone call, but also prevents anyone with fraudulent identification from making changes at a T-Mobile location.

T-Mobile提供了设置密码的选项，该密码与用于在线帐户访问的一个密码，在进行帐户更改（例如交换SIM卡）时必须使用。该安全措施不仅可以防止试图通过电话更改SIM卡的罪犯，而且还可以防止任何具有欺诈性识别的人在T-Mobile位置进行更改。