You Don’t Want a “Silver Bullet”! – Enterprise Case to Stopping SIM-swap Frauds

Typically, we imagine in deploying refined know-how to resolve an issue. Nevertheless, the answer may very well lie within the fundamentals, when you’ve got the attention to search for it.

SIM Swap fraud has been costing the monetary ecosystem a big quantity, affecting each customers and monetary establishments. In keeping with the FBI’s IC3 Report, within the US alone, there have been 1,075 reported incidents, leading to losses totaling $48.7 million. Globally, the numbers are staggering, and lots of international locations are nonetheless grappling with this fraud.

SIM-swap fraud emerged within the United Arab Emirates in direction of the top of 2014 and lasted till mid-2018. As one of many main banks, we sadly encountered a few these incidents, leading to substantial losses. The syndicate behind this fraud was well-organized, diligent, and complex. I used to be fairly amazed on the stage of due diligence they performed on their targets. 

We labored intently with regulation enforcement businesses, performed sting operations, and managed to arrest greater than 20 syndicate members, however failed to succeed in the highest layer. This incident will stay one of many handful of instances in my profession the place we weren’t in a position to apprehend the syndicate masterminds.

We fashioned a cross-functional working group with representatives from antifraud, info safety, know-how, enterprise, and operations groups to handle this problem. We evaluated choices to accumulate options together with voice biometrics, bodily tokens to stop such frauds from recurring. Nevertheless, we realized that implementing new know-how would take at the least just a few months, if no more, and we didn’t have that luxurious because the frequency of fraud was excessive. It’s value noting that this was in early 2015, and integrating new applied sciences wasn’t as refined as it’s as we speak. 

Realizing that we didn’t have many choices, we determined to make use of the best-known anti-fraud weapon: discovering methods to make it tougher for these criminals to commit fraud. 

So, how did we strategy it? 

We started by addressing the basics – breaking down the modus operandi layer by layer. 

How Does SIM Swap Fraud Work?

Step 1: The fraudster obtains the checking account quantity and cell variety of the sufferer.

This info will be acquired via phishing, social engineering, the darkish net, or on-line analysis. In some situations info had been obtained from sufferer’s financial institution itself.

Step 2: The fraudster manipulates the sufferer’s cell operator by both impersonating the client or bribing the cell operator workers to problem a reproduction SIM on the client’s quantity.

Step 3: The fraudster positive aspects entry to the sufferer’s telephone quantity, enabling them to reset login credentials for e-mail and on-line banking accounts, together with MFA codes (OTP). Some banks might also require callers to reply primary safety questions, such because the mom’s maiden title, date of beginning, handle, final transaction, or department title, which the fraudster could already possess for resetting on-line banking credentials. 

Step 4: The fraudster now has full entry to the sufferer’s financial institution accounts, enabling them to switch funds, make purchases, or avail different monetary amenities.

After documenting the modus operandi layer by layer, we started exploring the obtainable controls. As a financial institution, stopping the theft of buyer knowledge was past our management. Equally, we had no affect over the telco operators’ due diligence processes or habits when issuing substitute SIM playing cards. In abstract, we didn’t have management over steps 1 or 2.

The exploration course of required us to search for controls in steps 3 and 4, which had been inside the financial institution’s management. We reviewed the knowledge required from prospects for enrolling or resetting the web banking course of. It usually concerned both requesting primary dynamic safety questions or sending MFA codes by way of telephone or e-mail. Fraudsters typically even tricked or bribed financial institution workers into divulging a few of this info. By now, we knew that these controls weren’t efficient, as fraudsters had gained management over them. 

So, we began asking ourselves: what’s one set of data that solely the client would have and that wouldn’t be obtainable in financial institution techniques, social media, emails, or the darkish net? After some brainstorming, we recognized two knowledge units – the CVV quantity behind the cardboard and the Debit Card PIN “PIN”. These two knowledge units had been obtainable within the financial institution’s system solely in encrypted kind. We determined to make use of the PIN as a single piece of knowledge that solely the client would know. CVV numbers, in these days, could possibly be seen by restaurant workers or throughout different purchases.

We started deliberating the professionals and cons of utilizing the PIN and its compliance with PCI and regulatory pointers. After brainstorming and figuring out its suitability, we rapidly moved on to implementation. 

So, what steps did we take subsequent?

We made course of enhancements to the web banking enrollment and resetting course of. Now, each time a buyer was required to enroll or reset their on-line banking credentials, we mandated getting into the PIN on each the Name Middle IVR and On-line Banking platforms. Inside just a few weeks and nearly negligible price, we reengineered the method circulation in our techniques. 

That was it— the frauds stopped! To this present day, no SIM swap incidents have been reported since implementing this variation. 

One could counter-argue: what if the fraudsters socially engineered the PIN from the shoppers? The reply is sure, that’s attainable; nevertheless, there are some things to consider:

Fraudsters are extraordinarily cautious about their Return on Funding (ROI). SIM swap fraud is a high-risk endeavor, they usually usually count on greater rewards. It entails the chance of bodily visiting telco operator premises, acquiring genuine-looking buyer identification paperwork, staff mules, or bribing financial institution or telco workers. Therefore, their targets are principally high-balance accounts, together with each financial institution accounts and wallets. Through the years, we’ve discovered that prospects with substantial account balances could often share financial institution particulars and OTPs throughout social engineering schemes, however they usually chorus from sharing their PIN as a result of perceived danger concerned.

Even when a small share of consumers ended up sharing their PIN, the chance would nonetheless be minimized, as the vast majority of potential victims wouldn’t share their PIN. Furthermore, it provides one other layer to the scheme. Now, the fraudsters would want to compromise at three ranges as an alternative of two: knowledge gathering, compromising the telco operator, and persuading the client as nicely. If prospects sense one thing suspicious, they might grow to be alert, resulting in the fraudsters’ investments being wasted. 

The thought was to make the duty tougher for fraudsters in order that they might transfer on to different establishments which can be simpler to compromise. What might have taken months and even years was addressed inside just a few weeks by simplifying our concentrate on the basics of this fraud scheme.

We shared our secret recipe with the banking fraternity; just a few had been fast to grasp and implement comparable controls, whereas others did it after trial and error and incurring some extra losses.

As well as, as an trade, we labored collectively to implement extra mitigating controls, which took a number of months, however we ended up with the specified outcomes. By the UAE’s banking affiliation, we reached out to Telecom Regulators to mandate the usage of the UAE’s Nationwide ID playing cards for SIM registration and reissuance. The ‘Emirates ID’ is a part of UAE’s Digital Public Infrastructure, outfitted with safety features reminiscent of chips and biometrics. The Telco Regulators understood our argument and supported it by mandating that telco operators should confirm the Emirates ID card utilizing the chip and fingerprint reader options. This mandate was the ultimate nail within the coffin. It took a while for the telcos to mandate biometric verification, however now the substitute SIM issuance course of is hermetic.

Fortunately, SIM swap fraud is not a menace within the UAE because of strong preventive measures throughout the telecom and monetary sectors. 

Right this moment, there are a handful of tech corporations that supply options to stop SIM swap fraud. The above case examine could be a fast win when you’re quick on time and finances. Generally small issues could make an enormous distinction!

Typically, we imagine in deploying refined know-how to resolve an issue. Nevertheless, the answer may very well lie within the fundamentals, when you’ve got the attention to search for it.

SIM Swap fraud has been costing the monetary ecosystem a big quantity, affecting each customers and monetary establishments. In keeping with the FBI’s IC3 Report, within the US alone, there have been 1,075 reported incidents, leading to losses totaling $48.7 million. Globally, the numbers are staggering, and lots of international locations are nonetheless grappling with this fraud.

SIM-swap fraud emerged within the United Arab Emirates in direction of the top of 2014 and lasted till mid-2018. As one of many main banks, we sadly encountered a few these incidents, leading to substantial losses. The syndicate behind this fraud was well-organized, diligent, and complex. I used to be fairly amazed on the stage of due diligence they performed on their targets. 

We labored intently with regulation enforcement businesses, performed sting operations, and managed to arrest greater than 20 syndicate members, however failed to succeed in the highest layer. This incident will stay one of many handful of instances in my profession the place we weren’t in a position to apprehend the syndicate masterminds.

We fashioned a cross-functional working group with representatives from antifraud, info safety, know-how, enterprise, and operations groups to handle this problem. We evaluated choices to accumulate options together with voice biometrics, bodily tokens to stop such frauds from recurring. Nevertheless, we realized that implementing new know-how would take at the least just a few months, if no more, and we didn’t have that luxurious because the frequency of fraud was excessive. It’s value noting that this was in early 2015, and integrating new applied sciences wasn’t as refined as it’s as we speak. 

Realizing that we didn’t have many choices, we determined to make use of the best-known anti-fraud weapon: discovering methods to make it tougher for these criminals to commit fraud. 

So, how did we strategy it? 

We started by addressing the basics – breaking down the modus operandi layer by layer. 

How Does SIM Swap Fraud Work?

Step 1: The fraudster obtains the checking account quantity and cell variety of the sufferer.

This info will be acquired via phishing, social engineering, the darkish net, or on-line analysis. In some situations info had been obtained from sufferer’s financial institution itself.

Step 2: The fraudster manipulates the sufferer’s cell operator by both impersonating the client or bribing the cell operator workers to problem a reproduction SIM on the client’s quantity.

Step 3: The fraudster positive aspects entry to the sufferer’s telephone quantity, enabling them to reset login credentials for e-mail and on-line banking accounts, together with MFA codes (OTP). Some banks might also require callers to reply primary safety questions, such because the mom’s maiden title, date of beginning, handle, final transaction, or department title, which the fraudster could already possess for resetting on-line banking credentials. 

Step 4: The fraudster now has full entry to the sufferer’s financial institution accounts, enabling them to switch funds, make purchases, or avail different monetary amenities.

After documenting the modus operandi layer by layer, we started exploring the obtainable controls. As a financial institution, stopping the theft of buyer knowledge was past our management. Equally, we had no affect over the telco operators’ due diligence processes or habits when issuing substitute SIM playing cards. In abstract, we didn’t have management over steps 1 or 2.

The exploration course of required us to search for controls in steps 3 and 4, which had been inside the financial institution’s management. We reviewed the knowledge required from prospects for enrolling or resetting the web banking course of. It usually concerned both requesting primary dynamic safety questions or sending MFA codes by way of telephone or e-mail. Fraudsters typically even tricked or bribed financial institution workers into divulging a few of this info. By now, we knew that these controls weren’t efficient, as fraudsters had gained management over them. 

So, we began asking ourselves: what’s one set of data that solely the client would have and that wouldn’t be obtainable in financial institution techniques, social media, emails, or the darkish net? After some brainstorming, we recognized two knowledge units – the CVV quantity behind the cardboard and the Debit Card PIN “PIN”. These two knowledge units had been obtainable within the financial institution’s system solely in encrypted kind. We determined to make use of the PIN as a single piece of knowledge that solely the client would know. CVV numbers, in these days, could possibly be seen by restaurant workers or throughout different purchases.

We started deliberating the professionals and cons of utilizing the PIN and its compliance with PCI and regulatory pointers. After brainstorming and figuring out its suitability, we rapidly moved on to implementation. 

So, what steps did we take subsequent?

We made course of enhancements to the web banking enrollment and resetting course of. Now, each time a buyer was required to enroll or reset their on-line banking credentials, we mandated getting into the PIN on each the Name Middle IVR and On-line Banking platforms. Inside just a few weeks and nearly negligible price, we reengineered the method circulation in our techniques. 

That was it— the frauds stopped! To this present day, no SIM swap incidents have been reported since implementing this variation. 

One could counter-argue: what if the fraudsters socially engineered the PIN from the shoppers? The reply is sure, that’s attainable; nevertheless, there are some things to consider:

Fraudsters are extraordinarily cautious about their Return on Funding (ROI). SIM swap fraud is a high-risk endeavor, they usually usually count on greater rewards. It entails the chance of bodily visiting telco operator premises, acquiring genuine-looking buyer identification paperwork, staff mules, or bribing financial institution or telco workers. Therefore, their targets are principally high-balance accounts, together with each financial institution accounts and wallets. Through the years, we’ve discovered that prospects with substantial account balances could often share financial institution particulars and OTPs throughout social engineering schemes, however they usually chorus from sharing their PIN as a result of perceived danger concerned.

Even when a small share of consumers ended up sharing their PIN, the chance would nonetheless be minimized, as the vast majority of potential victims wouldn’t share their PIN. Furthermore, it provides one other layer to the scheme. Now, the fraudsters would want to compromise at three ranges as an alternative of two: knowledge gathering, compromising the telco operator, and persuading the client as nicely. If prospects sense one thing suspicious, they might grow to be alert, resulting in the fraudsters’ investments being wasted. 

The thought was to make the duty tougher for fraudsters in order that they might transfer on to different establishments which can be simpler to compromise. What might have taken months and even years was addressed inside just a few weeks by simplifying our concentrate on the basics of this fraud scheme.

We shared our secret recipe with the banking fraternity; just a few had been fast to grasp and implement comparable controls, whereas others did it after trial and error and incurring some extra losses.

As well as, as an trade, we labored collectively to implement extra mitigating controls, which took a number of months, however we ended up with the specified outcomes. By the UAE’s banking affiliation, we reached out to Telecom Regulators to mandate the usage of the UAE’s Nationwide ID playing cards for SIM registration and reissuance. The ‘Emirates ID’ is a part of UAE’s Digital Public Infrastructure, outfitted with safety features reminiscent of chips and biometrics. The Telco Regulators understood our argument and supported it by mandating that telco operators should confirm the Emirates ID card utilizing the chip and fingerprint reader options. This mandate was the ultimate nail within the coffin. It took a while for the telcos to mandate biometric verification, however now the substitute SIM issuance course of is hermetic.

Fortunately, SIM swap fraud is not a menace within the UAE because of strong preventive measures throughout the telecom and monetary sectors. 

Right this moment, there are a handful of tech corporations that supply options to stop SIM swap fraud. The above case examine could be a fast win when you’re quick on time and finances. Generally small issues could make an enormous distinction!