Using SMS as a part of two-factor authentication is not the safest way to go about it.

I have written many posts in our Tech News about online security recently, but the subject is by no means finished. The need for proper online protection is only increasing, with more and more of our online activities being subjected by cyber criminals to social engineering. Thanks to their more and more sophisticated methods of information gathering it becomes crucial to implement even better methods of protection. One of those methods is implementation of two-factor authentication (2FA).

What is two-factor authentication? It is a security system that requires two different forms of identification to access something. Usually, it requires a password and a unique temporary pin that is provided to you, most commonly, either via text, email, an authenticator app or some kind of electronic device.

This method of protection has been around for many years now, though recent increase in cyber crime made it more necessary than ever. However, it is becoming clear, that with increased sophistication of information mining used by cyber criminals some methods used in pin generation are becoming less and less secure.

Today, I’d like to talk a bit about SMS based two-factor authentication and why it may not be the most secure of all. The main reason for this is SIM swap fraud (also known as simjacking, SIM splitting, SIM hijacking and port-out scamming). It happens when scammers call your cell phone company, posing as you. They convince the company to swap your phone number to a SIM card that the scammers control (security question answers are provided to them via social engineering, phishing emails, malware etc.) Once they have a control of your SIM, they gain access to all the information that is there stored and with that they gain access to your banking, shopping and personal accounts by requesting password resets via text message.

Signs of being a victim of SIM swap fraud:

1) You are unable to place calls or texts.
2) You are notified that your SIM card was activated on another device
3) You are unable to access your accounts (such as bank, credit card accounts etc. – in this case contact your bank immediately!)

Ways of protection:

1) Boost your cellphone account security (assign a strong, difficult to guess password and chose difficult to guess security questions)
2) PIN codes – Education on how phishing emails work
3) Assign one for your communications, if allowed by the carrier
4) Use email or an app for two-factor authentication, whenever possible
5) Bank and mobile carrier alerts for SIM changes, wherever possible
6) Request call backs (some organizations will call customers back to ensure you are the one requesting changes)

In conclusion, SIM swapping is one reason that using your SMS for two-factor authentication is not the most secure solution. There are other ways to tighten security and if you have questions about it, call us!

Everyone does IT, we make IT simple!!