SIM swappers now stealing phone numbers from eSIMs

SIM swappers have adapted their attacks to steal a target's phone number from an eSIM card, a rewritable SIM chip present on many recent smartphone models. Embedded Subscriber Identity Modules (eSIMs) are digital cards stored on the chip of the mobile device and serve the same role and purpose as a physical SIM card but can be remotely reprogrammed and provisioned, deactivated, swapped, deleted. A user can typicall add an eSIM to a device supporting the functionality by scanning a QR code from the service provider. The technology is becoming increasingly popular among smartphone makers because eSIMs eliminate the need for a SIM card slot and can offer cellular connectivity on small wearables. Russian cybersecurity firm F.A.C.C.T. reports that SIM swappers in the country as well as worldwide have been taking advantage of this shift to eSIMs to hijack phone numbers and then bypass protections to access bank accounts. "Since the fall of 2023, analysts from F.A.C.C.T.'s Fraud Protection have recorded more than a hundred attempts to access the personal accounts of clients in online services at just one financial organization," reads the press release. "To steal access to a mobile number, criminals use the function of replacing or restoring a digital SIM card: transferring the phone from the victim's 'sim card' to their own device with an eSIM." To do that, the attackers hijack the user's account for the service provider's platform or app, which allows them to initiate the procedu...