Protecting against SIM swap fraud

[GraemeR]

There are numerous instances these days of SIM Swap fraud.  In addition to setting a PIN code to unlock the SIM card, what else can we do to prevent scammers from persuading SMARTY that a SIM has been lost or damaged and handing over a new SIM to them?

[Linsey]

Hey @GraemeR 

SMARTY asks different security questions when they get in touch with the team. If the questions are answered correctly, then we must accept that the person is the account holder.

To help keep your account safe, here are some friendly tips:

• Choose a strong and unique password for your SMARTY account, and avoid using it for other accounts.
• Stay vigilant against phishing scams. Scammers often send fake emails and messages to try to get personal information. Remember, never share your account details or codes.
• Keep an eye out for any sudden changes to your mobile service, like account suspension, as it could be a sign of a replacement SIM request.

If you ever request a replacement SIM, your services will be temporarily suspended as a security precaution. So if you notice your services have been suspended unexpectedly, don’t hesitate to reach out to our team for clarity.

We’re here to help you sort it out and take the right steps to keep your account secure.

Contact us - FAQ | SMARTY

[GraemeR]

Thanks for the reply. How soon are services suspended after the phoney request? Would I get an e mail (which I could view on my tablet or laptop) within minutes confirming that a SIM swap had been requested ?

[MSF]

@GraemeR The service is suspended after a request for a replacement sim - you would notice the phone not working in that case.

This is different from a PAC code being requested and sent to a new network.

[CharlyA_1208171]

It all sounds very passive - this is not really much protection, it relies on me noticing within a couple of days my SIM is not working, I don't always use my phone for calls each day.
I was expecting that Smarty would provide some security such as allowing a user to add a PIN or separate password which would be required for any future SIM card swap request, and if they are not provided by the requestor then Smarty would require a more extensive proof of SIM ownership such as writing to the registered address and leaving the service inactive until SIM ownership had been confirmed.

[MSF]

@CharlyA_1208171 But surely the scumbags would need to have accessed your account with your email and password before they could request a replacement sim. It would then be sent to your registered address.

[CharlyA_1208171]

From a security view point (I've worked in IT and systems security for decades) it is wise to have multiple layers. Look at it this way, we know that sometimes people's emails are compromised, so Smarty relying on emails not being compromised as the base of the security of the SIM is a risk.