SIM swapping fraud driven by blackout myths how criminals compromise mobile accounts

Anatomy of digital hijacking why network loss is a signal of critical threat

A sudden loss of mobile network signal on a smartphone is perceived by most users as a routine technical glitch or the result of maintenance work by the operator. Subscribes usually restart their device or simply wait for coverage to return. However, in today’s environment, this symptom may indicate the beginning of an active phase of cyber hunting called SIM-swapping, or remote theft of SIM cards. While the owner of the gadget believes that their device is temporarily out of reach, criminals at that very moment perform legal and technical seizure of their number to gain full access to personal data.

The main danger lies in the fact that the mobile number today serves as the primary identifier of a person in the digital space. Profiles of state services, e-mail, messengers and, most importantly, mobile banking are linked to it. Having seized control of the card, criminals gain the ability to bypass two-factor authentication and perform any financial transactions on behalf of the victim. The process of complete compromise and withdrawal of funds usually takes from 10 to 15 min, leaving the real owner without the ability to quickly contact the bank or operator due to lack of connection.

How social engineering technology works under the pretext of network modernization

The new wave of cyberattacks in Ukraine is based on the exploitation of sensitive topics related to infrastructure problems and power outages. Scammers use carefully designed social engineering scenarios to minimize the victim’s critical thinking and force them to voluntarily hand over access keys to their account. The whole procedure consists of several sequential stages, each of which is aimed at misleading the user.

• Initial contact and building authority. The attacker calls the subscriber using spoofed numbers or special IP-telephony services. A confident voice introduces himself as a technical support employee of a well-known national mobile operator, such as Kyivstar or Vodafone. To attract attention, the scammer uses professional terminology and refers to planned work on coverage optimization.
• Exploitation of the stability trigger. The victim is informed that due to constant power outages and database failures, their number will be blocked, or they are offered a allegedly unique service – remote switching of the smartphone to a new, upgraded base station. Scammers promise that after this procedure, mobile internet and voice communications will work stably even during a total blackout in the city.
• Interception of authorization code. To complete the migration process to the new tower, the scammer asks the subscriber to confirm their consent. At this moment, a completely legitimate SMS message with a code from the official operator arrives on the victim’s phone. The scammer insists on the need to dictate these numbers to complete device synchronization. As soon as the subscriber calls the password, the current SIM card in their phone is deactivated, and network indicators disappear.

Mechanism of financial depletion after capturing card duplicate

Having received the verification code, scammers through remote self-service platforms or by issuing a virtual eSIM card instantly register a duplicate number on their equipment. From this moment on, all incoming calls, messages and confirmation codes arrive exclusively on the device of criminals. Next, an automated algorithm for hacking financial tools is launched, which does not require knowledge of the user’s original passwords.

Scammers open mobile applications of major banks and initiate a procedure for restoring access by phone number. The financial institution’s security system sends a one-time password to the compromised card, and attackers freely enter the personal account. They instantly change transaction limits, cash out deposits, clear current accounts and completely exhaust available credit limits, transferring funds to shell accounts or cryptocurrency wallets. The estimated financial loss from one such operation can fluctuate within significant limits, often exceeding the equivalent of 2000 USD or even 5000 USD per incident.

Step by step algorithm of legal protection and cybersecurity setup

To minimize risks and completely prevent the implementation of the SIM-swapping scheme, cybersecurity experts and cyberpolice representatives have developed a clear list of preventive actions. Since the technological methods of scammers are constantly improving, protection must be implemented at the level of closing the legal vulnerabilities of the mobile operator itself.

1. Strict ban on remote replacement. The main step is to transfer the number to a contract form of service or register a non-contract number with a passport. This legally secures the right of ownership of the card to a specific individual. After that, any operations with the SIM card (replacement, blocking, recovery) will be performed by the operator only under the condition of a personal visit of the client to the brand store with presentation of a passport or via digital verification.
2. Use of state digital tools. Modern technologies allow passing the identification procedure without visiting the store. In the applications of operators My Kyivstar or Vodafone Ukraine, the function of document sharing through the state portal Diia is integrated. The process takes less than 5 min and instantly blocks the possibility of remote replacement of the card by scammers.
3. Creation of a dedicated financial number. To increase the level of security, it is recommended to separate the daily number for communication and the number to which banking services are linked. The financial number should not be used in advertisements, social networks, for registration on websites or when filling out loyalty forms. Only the owner and the banking institution should know about its existence.

Rules of conduct during suspicious calls

If you receive a call from a person who calls himself a representative of a telecommunications company and starts a conversation about technical problems, cell towers, modernization or the threat of blocking a number, this is a reason for immediate termination of communication. Remember that real operators possess all necessary information about the status of your line inside their billing systems and never, under any circumstances, ask to dictate codes from SMS messages or numbers on the back of the card. If the conversation has already been conducted and the code has been sent, it is necessary to immediately find another phone, contact the bank to block cards and accounts, and then inform the operator about the theft of the SIM card.