This is why it's best to avoid signing up on exchanges using phone number

[Floxynice]

Sorry this happened to your family. There is something for  us to learn from this experience. Scam is getting so advance now that we can hardly tell when we are dealing with scammers. We all should always verify before sending money to anyone, even if the person is a close family member. I have received similar messages from impersonators, but once I request for video calls or even audio calls, they run away. When dealing with anyone on the internet, all your senses need to be active.

[Coyster]

I don't quite follow this sim swapping thing, never heard of it to be honest. Is sim swap and sim clone same or similar?

At here, the majority of the users still uses physical sims, that needs to be actively present, inserted into the phone for to work. There is no swapping process through the internet afaik. And even if I wanted to change sim's ownership or replace or change the operator, anything at all, I still need to be physically present at the customer care to do so. I guess I'm somewhat saved then?!

An attacker does not need to get a hold of your sim card to perform a sim swap attack. All they need to have is enough information about you, with which to convince the mobile operator to transfer your mobile number to the sim card in their possession. If they are able to do that, your own sim card immediately loses service and they can now intercept your messages and carry out other criminal activities, like identity theft and the rest.

[hopenotlate]

Generally speaking I think everyone should avoid every services requiring our personal details, not only phone numbers, our real names and real addresses amd email addresses ( even worse if matched with phone numbers) are avidly sought after on the market for both legal and illegal purposes: hackers, dishonest employees, and shady services take advantage of these informations and sell it on every available market.

I realize that avoiding KYCed services closes us off to a whole host of options, but what perhaps isn't clear to many is that accessing these services involves very high risks, and the potential damage from identity theft makes it, in my opinion, not worth the risk.

How is it even possible not to give out personal details when almost everything we do online that relates to money requires undergoing KYC documentation. So far as KYC is mandatory on centralized exchanges, it is unavoidable for our personal details not to get exposed. We should just be very careful and verify information thoroughly before taking any actions. What we should just do is to find services that has strong security protocol so that our data and personal details do not get compromised and become vulnerable to scammers.

That is my point, I started avoiding centralized exchanges as soon as I understood the risk I was incurring into,  too late by the way I should have started way earlier safeguarding my privacy.

Luckily in crypto there are nowadays options to do basically everything you do on CEX by using DEX services, included leverage trading : there arethere are risks of another nature, such as hacks, and there there is the need of a bit deeper knowledge involved but the efforts are worth the risk imo.

[DYING_S0UL]

An attacker does not need to get a hold of your sim card to perform a sim swap attack. All they need to have is enough information about you, with which to convince the mobile operator to transfer your mobile number to the sim card in their possession. If they are able to do that, your own sim card immediately loses service and they can now intercept your messages and carry out other criminal activities, like identity theft and the rest.

Thank you for explaning the process, got it now. But in my opinion, such process should not exiest. The owner should be present for this swap thing to happen. Because this online process seems kinda exploitable to me, I understand there may be 2FA and other security involved to ensure everything is in order, but still...risk remains...

FYI, we don't have it here, we have to be present physically. I have already made a response on another thread and don't want to repeat it again, so I'm linking it here.

[pliego]

An attacker does not need to get a hold of your sim card to perform a sim swap attack. All they need to have is enough information about you, with which to convince the mobile operator to transfer your mobile number to the sim card in their possession. If they are able to do that, your own sim card immediately loses service and they can now intercept your messages and carry out other criminal activities, like identity theft and the rest.

Thank you for explaning the process, got it now. But in my opinion, such process should not exiest. The owner should be present for this swap thing to happen. Because this online process seems kinda exploitable to me, I understand there may be 2FA and other security involved to ensure everything is in order, but still...risk remains...

FYI, we don't have it here, we have to be present physically. I have already made a response on another thread and don't want to repeat it again, so I'm linking it here.

Physical presence makes way more sense imo. Online-only swaps are just too exploitable, no matter how much 2FA they add. One leaked detail and it’s game over

[tvplus006]

...I personally believe that a SIM swap scheme is going on here, the attacker gained access to her phone number and started messaging on group chat, everyone believed her to be her because it's her phone number, she started acting very weird saying she needed help that something happened at work and she needs money urgently...

This is some kind of ridiculous story. Did no one come up with the idea of calling aunt before sending money to the account specified in the group? I think that you have learned a good lesson, paid for with your money, and you will not make such mistakes in the future.

[lornadane]

This is a classic example of social engineering + SIM swap, and you handled it well by verifying through a second number. Once attackers control a number, they exploit trust, not tech. Urgency + emotional pressure is their main weapon. Everyone in the family should now treat any money request as suspicious until verified by voice or video call.

[Peanutswar]

This is one of the common rights now even in my country tons of hackers are using the number came from the banks and even e-wallets and they send an SMS about the rewards unclaimed balances points and etc. just to lure their next victim. And in that case seems they got compromised with the number and seek for help about sending money at the first place its already skeptical if you are kind person possible you will give immediately but if you are concious person out of no where they are seeking for money, one of the best thing to do is to verify if its legit came from the person such as calling them and if they arent the one answer it its probably a scam.

Generally speaking I think everyone should avoid every services requiring our personal details, not only phone numbers, our real names and real addresses amd email addresses ( even worse if matched with phone numbers) are avidly sought after on the market for both legal and illegal purposes: hackers, dishonest employees, and shady services take advantage of these informations and sell it on every available market.

I realize that avoiding KYCed services closes us off to a whole host of options, but what perhaps isn't clear to many is that accessing these services involves very high risks, and the potential damage from identity theft makes it, in my opinion, not worth the risk.

Actually its the best thing but most of them required right now to use your personal information to uses their platform unless you will use a spare phone number but sooner or later they will seek an advance KYC if they will doubt about your information. So there's no safe information right now reason why peple prefered too a No KYC platforms. 

[pawanjain]

My family members was targeted yesterday through WhatsApp group, a group that's opened for family related discussion, this was possible because my aunt phone number got compromised, the only explanation she was able to come up with is Crypto.com, she said she has been receiving spam messages after she used her phone number to sign up on crypto.com.

I personally believe that a SIM swap scheme is going on here, the attacker gained access to her phone number and started messaging on group chat, everyone believed her to be her because it's her phone number, she started acting very weird saying she needed help that something happened at work and she needs money urgently.

Before I was able to be the alarm raiser my mother's two sisters already sent money to this fraudster, the account sent money to is an online bank account, and she asked me for USDT, I almost fell for it because my aunt knew that I was into crypto trading and investing but with the way she texted I knew it wasn't her.

I kept asking how the attacker knew that I am into crypto, that's when I make up my mind that this is a sim swap attack, every past messages I had with her will be revealed to the attacker.

I called my aunt second number to verify and she was shocked, she doesn't even know that something like that was going on, I ran back to the group to stop others from sending money, but it was too late, she lost some money she left on Binance exchange and luckily her bank account was running on the second phone.

This shows us why we need two phone numbers. One for banking and payments and the other for regular contact.
This eliminates the possible risks of such scenarios and keeps us one step ahead of the hackers.
These days it has become easier for hackers to get personal info from social media accounts and impersonate them to complete the sim swap process.
Its in our best interest not to give our personal details anywhere on the internet and use a fake alias in case we need to.

[Lucius]

~snip~
When such attacks come, we can face with physical damages, even lose our lives, so if we can prevent it, why don't secure our privacy better. Privacy maters and is very important, it's never too late to live a private life.

It's actually not that easy to get your privacy back if you've been exposing yourself to the public for a long time. Especially if you use social networks that collect all data and save it even when you delete your profile, and other users download your content and forward it on. Once you let the genie out of the bottle, it's almost impossible to put it back in.

~snip~
Didn’t know some countries require physical presence, that’s actually solid. Would stop a huge chunk of SIM swap attacks instantly. Sadly, most providers won’t change unless forced

Physical presence means nothing if the company's policy is not to establish beyond a reasonable doubt that the person standing in front of them is actually the owner of the lost/stolen SIM. A few years ago I needed a new SIM and went to the branch with my old SIM and ID card, they didn't ask me for anything except to tell them the phone number I needed a replacement for.

[nakamura12]

The possibility of getting attacked by sim swap is possible if the person is not very careful so using phone number to create an exchange account is not recommended. I'd rather use an email because if you are using the phone number for daily use then there's a chance that you might lose more money as the person behind the swim swap might have known you have other accounts that has funds. As others have said, it's better to use email just to be safe.

[Faisal2202]

I don't quite follow this sim swapping thing, never heard of it to be honest. Is sim swap and sim clone same or similar?

 At here, the majority of the users still uses physical sims, that needs to be actively present, inserted into the phone for to work. There is no swapping process through the internet afaik. And even if I wanted to change sim's ownership or replace or change the operator, anything at all, I still need to be physically present at the customer care to do so. I guess I'm somewhat saved then?!

Sim swap and sim clone is not the same thing, in Sim swap a person (scammer) pretends to be the real owner and tries to get new sim on the same number remotely by the operators (company), I also got confused at first because here in Pakistan we have to visit their branch and even have to confirm our fingerprints and then they give us the sim but in USA and UK some operators allow this method to be remotely.

Most of the cases so far has been recorded in USA. I once used a sim of my friend in spain, he got back to hometown, his sim was swapped by someone else not a scam, he did not claimed it later. I am saying it was not a scam because he said it is allowed there if you don't renew your sim then it can be given to others. I know it does not add up but I had to beleive him I hope he is not lying haha. As he is my best friend so I did no dug more about it.

Sim cloning is not like sim swapping, it is like making a clone of the real sim and maybe it works simultaneously like with the real sim until the operator catches the clone one but I beleive it is more technical than sim swapping.

[salad daging]

Generally speaking I think everyone should avoid every services requiring our personal details, not only phone numbers, our real names and real addresses amd email addresses ( even worse if matched with phone numbers) are avidly sought after on the market for both legal and illegal purposes: hackers, dishonest employees, and shady services take advantage of these informations and sell it on every available market.

I realize that avoiding KYCed services closes us off to a whole host of options, but what perhaps isn't clear to many is that accessing these services involves very high risks, and the potential damage from identity theft makes it, in my opinion, not worth the risk.

Now that almost all exchanges have mandatory KYC where you have to submit real data for verification so that KYC passes can be approved by the exchange, there is no other way to be anonymous in today's exchange times, there is no way but to use Dex.

To register on the exchange never use a phone number but all use email so at least the phone number is still safe not published to other parties, actually there are also some exchanges that require entering a phone number.

[qwertyup23]

Generally speaking I think everyone should avoid every services requiring our personal details, not only phone numbers, our real names and real addresses amd email addresses ( even worse if matched with phone numbers) are avidly sought after on the market for both legal and illegal purposes: hackers, dishonest employees, and shady services take advantage of these informations and sell it on every available market.

I realize that avoiding KYCed services closes us off to a whole host of options, but what perhaps isn't clear to many is that accessing these services involves very high risks, and the potential damage from identity theft makes it, in my opinion, not worth the risk.

There are both advantages and disadvantages of choosing a KYC-regulated exchange or website compared to the opposite. However, it is generally recommended to AVOID surrendering your personal information and details to platforms that are not that established and well-known.

To give you a concrete example, some gambling websites mandate a submission of KYC documents in order to use their service. Whereas a not-so-established gambling website may offer tons of rewards and privileges on their platform but they are relatively new on the industry which puts the player also at risk in the process.

Sorry this happened to your family. There is something for  us to learn from this experience. Scam is getting so advance now that we can hardly tell when we are dealing with scammers. We all should always verify before sending money to anyone, even if the person is a close family member. I have received similar messages from impersonators, but once I request for video calls or even audio calls, they run away. When dealing with anyone on the internet, all your senses need to be active.

As time passes by, technology becomes innovative and scammers also adapt.

Unfortunately, this had to happened to you OP but I do think that remaining vigilant in the crypto space is still the best advice to avoid scams. If you really think that an offer is to good to be true; or if some random website asks for your KYC documents, then that should spark a red flag for you to avoid.