SIM Swap Attack In Nigeria: Beyond Banks, Now A Big Threat To Your Crypto

[EjiukaSpecial]

Earlier this week, a friend of mine lost all the asset on his Bybit wallet through SIM swap attack. It all began when he lost network signal on his phone and assumed it was an issue from the network provider. It happened on Saturday evening and after hours of trying to regain network, he reluctantly switched to using internet connection from his second sim of a different network provider with the hope of going to sort out the issue on Monday since customer service offices doesn't open on Sundays. Unknowingly to him, his number had been maliciously swapped and the hackers had gained access to his email account using the 2FA method he used in linking his email account his phone number. it was from the email that they got all the details they needed to access his Bybit exchange wallet, waited for the default 24 hours delay time after changing the exchange password before wiping everything on his account. Monday morning he wanted to check his email before heading out to go fix the SIM issue before he discovered that his email has been logged out of all his devices, he tried retrieving it but it wasn't working because the email then had a new password, that was when it occurred to him that he was under a serious attack and that the loss of network signal wasn't ordinary, went to the network provider's office, and it was confirmed that his SIM was actually swapped. Then he proceeded to try regain his Bybit account and saw that nothing was left in his balance when he retrieved it as the hackers had wiped off his exchange wallet account.
 
                         Recommended Measures To Keep Your Sim Protected
To reduce the risk of scammers swapping your SIM and stealing your crypto, try and implement the following helpful security measures;
 1. Set Up SIM Lock: This the simplest but most effective measure. How to set it up is to go to the SIM security settings on your phone device and turn on SIM lock. They'll require for pin, if you use MTN, the default pin is 00000 while for Glo and Airtel, it's 0000. After turning it on, modify you pin to something more personal and unique so it can't be randomly  guessed right.
 2. Enable Address Whitelisting & Withdrawal Delays: When address whitelisting and delay withdrawal options are enabled on your exchange, funds can only be sent to the pre-approved wallet addresses and when there's need to make changes, it'll require multi-day delay period.
  3. Use Time-Based One-Time Password(TOTP): Get any of the physical devices that are specifically designed to complement app-based authenticators like Google Authenticator or Authy and link them to your exchange wallets, that way you can use them to authenticate your transactions and when your wallets are compromised, the hackers won't be able to send out funds since they're not in possession with the physical device.
  4. Remove SMS 2FA: Turn off SIM SMS as one of your authentication or recovery options on your important email accounts and crypto exchange accounts.

[Amphenomenon]

SIM as 2FA is something I have quit, there are quite a number of risks that can come through from it.

There are better options but it require much responsibility which we all should be training ourselves to accept even if others are going so extra, at the very least there is more expected than relying on SIM and Email.


When hackers gain access to your mail what level of data will they be getting, this is critical when your password manager and SIM are linked with it.


The fact that the attackers could work silently and your friend didn't even notice these changes earlier is another flaw that we all should be mindful, there's high chance that there are quite a number of notifications he or she failed to see.

[EjiukaSpecial]

The fact that the attackers could work silently and your friend didn't even notice these changes earlier is another flaw that we all should be mindful, there's high chance that there are quite a number of notifications he or she failed to see.

I didn't put the SIM swap hack blame on him but his complacency was just too annoying to ignore. How did you not take action immediately, not even over 24 hours later.
His excuse was that he's had the same network signal issue before and it was later resolved, then I asked him if he wasn't getting notifications on his email when they were attempting to gain access only to be told that he turned off his phone notification because it became too disturbing.
Well, he's learnt his lesson, but I wouldn't want any other person person here to learn it his own way, that was why I created this topic.

[Ashawowo(OS)]

I have 3 questions

• Was the email not logged on his phone?
• Was he not notified via his email of the password reset?
• What actions did he take that aided the sim Swap?

The truth is that SimSwap attack isn't automatic, before it works on your phone, you're prompted to press a number to complete the setup and if you're not careful, you give the scammers access to swap the SIM when you comply.

He has a heavy blame to take, why did he keep all his assets in a CEX in the first place? This is why Having your assets in a non-custodial wallet remains the best.