The IT Nerd

The FBI has warned that cyber criminals are impersonating staff at financial institutions to steal money or information in Account Takeover (ATO) fraud schemes. Since January 2025, the FBI Internet Crime Complaint Center (IC3) received more than 5,100 complaints reporting ATO fraud, with losses exceeding $262 million.

Details can be found here: https://www.ic3.gov/PSA/2025/PSA251125

Jim Routh, Chief Trust Officer at Saviynt, commented:

“The large majority of ATO accounts referenced in the FBI announcement occur through compromised credentials used by threat actors intimately familiar with the internal processes and workflows for money movement within financial institutions. The most effective controls to prevent these attacks are manual (phone calls for verification) and SMS messages for approval. The root cause continues to be the accepted use of credentials for cloud accounts despite having passwordless options available.”

If you want to protect yourself from a scam like this, this link will help: Learn about the phony bank investigator scam

 An ongoing phishing campaign impersonating E-ZPass and other toll agencies has surged recently, with recipients receiving multiple iMessage and SMS texts to steal personal and credit card information. This scam is not new, with the FBI warning about it in April 2024, and Highway 407 warning about it it March. 

Commenting on this is James McQuiggan, Security Awareness Advocate at KnowBe4:

“Mobile phishing campaigns are becoming more common, as cybercriminals are impersonating companies like E-ZPass in a very believable way by telling people that they have unpaid tolls. Cybercriminals prey on a person’s heightened emotions to encourage behaviors that can be harmful if acted upon. Whenever a text message seems urgent and arrives unexpectedly, it is important to always remember to verify the validity of the message before taking any requested action. Instead of clicking on the link provided in the text message, instead go to the known valid website of the sender first and double check that the information provided is accurate. Always stop and think before acting, especially if the message seems urgent.”

My advice is if you get one of these texts, don’t click on anything. Then stop, take a pause, and think about it. Keep in mind that it is highly unlikely that you will receive a text like this without you being identified by name. Furthermore, it is also highly unlikely that any organization will reach out to you in this manner. If you do that, it is highly unlikely that you will be victimized.

I was at a wedding in Niagara On The Lake with my wife last weekend when I got a series of iMessages from a client of mine. He first said that his email inbox was being flooded with all sorts of garbage email. As in hundreds of them. He asked if he could stop them from coming in and I texted back discreetly that no he couldn’t and that I would call him later.

Fast forward about two hours and I get another series of iMessages from the same client saying that he got a phone call from one of Canada’s “big three” telcos that his account had an issue and they would have to take his cell phone offline for 24 hours to resolve it. That immediately got my attention as that is not any of Canada’s cell phone providers, “big three” or otherwise behave. Since the actual ceremony was over, I texted a friend who is married to a person who holds a significant position in the telco in question to confirm that I wasn’t delusional. Which that person did. At the same time, I noted that the iMessages were coming from his iCloud account as opposed to his cell phone number. That confirmed that he was the victim of a SIM Swap Attack.

Now I went down the rabbit hole of what a SIM Swap Attack is here. But here’s the TL:DR:

SIM stands for Subscriber Identity Module. That’s telco speak for the chip that goes inside your phone to allow you to get cell phone service. Your cell phone number is associated with that SIM and what the threat actor is going to try and do is to either trick a telco employee into moving your number to a SIM that they control, or have an accomplice inside the telco who will help them move your number to a SIM that they control.

And:

So in short, a SIM swap attack is a means for a threat actor to take control of your number to get access to two factor authentication codes that allow the threat actor to take control of anything from social media accounts, to bank accounts, to crypto wallets. That’s because two factor authentication codes are often sent by text message. And since the threat actor is unlikely to get direct access to your phone, taking over your SIM is the next best option.

I told the client to phone the telco and confirm that they didn’t make the phone call, and then have them take action to regain his phone number and account. Which he did. I also told him to start phoning his banks and credit card companies to try and get ahead of whatever this threat actor was up to, as well as change all his passwords. Which mirrors this advice from the article that I linked to. Now I didn’t have my MacBook Pro with me, so I wasn’t able to investigate this until the next day via a remote session with the client. But my belief was the email issue and the SIM Swap were connected. And it didn’t take long for me to prove that.

What the threat actor had done is used some sort of automated process to sign my client up to hundreds of email based distribution lists. That in turn sent hundreds of emails to my client flood his inbox. Now you’re likely wondering why they would do that. The answer is that they were trying to cover up what they were really up to. Once I cleared out all that “noise”, I found that they were trying to attack his Zoom accounts. Why I do not know. But I also noticed that someone had also applied for a credit card with a $20,000 credit limit with Canadian Tire which is a big retailer in Canada. Finally, the threat actors changed the password on his telco’s online account. I knew that because the notification about the password change showed up via email. I changed his password to a new one and looked through his account because I was thinking that the threat actors might have tried to order a phone to ship it to an address that they could get the phone and ship it elsewhere for resale. Thus I advised him to phone his telco to confirm that this had not happened.

My advice to him at the time was to call Canadian Tire’s financial services and stop that credit card from being issued, and to continue to change password for any and all online accounts. Finally, I advised him to sign up for credit monitoring and report this to the Canadian Anti-Fraud Centre. I then made an appointment with him to see him the next day.

I followed up with him and he had taken the following action:

• Signed up for credit monitoring
• Reported this to the Canadian Anti-Fraud Centre
• Reported this to his bank and credit card company. Of interest, the credit card company cancelled his credit cards and issued new ones. The bank took no action as they didn’t see anything suspicious.
• He had phoned his telco and confirmed that no account changes had been made and nothing had been ordered via his account.
• Interestingly, Canadian Tire Financial Services phoned him to say that someone had tried to sign up to a credit card in one of their stores, and then tried to buy thousands of dollars worth of product. He shut that down immediately. But it implies that the goal of this SIM Swap Attack was identity theft followed by retail theft.

Now while I was there, I helped my client to not only change his banking password as he was having difficulty doing that, but enable push notification based two factor authentication. I did that because a SIM Swap Attack relies on the target having two factor authentication codes coming over text message. If they come via push notification, then a SIM Swap Attack would be totally ineffective as those notifications are not connected to the SIM. In fact, I encourage anyone who reads this to see if you can move any two factor authentication codes to push notifications as a means to mitigate an attack like this should it happen to you.

Now you might be noticing that I am not naming the Canadian telco in question. That’s because after he reported this to the Canadian Anti-Fraud Center, I got a number of calls from them, and then a police agency that I will also not name. In short, this situation is now part of a larger investigation into a SIM Swap gang that seems to be operating inside a couple of provinces in Canada. And the police agency also told me that there might be insiders that work for the telco that he deals with. If that’s true, I’ve seen this before here. And that caught my attention because my first thought was that they might have asked him to provide them with access to his online telco account via the PIN number that gets emailed every time you try to log in or reset the password. But when I looked for that in his email, I did not see any evidence that he received such an email. The only thing that I saw was the email that said that his password was reset. The other odd thing that caught my attention was that he reported that when he got the call from the threat actor pretending to the an employee of the telco in question, the woman at the other end of the line knew him by name and phoned his cell phone directly. Now I have experienced this personally here with a threat actor pretending to be Rogers who knew my wife’s name and who was trying to get me to sign on to a great deal with a free phone. Which I knew to be a scam immediately. So it doesn’t surprise me that this might be the case with the telco in this incident. I do have a follow up with him in the next day or two, so I will see if I can try again to confirm that he played no part in the SIM Swap Attack by providing any information that helped the threat actors.

This is likely not going to be the last that I am writing about this incident. Thus I would suggest that you stay tuned for updates if and when they come. And just to make it clear, there are things that I can’t talk about regarding this, so please understand if I cannot answer all your questions. But if you do have questions, I will answer them as best as I can.

Recently a friend of my wife’s was doomscrolling on her phone and suddenly her phone went into SOS mode. Meaning it had no service. Confused by this she hopped into her car and drove to her local Bell store. The Bell employees had a look and determined that something weird was going on. Specifically her phone number was linked onto a Bell account that had the numbers of 20 other people on it. The Bell employee then went into action to get “the fraud department” involved. But while that was going on, someone was trying to use her credit card to buy some high value items. As in $14,000 worth of items. She would later find out about this when the Bell employee told her to phone her bank to see if her credit cards and bank accounts okay. When she made that call, that’s when she got that bad news. He bank told her that what likely happened was that before the purchase went through, Visa who was the credit card company in question would have sent her phone a two factor authentication code to authorize the purchase. Fortunately for her, her bank seeing clear evidence of fraud reversed the charges. But she had to be issued brand new credit cards and a new bank account to boot.

Welcome to the modern reality of the SIM swap attack.

So let’s go down the rabbit hole of what a SIM swap attack is and why it is one of the most common ways that people get hacked, if you want to call it that. SIM stands for Subscriber Identity Module. That’s telco speak for the chip that goes inside your phone to allow you to get cell phone service. Your cell phone number is associated with that SIM and what the threat actor is going to try and do is to either trick a telco employee into moving your number to a SIM that they control, or have an accomplice inside the telco who will help them move your number to a SIM that they control. This is an example of the latter. And this is an example of a Freedom Mobile customer who fell victim to the former.

And before those of you who might have an eSIM which is an electronic SIM that is sent over the air, or via a QR code, or via an app to a special chip inside your cell phone says that you can’t get pwned in this manner. You can absolutely be pwned in this manner. eSIM’s are simply non-physical SIM’s. The attack method is still the same.

These attacks are either highly targeted, or opportunistic. The former involves the threat actor learning a whole lot about you to not only to figure out if you are a target worth their time, but to know how to quickly take over the accounts that they are interested in. In terms of the latter, I have begun to hear of situations where a target is sent a text message that purports to be a telco, and the victim is sent to a phishing website that gathers enough information about the victim to allow the attack to proceed. Here’s an example of another Freedom Mobile customer who fell for this.

So in short, a SIM swap attack is a means for a threat actor to take control of your number to get access to two factor authentication codes that allow the threat actor to take control of anything from social media accounts, to bank accounts, to crypto wallets. That’s because two factor authentication codes are often sent by text message. And since the threat actor is unlikely to get direct access to your phone, taking over your SIM is the next best option.

The question is, what can you do to protect yourself? Sadly, there’s very little that you can do to stop this from happening. The reality is that telcos need to come up with far better security to stop SIM swap attacks from being executed. The fact that insiders who work for a telco can help to execute a SIM swap, or someone can simply walk into a telco store and execute a SIM swap with enough information about you along with fake ID in most if not all cases reflects poorly on telcos and their ability to protect their customers. Now I’ve highlighted Bell and Freedom Mobile in this story. But all telcos need to step up their game here because they are all not doing enough to stop SIM swaps from happening.

Having said that, you can mitigate the dangers that SIM swaps pose. Instead of using text message based two factor authentication, you can use an app-based authentication program, like Google Authenticator. For another level of security, you can choose to purchase a physical authenticator token, like the YubiKey or Google Titan Key. All of this assumes that the online accounts support these options of course. But by doing any or all of these means that if a SIM swap happens, the threat actors get nothing.

You should also check to see if your online accounts directly support sending authentication codes via an app on your phone. For example my bank allows me to send two factor authentication codes via their app and not via text message. That makes accessing my bank account way more secure because again, a threat actor gets nothing if a SIM swap happens.

Finally, if your telco has the option to add a PIN or personal identification number to your account, do it. And pick one that isn’t associated with anything like a phone number or a license plate number for example. And if possible see if your telco has the option to set your PIN yourself. That way a rogue telco employee can’t use it against you.

So what happens if you are a victim of a SIM swap? As in you notice that your phone is in SOS mode meaning that it has no service. Time is of the essence if you are a victim. This is what you need to do in order:

• First, call your bank and credit card companies and request a freeze on your accounts. This will prevent the attacker from using your funds for fraudulent purchases.
• Try to “get ahead” of the attackers by moving as many accounts as possible to a new, un-tainted email account. Unlink your old phone number, and use strong (and completely new) passwords. For any accounts you’re unable to get to in time, contact customer service.
• Call the police and file a report. This is a crime and it needs to be reported without fail.
• Contact credit bureaus and request a freeze on your credit. Or at least credit monitoring.
• Contact the telco in question, preferably in person and get them to not only reverse the swap, but to investigate how it happened. Though from what I have heard, telcos often don’t want to properly investigate SIM swap incidents. And if they do, they tend not to want to talk about it.

Finally, I should also note that some homeowner’s insurance policies include protection for identity theft. But that only means something if you’ve filed a police report. So you should look into that.

As I mentioned earlier, all telcos need to step up here and make these sorts of attacks less viable. But until telcos take meaningful action on SIM swap attacks, you need to take action to protect yourself from being a victim.

On the eve of Valentine’s Day, researchers at Comparitech, Chainalysis and Bitfender are highlighting the staggering losses to romance baiting or pig butchering observed.

Comparitech estimated that almost 60,000 US romance seekers fell victim to these scams in 2024, resulting in heartbreaking losses of approximately $697 million ($11,616/victim!).

More concerning is an AARP survey that estimated that 4% of Americans have fallen victim to these scams, equating to over 13 million individuals, which is about 3.6% of those officially reported. Researchers estimate the cumulative financial damage from romance scams could exceed $535 billion. 

Chloé Messdaghi, Founder founder of SustainCyber has this comment:

  “These romance scams and pig butchering operations are getting more aggressive and harder to spot. Scammers are weaponizing AI to create fake profiles, deepfake videos, and run chatbot-driven conversations that feel real—they know how to tap into emotions fast. 

   “We can’t keep placing the burden solely on individuals to ‘watch for red flags’ when those flags are increasingly invisible. Platforms need to step up with stronger fraud detection and identity verification, and financial institutions should be doing more to catch suspicious transaction patterns before people lose everything. This is a collective problem that requires a collective response—tech, finance, and policy all need to work together to protect people from being manipulated and financially gutted.”

Since a major part of what I do is scam related, I’ll offer up this story that I did earlier this week. While it’s not the whole solution, it’s a start in terms of protection from these scams.