SIM Hijacking: Why Crypto Users Should Be Wary

It appears that the community of cryptocurrency investors has yet another security vulnerability to contend with. From hacks into wallets to cryptojacking and from ICO thefts to digital exchange flaws, the cryptocurrency space has already developed a reputation for being a risky place to keep money. Now, a report from CCN suggests that there may be a new access point for cryptocurrency thieves looking to swipe digital tokens: cell phones.

The process of SIM hijacking involves nefariously gaining access to a target's cell phone by tricking mobile operators. Hijackers convince a mobile operator to transfer a phone number for the target to a SIM card the hijackers control. Once they have obtained the number, the criminals are then able to reset passwords and access online accounts, including for cryptocurrency exchanges and wallets.

The process has come to light thanks to a sting carried out against a 20-year-old college student in California, according to the report. In July 2018, Joel Ortiz and multiple unspecified accomplices were charged with their participation in SIM hijacking, which netted them more than $5 million worth of bitcoin and other digital tokens. In order to accomplish this theft, Ortiz and his accomplices target approximately 40 cell phones.

Ortiz did not target victims at random. Rather, he took advantage of Consensus 2018, a meeting of leaders in the blockchain and digital currency worlds that took place in May. During that conference, Ortiz is alleged to have stolen more than $1.5 million from a single victim. In the process, Ortiz assumed control of the victim's cell phone number and then reset passwords for accounts including his email address before accessing his digital currency accounts.

Ortiz and his accomplices were caught as a result of a police report by one unnamed victim who claimed that his cell phone number had been targeted. Investigators were then able to identify the phones Ortiz had been using in the hacking process, as well as email accounts. Ortiz allegedly used cryptocurrency exchanges Binance, Bittrex, and Coinbase to complete his thefts.

Fraud in the digital currency world is a constant threat, with thieves continuously adapting their strategies in an attempt to stay ahead of investigators. For the everyday digital currency investor, this news may not mean much; Ortiz and his fellow criminals targeted leaders in the digital currency world with large cryptocurrency holdings. However, there is reason to believe that other criminals could engage in a similar practice as well, targeting new victims. Part of the pushback against SIM hijacking is likely to come from mobile service providers, but cryptocurrency investors can also take steps to prevent these thefts as well. In addition to following standard practices for maintaining digital wallet security, investors should be aware of changes taking place to their non-digital currency accounts as well. Beware of changes to passwords that appear randomly, for instance, and recognize that these may be telltale signs of SIM hijacking.

The FBI released a public service announcement in March 2018 indicating steps that criminals have taken to engage in what it termed "tech support fraud." Specifically, the agency indicated that "criminals pose as virtual currency support. Victims contact fraudulent virtual currency support numbers usually located via open source searches. The fraudulent support asks for access to the victim's virtual currency wallet and transfers the victim's virtual currency to another wallet for temporary holding during maintenance. The virtual currency is never returned to the victim, and the criminal ceases all communication." As this and other related fraud methods suggest, cryptocurrency investors should always be aware of the possibility of impending theft.

Investing in cryptocurrencies and Initial Coin Offerings ("ICOs") is highly risky and speculative, and this article is not a recommendation by Investopedia or the writer to invest in cryptocurrencies or ICOs. Since each individual's situation is unique, a qualified professional should always be consulted before making any financial decisions. Investopedia makes no representations or warranties as to the accuracy or timeliness of the information contained herein. As of the date this article was written, the author owns bitcoin and ripple.