07 December 2021

As SIM-swap fraud continues to skyrocket, Lincoln Naicker, product owner at Entersekt looks at how businesses can lower their risk and protect customers.

SIM-swap fraud has been around for decades and according to the latest SABRIC figures, SIM-swap incidents increased 91% year-on-year when looking at digital banking fraud across all platforms. But why, with all the advancements in technology, are we still dealing with this relatively unsophisticated, but rampant fraud type? How could we lower our risk to this perennial and costly threat?

SIM-swap fraud continues to grow. Some international reports show close to 100 percent year-on-year growth, and South Africa is seeing the same trend. The most important thing to recognise is that SIM swaps have a very important part to play in the mobile network industry. Mobile Network Operators (MNOs) sit at the centre of an extended ecosystem and impacts many other sectors, not least of all the financial one. And, although there has been a seismic shift in the technology in mobile apps and other digital channels, the SIM has remained fairly unchanged.

SIM-swap fraud remains a largely manual process with social engineering at the heart of most of the criminal efforts. Another big problem is that, at the moment, clients will be asked to challenge a SIM swap after the fact, rather than the MNOs proactively reaching out to the client to verify that the SIM-swap request actually came from them before proceeding.

The US regulator is leading the charge in changing this and is proposing new requirements for phone carriers to authenticate a person’s identity before transferring their number to a new phone. This is timeous because Covid-19 has amplified digital and mobile banking and with over 90 percent smartphone penetration, we are all beholden to mobile networks for our digital financial lives.

There may need to be better local regulation to effect change, although the current method is low-friction and offers MNOs a better customer experience.
MNOs want to keep the customer experience as smooth as possible. If you put too many roadblocks in the path of the cellphone owner, they may simply migrate to another provider and so the incentive to add additional security layers is not immediately obvious. However, when it comes to reputation, SIM-swap fraud will eventually impact your bottom line.

A collective solution may be the answer
Minimising SIM-swap fraud requires a multi-layered solution. The first issue that needs addressing is how MNOs onboard customers.

We need greater cooperation between the MNOs when it comes to onboarding. The verification process should be augmented using other technologies such as voice biometrics. If all players could agree on better security at this early stage, we would already have made progress.

The second piece to the puzzle lies with organisations’ ongoing reliance on SMS one-time passwords (OTPs). SMS OTPs are not secure and fraudsters know this.
We have seen dramatic results at companies where we have helped them remove SMS OTPs as part of their authentication offering. We should remember that the industry rolled out SMS OTPs when we realised that username and passwords were not sufficient. But now we know that SMS OTP should not be used for anything tied to personal or financial information. It’s simply not strong enough.

“The verification process should be augmented using other technologies such as voice biometrics”

This cannot happen overnight and, in the shorter term, companies can augment the authentication process with SIM-swap detection technologies or use mobile apps that rely on device integrity.

Beyond industry cooperation, our regulators need to look at introducing guidelines and standards that will address SIM-swap fraud at the entry point.

At the end of the day SIM-swap fraud remains a huge part of digital crime committed because there has not been much focus on improving a very archaic process that relies on very old technologies. There are certainly better ways of doing things, but it requires a coordinated effort to make the necessary changes. Most of all we will need to move past the current industry inertia.