Stay Savvy: Spotting Phishing, SIM-Swap, and Account Takeover Scams

In our increasingly digital world, fraudsters are constantly evolving their tactics. Phishing, SIM-swap, and account takeover scams are among the most prevalent and damaging threats to your financial security and personal information. Understanding how these scams work is your first line of defense.

Phishing: The Art of Digital Deception

Phishing is an attempt to trick you into revealing sensitive information by impersonating a trustworthy entity, such as a bank, government agency, or well-known company. These scams often arrive via email, text message (smishing), or phone call (vishing).

Common Phishing Red Flags:

• Suspicious Sender: Does the email address or phone number look slightly off? Fraudsters often use similar-looking domains.
• Urgent or Threatening Language: Scammers often create a sense of urgency to make you act without thinking. They might threaten account closure, legal action, or sudden fees.
• Generic Greetings: If an email addresses you as "Dear Customer" instead of your name, it's a red flag.
• Poor Grammar and Spelling: Legitimate organizations usually have professional communication.
• Unexpected Attachments or Links: Be extremely cautious about opening attachments or clicking links from unsolicited messages. Hover over links to preview the URL before clicking.
• Requests for Personal Information: Legitimate companies will rarely ask for your password, Social Security number, or full credit card details via email or text.

SIM-Swap Fraud: Hijacking Your Phone Number

SIM-swap fraud, or SIM hijacking, occurs when a scammer convinces your mobile carrier to transfer your phone number to a new SIM card under their control. Once they have your number, they can intercept calls and texts, including two-factor authentication codes.

How SIM-Swaps Happen:

1. Information Gathering: Fraudsters may gather personal information about you through phishing or data breaches.
2. Impersonation: They contact your mobile carrier, pretending to be you, and request a SIM transfer.
3. Account Access: With control of your phone number, they can reset passwords for your email, banking, and social media accounts, effectively taking them over.

Protecting Against SIM-Swaps:

• Use Strong, Unique Passwords: Especially for your mobile carrier account.
• Add a PIN or Passcode: Set up a separate PIN or password with your mobile carrier that must be provided before any account changes can be made.
• Be Wary of Social Engineering: Don't disclose personal information over the phone unless you initiated the call and verified the recipient.
• Monitor Your Accounts: Keep an eye out for sudden loss of cell service or unexpected account activity.

Account Takeovers: When Your Accounts Become Theirs

Account takeover (ATO) occurs when a fraudster gains unauthorized access to your online accounts, such as banking, email, or e-commerce platforms. This can happen through stolen credentials from data breaches, successful phishing attempts, or weak passwords.

Signs of an Account Takeover:

• Unauthorized Transactions: Purchases or money transfers you didn't approve.
• Password Changes: You can't log into an account because the password has been changed.
• Suspicious Login Alerts: Notifications about logins from unfamiliar locations or devices.
• Missing Emails: Important emails (like password reset notifications) are deleted.

Preventing Account Takeovers:

• Enable Two-Factor Authentication (2FA): Where possible, use authenticator apps instead of SMS for 2FA, as SMS can be vulnerable to SIM-swaps.
• Use Strong, Unique Passwords: A password manager can help you manage complex passwords.
• Regularly Review Account Statements: Check bank and credit card statements for suspicious activity.
• Be Skeptical of Unsolicited Communications: Always verify requests for account information directly with the company.