Hackers steal thousands of dollars through victims’ cell phones using SIM swap fraud

NEW ORLEANS (WVUE) - Criminals are employing a new hacking technique both in New Orleans and across the country, leading to millions of dollars in yearly losses from victims who may not be able to figure out what happened until it’s too late.

For months, Fox 8 has had in-depth conversations with locals and tourists who said they became victims of a little-known hacking technique: SIM swap fraud.

The common thread of victims who Fox 8 spoke with was spending a night out in the French Quarter, but SIM swapping can, and does, happen in many different locations and to various victims.

The fraud can take place one of two ways: hackers can gather your personal information and contact your cell phone provider to impersonate you and have your phone number ported to another device, or the SIM card can by physically removed from your phone and placed into another device.

Once hackers can access your phone number, they can intercept confirmation codes for two-factor authentication sent via SMS.

“After having this happen and finding out about the other cases, it definitely seems like they’re preying on vulnerable people,” said Kristopher Buckley, who himself became a victim in February.

Buckley and his partner Ezequiel Fernandez Lopez were in the French Quarter following the Chewbacchus parade. They ordered a Lyft at the end of the night, so they weren’t surprised when a car pulled up outside the bar and the driver offered a ride.

“We noticed there was somebody in the back seat, which was a little odd. But we pulled off with them anyway,” Buckley said. “They just kind of drove around the French Quarter, and then told us to get out abruptly.”

Buckley and Lopez, who said they had a few drinks that night, found the interaction strange but didn’t think anything of it.

That is until Buckley couldn’t locate his cell phone.

“We figured because we have a lock pin that nobody could access the phone,” Lopez said. “We also figured we could just call them whenever our phone charges and they can meet with us and give it back.”

They dialed Buckley’s phone and one of the female drivers answered, agreeing to meet them at a bar and return the phone.

But they never showed up.

“They picked us up at 4:00 a.m., and by 4:09 I had an email saying my iCloud password was changed,” Buckley said. “They had access to all of my accounts through iCloud. They had access to my TurboTax record, they had access to my bank account, to all of my email addresses.”

“It took them max 10 minutes to take that SIM card out, pop it in another phone, and start resetting everything on there,” Lopez said.

Buckley said the two women hackers stole more than $7,000 from his bank account alone.

“They even opened an Apple Credit Card under his name,” Lopez said.

It took Buckley and Lopez more than a month, and endless calls to multiple financial institutions, to get their finances in order. Other victims who spoke with Fox 8 said they never had their money returned once the hackers stole it.

“It almost feels like there’s no moving forward, you know? Knowing that they have all of our personal information and, when we go to a certain place that feels like a safe space to us in the community, that we’re going to be taken advantage of there,” Buckley said. “We don’t really feel like we have a safe place anymore.”

More than 2,000 complaints of SIM swap fraud were reported to the FBI in 2022, up from more than 1,600 complaints in 2021 and only 320 from 2018 to 2020.

The losses in 2022 total more than $72 million, more than $68 million in 2021, and around $12 million from 2018 to 2020.

Buckley and Lopez said the fraud felt so personal because of their vulnerable, inebriated state when it happened.

“As adults, we feel like the decision to have a few drinks shouldn’t be an issue,” Buckley said. “It makes us not even want to enjoy public spaces like we could before.”

The FBI asks victims of SIM swap fraud to file a report online.

“Back in the early 90s all you had was the home computer. Now we’re all carrying the computer in our pockets,” said Josh Morrow, a special agent with FBI New Orleans. “Once they control that phone, they can go find that information and easily get into all your other accounts.”

Fox 8 cybersecurity expert Nam Nguyen shared some tips to protect yourself and your finances from SIM swapping:

• Call your cell phone provider and ask them for help to protect your number from being ported to another device.
• Two-factor authentication is a good thing, but consider using third-party authentication applications (like Google Authenticator or Microsoft Authenticator) rather than SMS.
• Don’t advertise your phone number, physical address, email address or financial information online, especially on social media.
• If you have a physical SIM card, consider locking your SIM card, which can be done by calling your mobile provider and asking for help getting your default password for the SIM card. If needed, they should be able to walk you through the steps of locking the card on your phone.

Locking your SIM card can save you a lot of headaches in the future, Nguyen said.

“Every time the phone is rebooted, or if somebody takes out the SIM and puts it into another device, the SIM’s locked. You have to have that code before you actually start using the phone,” he said.

Nguyen said people signing up for two-factor authentication to access various social media and banking apps is, generally, a positive trend. But it can become dangerous when someone has access to your phone number.

“There’s multiple types of two factor authentication, like the SMS two-factor authentication. It’s good, it’s convenient, it’s better than not having it,” Nguyen said. “But you could be subject to these types of attacks.”

Buckley and Lopez said last week that they, finally, had all their money returned to them. But they wanted to come forward to try and prevent this from happening to as many people as possible.

“It’s been a huge emotional and mental strike to us,” Buckley said.

See a spelling or grammar error in our story? Click Here to report it. Please include the headline.

Copyright 2023 WVUE. All rights reserved.