Information on the “SIM Swapping” fraud

Learn more about your protection from the “SIM Swapping” fraud typology.

Individuals' Support Center
Security
Information on the “SIM Swapping” fraud

Information and awareness-raising on the “SIM Swapping” fraud typology

The use of the mobile phone number as one of the main and basic elements for the strong and reliable identification of its owner/subscriber, is an international practice that organizations, companies and the public sector employ for the services that they offer.

Banks are no exception to this practice, as they use their customers’ mobile phone number as a means for sending one-time passwords (OTP) that enhance the security of electronic transactions (fund transfers, card-based purchases, etc.) and security alerts for the executed transactions, as well as for the purposes of their customers’ remote signing up for new services.

In principle, the replacement/change of the SIM card (SIM Replace) is a perfectly legitimate service that mobile operators offer to their subscribers, so that the latter can retain their mobile phone number in the event that their mobile device is lost or stolen, or because they need to use a SIM card of different size. With the activation of the new SIM card, the old card is automatically deactivated and mobile telephony services (calls, SMS, internet access) are from then on carried out by the new card that operates with the same number.

In cases of SIM Swapping fraud, the perpetrators take advantage of the availability of the SIM Replace service and pretend either to be the holder of the SIM card or someone authorized by the legitimate subscriber, thus trying to deceive the mobile telephony operators and obtain a new card which will replace the one owned by the legitimate holder.

Once they activate the new card, the old one, which is still in the possession of the legitimate subscriber, is deactivated and thus all services (calls, SMS, internet access) are received on the device in the possession of the fraudulent offender, enabling them to carry out illegal activities unbeknownst to the legitimate subscribers (by receiving calls and messages intended for the latter, intercepting one-time passwords or security verification messages, etc.).

The unauthorized replacement/exchange of the SIM card is usually the second leg of the above illegal mode of action. In the first part, the perpetrators have managed to intercept the victim's e-Banking codes, usually through a phishing email or through malware installed on the victim's computer.

If your mobile phone stops working for unusual reasons, contact your mobile telephony provider immediately. Sometimes you may have no mobile telephony signal due to broader problems that affect your mobile telephony service. However, if you lose the service at a location that usually has good coverage, it is safer to contact your network provider and confirm that your SIM card has not been deactivated.
Do not disclose your mobile phone number on social media.
Subscribe to the services of organizations that provide SMS and email notifications when your transactions are executed.
Never respond to unknown messages or calls asking for your account details and your registered mobile phone number.
Do not follow links to web pages and do not open attachments that you may receive from unknown email senders. Carefully check the sender’s details, as the perpetrators often pretend to be legitimate businesses and organizations.
Do not disclose to anyone your e-banking codes (username and password) or card numbers, and do not enter them on unknown websites. Confirm that you have visited the official website of your Bank and remember that the Banks will never ask you for your passwords in any way whatsoever.
Make sure that your computer and your devices (tablets, smartphones) always have the latest OS and app updates. Install and always keep up-to-date a trusted anti-malware program.
Check frequently your accounts’ activity.
If you are the victim of SIM Swapping fraud or have found transactions [in your accounts/cards] that do not have your approval, you should inform your Bank immediately.

What measures Banks are taking

Banks cannot know if a subscriber has been the victim of SIM Swapping fraud or phishing, or if their computer has been infected with malware and their passwords have been intercepted.

Banks always aim to ensure the security of electronic transactions in line with current technical and technological developments and global best practices in the field of information security, as well as with the applicable laws and regulations. In addition, they place great emphasis on the user experience and speed of the services that they provide to their Customers.

Cyber fraud is a widespread problem whose deterrence or prevention requires the collaboration of the many individual parties that are involved in payment processes. Especially in the current period, in which the use of electronic services has increased significantly worldwide due to the coronavirus, the perpetrators are trying to take advantage of the particular circumstances by increasing their attempts at data interception. The Hellenic Bank Association has set up a special Committee for the Prevention and Management of Fraud in Payment Instruments and Systems, whose purpose is to monitor and process related information and data, and to provide guidance in this area. The Committee coordinates the cooperation with the Cyber Crime Division of the Hellenic Police and with the Bank of Greece, and cooperates systematically with other competent bodies in Greece and abroad.

More security tips and transaction protection measures:

Europol

Visit the Europol website

Hellenic Bank Association

Visit the Hellenic Bank Association website

Secure electronic transactions

The security of your transactions is our priority. We ask our Customers to follow the guidelines for the security of electronic transactions provided by Alpha Bank, especially at this time that phishing attacks have significantly increased.