Sim-swap fraud claims another mobile banking victim

Chris Sims was sitting in his Nottingham home a fortnight ago when his iPhone, on the EE network, suddenly stopped working. Within 75 minutes the fraudsters who had hijacked his phone had, through his online banking app, emptied his bank account of £1,200 and applied for an £8,000 loan in his name. But Sims is just the latest victim of a financial scam that is sweeping Britain: sim-swap fraud.

When Sims rang EE, it soon emerged that someone posing as his wife had managed to persuade the mobile network to activate a new sim card – in effect giving the fraudsters control of his mobile number. The crooks were then able to reset all his mobile banking passwords, using his phone as identity, and the passwords being sent to the phone.

The mobile phone companies say they first started seeing this sort of fraud in late 2015, and admit it is growing rapidly. Sims says that when he contacted his bank, Halifax, the call centre told him it is handling hundreds of sim scams every day, making it the fastest growing fraud in the country – although Halifax later disputed this figure.

It appears that fraudsters have identified a significant vulnerability in the way banks are using their customers’ mobiles to identify them – and exploiting it to the max.

“One minute I’m wondering why my phone won’t work, and less than two hours later my bank account has been emptied and I have an £8,000 loan,” says a still shocked Sims. “What has really annoyed me is EE’s attitude. It told me it has recordings of two calls where the fraudster tried to take over my account but failed the security questions. You’d think this might have set alarm bells ringing, but it didn’t. Then, on the third attempt, they were happy to cancel my sim. I have asked to hear this call but EE mysteriously didn’t record it, which I find very convenient.”

He says he has no idea why his phone was targeted. It is actually on a shared account in his wife’s name, although he pays the monthly bill from his bank account. Her phone worked as normal.

“They appear to have used the phone to tell Halifax that I had forgotten all my online bank settings. When my settings were reset, the bank sent notification to my phone – which of course, went to the fraudsters. If your bank’s security is only as good as EE’s then God help us all. I’ve been contacted by another woman who this has happened to twice. I won’t be using mobile banking again,” Sims says.

EE says it has “strict policies and procedures in place to prevent fraudulent activity and unauthorised access”. It adds: “All requests to make account changes, including swapping a sim, require the person to provide a range of details to verify their identity, and in this case the correct password was given. While we continue to improve defences against this type of fraud, customers should use unique and strong passwords for each of their accounts and contact their network provider, their bank and the authorities immediately if they notice any issues.”

Before a sim can be cancelled and reissued, the mobile phone network will ask a number of security questions, which only the phone owner should know the answer to. This suggests that fraudsters have already gathered a considerable amount of information on their victim. The mobile phone companies say these details may have been hoovered up from social media accounts such as Facebook, or possibly bought on the “dark web”. But they also admit that they and the banks need to do more to fight this new menace.

Halifax tells us that it “ invests heavily in detection systems to ensure robust controls are in place. To protect our customers we are working with industry and network providers on a number of initiatives, including sim-swapping”.It adds: “We are sorry to hear that on this occasion Mr Sims fell victim to fraudsters who were able to remove funds from his account following a sim-swap. Where a customer is a victim of fraud we look to refund, provided the customer has taken reasonable steps to keep their own security information safe. As such, as soon as Mr Sims notified us of the fraud, we immediately refunded the money he had lost.”

Guardian Money has also recently reported on the case of John Ellard from Hertford whose Nationwide account was emptied of £6,000 after fraudsters apparently took over his O2 mobile account. Our earliest case of a fraudster using a victim’s mobile to access their bank account was in September last year, when we featured Emma Franks who had £1,500 taken after thieves took over her Vodafone account. Someone had reported her sim card water-damaged, and requested a replacement.