SIM-swap fraud has been around for decades and according to the latest South African Banking Risk Information Centre (SABRIC) figures, SIM-swap incidents increased 91% year on year when looking at digital banking fraud across all platforms.<\/p>\n
But why, with all the advancements in technology, are we still dealing with this relatively unsophisticated, but rampant fraud type? Lincoln Naicker, product owner at Entersekt, a provider of strong device identity and customer authentication software, explores how we could lower our risk to this perennial and costly threat.<\/p>\n
\u201cSIM-swap fraud continues to grow. Some international reports show close to 100% year-on-year growth, and South Africa is seeing the same trend,\u201d Naicker said.<\/p>\n
\u201cThe most important thing to recognise is that SIM swaps have a very important part to play in the mobile network industry. Mobile Network Operators (MNOs) sit at the centre of an extended ecosystem and impacts many other sectors, not least of all the financial ones. And, although there has been a seismic shift in the technology in mobile apps and other digital channels, the SIM has remained fairly unchanged.\u201d<\/p>\n
Naicker pointed out that SIM-swap fraud remains a largely manual process with social engineering at the heart of most of the criminal efforts. Another big problem is that, at the moment, clients will be asked to challenge a SIM swap after the fact, rather than the MNOs proactively reaching out to the client to verify that the SIM-swap request actually came from them before proceeding.<\/p>\n
\u201cThe US regulator is leading the charge in changing this and is proposing new requirements for phone carriers to authenticate a person\u2019s identity before transferring their number to a new phone. This is timeous because Covid-19 has amplified digital and mobile banking and with over 90 percent smartphone penetration, we are all beholden to mobile networks for our digital financial lives,\u201d he said.<\/p>\n
Naicker said there may need to be better local regulation to effect change, although he is quick to point out that the current method is low-friction and offers MNOs a better customer experience.<\/p>\n
\u201cMNOs want to keep the customer experience as smooth as possible. If you put too many roadblocks in the path of the cellphone owner, they may simply migrate to another provider and so the incentive to add additional security layers is not immediately obvious. However, when it comes to reputation, SIM-swap fraud will eventually impact your bottom line,\u201d he warned.<\/p>\n
A collective solution may be the answer<\/strong><\/p>\n Minimising SIM-swap fraud requires a multi-layered solution. Naicker believes that the first issue that needs addressing is how MNOs onboard customers.<\/p>\n \u201cWe need greater cooperation between the MNOs when it comes to onboarding. The verification process should be augmented using other technologies such as voice biometrics. If all players could agree on better security at this early stage, we would already have made progress,\u201d he said<\/p>\n The second piece to the puzzle lies with organisations\u2019 ongoing reliance on SMS one-time passwords (OTPs). Naicker said SMS OTPs are not secure and fraudsters know this.<\/p>\n \u201cWe have seen dramatic results at companies where we have helped them remove SMS OTPs as part of their authentication offering. We should remember that the industry rolled out SMS OTPs when we realised that username and passwords were not sufficient. But now we know that SMS OTP should not be used for anything tied to personal or financial information. It\u2019s simply not strong enough,\u201d Naicker said.<\/p>\n He acknowledged that this cannot happen overnight and said that, in the shorter term, companies can augment the authentication process with SIM-swap detection technologies or use mobile apps that rely on device integrity.<\/p>\n Naicker suggested that beyond industry cooperation, regulators need to look at introducing guidelines and standards that will address SIM-swap fraud at the entry point.<\/p>\n \u201cAt the end of the day, SIM-swap fraud remains a huge part of digital crime committed because there has not been much focus on improving a very archaic process that relies on very old technologies. There are certainly better ways of doing things, but it requires a coordinated effort to make the necessary changes. Most of all we will need to move past the current industry inertia,\u201d he said.<\/p>\n
\n