The fraudster drained the victim’s bank account using a sim swapping attack

In sim swapping, the attacker hijacks the victim’s subscription in his name. Adobe Stock / AOP

Insurance and financial advice FINE tells payment instrument fraud, which was committed on the company’s board chairman’s work phone. The attacker was able to take 37,000 euros from the victim’s bank accounts with a sim swapping attack, where the victim’s connection is hijacked to another sim card by deactivating the old sim card.

The solution states that the criminals had identified themselves to the operator with the customer’s personal identification number and ordered a new sim card for the company’s phone, the replacement date of which was set for June 9, 2021. On the day in question, the phone stopped working, and the criminals emptied the victim’s accounts without her knowledge, because the phone did not receive confirmation messages from the banks about the money transfers.

The chairman sought compensation from the insurance company for the lost money from the company’s liability insurance, because according to him, the damage was caused by a phone owned by the company.

In the decision of the insurance company from September last year, it is stated that the damage that occurred is not covered by the liability insurance, because according to the limitation condition, the insurance does not cover monetary loss that is not related to material or personal damage.

FINE agrees with the insurance company and does not recommend a change.

“The damage is a so-called pure financial loss, which has resulted from the fact that, according to the damage report, the phone was somehow hijacked by criminals and used to commit payment instrument fraud,” the decision says.

Sim swapping is becoming more common

The information security company Check Point warned in August about sim swapping scams, which are becoming more common. At worst, the attack can lead to the emptying of accounts, as happened in the case presented above.

Sim swapping attackers gain access to the victim’s phone data and gain full control of the device. In this way, the attackers gain access to, for example, the victim’s banking, instant messaging and social media applications.

– This could mean emptying your bank account or becoming a victim of identity theft, in which case a criminal could buy goods and services over the internet in your name, Check Point’s country manager for Finland and the Baltics Sampo Vehkaoja said in the announcement.

The signs of a sim swapping attack are easy to spot. The connection is completely disabled, so the phone cannot access the network. So it’s not just a disconnection of the mobile internet connection, but you can’t make calls or send text messages with the phone.

– If this happens, contact the authorities and your mobile operator so that they can disable the SIM card and start the process to restore your data, Check Point advises.

Check Point lists vigilance with its own data as protection methods.

– Be careful with the websites you visit. Make sure the site is official and that the connection is secure.

In addition, the information security company recommends being careful with various fishing messages and websites.

– Check for typos in e-mails or text messages, even if you know the sender. Pay attention to the sender’s address to make sure it is genuine. The same goes for links and attachments that look strange.

The “Beware, verify, warn” campaign of authorities and companies has collected really good instructions for identifying and avoiding online scams. You can find the instructions below.

BEWARE of suspicious messages and contacts:

MAKE SURE where the contacts are coming from and that you log into the services the right way:

WARN others about scams too: