Eight Brits arrested after probe into SIM-swapping scam targeting US celebs

Brit cops have cuffed eight men in England and Scotland amid a probe into SIM-swapping attacks on high-profile US targets – including sports stars, musicians, and "influencers" – that had money and personal data stolen. The suspects, aged between 18 and 26, were nabbed in an operation co-ordinated by Police Scotland, the …

[Mike 137]

Not exactly a new issue

SIM swapping is one of the vectors that make SMS a lousy "second factor" for authentication. This has been known for a decade, and last month EUROPOL published guidance on it, including a warning to avoid reliance on SMS for authentication. Which is of course why our business bank has just adopted it to authenticate the registration of new payees.

I wonder where they recruit their "security" personnel.

[adam 40]

Re: Not exactly a new issue

It's also a good reason NOT to link your mobile phone number with any online accounts AT ALL.

I think I have mine linked with whatsapp, because you can't really avoid it. But that's it. Every new physical phone gets a different gmail account too.

Some accounts (e.g. paypal) try and insist on it quoting some "PSD2 regulations" baloney, but you can avoid that.

On top of so-called SIM swapping you can have man-in-the middle attacks using a compromised basestation, but that get a bit trickier as it needs proximity to the victim.

[Cynic_999]

Re: Not exactly a new issue

SIM swapping can indeed compromise the security of accounts that use your mobile phone as authentication. BUT - it is reasonably difficult to carry out, meaning there is a lower probability of you being targeted. And so long as you frequently use your phone, you will very quickly know that your SIM has been compromised because your phone will no longer connect to the network, and if you then act quickly you can reverse the effects of anything the miscreant has managed to do.

[EnviableOne]

Re: Not exactly a new issue

Yet still NIST pulled pulled the advice against it from the SP800-63b when it went from draft to release.

[macjules]

sports stars, musicians, and "influencers"

influencers are not celebrities. They are simply Warholian wannabes who could not even get famous for 15 minutes.

[Throatwarbler Mangrove]

Re: sports stars, musicians, and "influencers"

The judges would also have accepted "professional attention whores."

[Anonymous Coward]

Re: sports stars, musicians, and "influencers"

Why not? "Celebrity" doesn't mean you do anything useful or important. It's just you get attention from other people. Why people kicking or throwing balls are "celebrity" for example wonders me too - they don't anything more useful than any "influencer", just a different useless thing.

Maybe people should stop to worship useless people.

[Cuddles]

Re: sports stars, musicians, and "influencers"

Indeed. An influencer is just a TV celebrity who happens to appear on some internet-based video service instead of a long-wave broadcast. As much as people like to rant about the youth of today doing things slightly different from how they used to be done, the difference here really is very slight. Compare things like talk shows, reality TV, You've Been Framed, and so on, and then try seriously claiming that someone making a prat of themselves on YouTube or TikTok is really different in any meaningful way.

[Da Weezil]

Extradition?

I heard one comment in radio news yesterday that suggested the septics may seek extradition, this shouldn’t happen until the septics send back a certain u.s. gov shielded female to face justice here. Killing a man is far more serious than upsetting a few overpaid “celebrities”. For far too long extradition has been a one sided process with the US. It’s time this was rectified.

[Cynic_999]

Re: Extradition?

No, killing a man *by accident* is not a more serious *crime* than defrauding someone deliberately. Yes, the consequences of the act were far more serious, but we should always punish people based upon the severity of the crime, not the severity of its consequences. Not that that is what happens in practice.

If I got impatient with someone and pushed them out of my way, it would amount to a low-level assault at worst and I'd probably get a fine - if the police even bothered with it.

If I did exactly the same thing, but the person stumbled, fell, hit their head on the pavement and died, I'd be looking at many years in jail.