Cole French:
SIM swapping. It sounds technical, but it’s not. And that’s exactly why it’s so dangerous.
In today’s episode, we unpack how attackers can take over your entire digital life without touching your phone, writing a line of code, or breaking into anything you own. If you’ve ever wondered how a single number port can lead to stolen accounts, drain crypto, impersonation, or months of identity fallout, you won’t want to miss this conversation.
Welcome to the Cyber Compliance and Beyond Podcast. A Kratos podcast that brings clarity to compliance, helping you leverage compliance as a tool to drive your business’s ability to compete in any market. I’m your host, Cole French. Kratos is a leading cybersecurity compliance advisory and assessment organization providing services to both government and commercial clients across varying sectors, including defense, space, satellite, financial services, and healthcare. Now let’s get to today’s episode and help you move cybersecurity forward.
Modern life runs through our phone numbers. They’re tied to our email, our banking, our apps, and in many cases, our identity itself. And that’s what makes SIM swapping such a persistent and damaging threat. In today’s episode, Mark Kreitzman walks us through how these attacks actually happen, not from some sophisticated hack, but from simple social engineering, insider access, and weak carrier verification processes that can quietly reroute your number to an attacker’s device.
Mark is a cybersecurity executive with over 20 years of experience building and scaling security companies. two of which were acquired by Microsoft and Cisco. Today, he serves as general manager at Afani, a secure mobile service protecting CEOs, crypto holders, high net worth individuals, and corporations from SIM swap attacks and mobile threats.
We break down the difference between a legitimate SIM swap, the routine process that happens when you upgrade your phone, and the illegal version where a criminal convinces a carrier to point your mobile account to their SIM. Once that happens, everything tied to your number becomes exposed. password resets, cloud accounts, email inboxes, and even encrypted messaging apps. Mark shares his own experience as a victim, explaining how attackers move through his accounts, triggering resets, compromising cloud services, and ultimately stealing cryptocurrency, even though he had nearly two decades of cybersecurity experience.
From there, we dig into why this threat continues to grow. We talk about the insider threat problem living in retail phone stores, the social engineering. tactics attackers use to weaken an accountant’s stages, and the systemic gaps across U.S. carriers that make fraud possible long before a victim realizes anything is wrong. We also explore the lesser-known ripple effects, identity freezes, DMV interventions, reputational risks, business disruption, and the long tail of anxiety that comes from not knowing who may still have access.
Finally, we touch on how attackers are increasingly pairing SIM swaps with modern data tools, including AI systems capable of profiling executives, mapping online identities, and identifying high-value targets with nothing more than a phone number or a small set of public clues. And we wrap with what organizations can do, reassessing mobile-based authentication, securing employee phone numbers, and building controls that assume SMS is no longer a trustworthy factor in the security chain. We hope you enjoy this episode.
Mark, I really appreciate you coming on the Cyber Compliance and Beyond podcast today. And for our listeners out there in the past, we’ve talked about cybercrime, and that’s what we’re going to be getting into a little bit today. And so we’ll just get right into it. So, Mark, could you kind of explain SIM swapping, which is what we’re going? to talk a lot about in our conversation today? Talk about what it is and why has it become such a persistent problem.
Mark Kreitzman:
Yeah, absolutely. And so first of all, thanks for having me on and happy to answer this question. So the first way I like to answer this question is to remind people what a legal SIM swap is, because a lot of people have done a SIM swap. The legal SIM swap, they just don’t know it by name.
And so a legal SIM swap is, let’s say I have an iPhone 12 today. I go into the store and I trade it in for the iPhone 17. And through that process, the Apple Store helps me move my mobile account from my iPhone 12 over to my 17. I walk out of the store. I’ve got this brand-new iPhone 17. I get my voice data text on the new phone. I’m happy. That is a legal SIM swap or a legal port over. And so anybody who’s had more than one phone, we’ve all done that.
Now, what an illegal SIM swap is, the SIM swap attack, is a nefarious person is accomplishing the same thing. except they’re moving your mobile account from pointing to the SIM or the eSIM in your phone to having the network, your carrier network, pointing to the SIM or the eSIM in the nefarious person’s phone.
I don’t like to call them hackers because when they hear the term hacking, they think it’s somebody who’s, like, hacking into the code of your iOS of your device or hacking into Android or hacking into your carrier. It’s a very kind of simple method for what these people can do. You don’t have to be able to write a line of code. But that illegal port over is when they get your carrier to move your mobile account to point to the SIM or eSIM in their phone.
Cole French:
So how do they typically undertake this? Like you mentioned, there’s no need for any kind of code or anything like that. So how are these type of illegal SIM swaps, how are they perpetrated?
Mark Kreitzman:
Yes, there’s various methods, and every time Carrier’s trying to close it down, they come up with a creative method. And you can find all these with victims on YouTube. And so there’s the bribery one. So you could. put somebody’s name and information into a SYNSwap forum and say, hey, does anybody have access to this person? I want to SYNSwap them. And they can offer, hey, for $300, $100, $3,000, I could help with that person. So the people that work at the carriers and the stores or they’re in a unique position to help may offer this up.
There’s also the most basic one, which is the social engineering. And these are the people that are just kind of con artists and they’re good at doing it and they can call up your carrier. And these days they do it maybe in two or three steps. So they may call up your carrier and impersonate you, but the first step is to simply add an email account. like add an email to your account. And this is less, like. this is not an attack, right? So their guard goes down.
Then they can call back, you know, the next day, two days later, and then mention and get verified through that email. And then maybe add another, maybe change the pin, maybe change something on it. And then the third time when they call in, they’re. no longer even social engineering. They’re literally saying, like, here’s my email, here’s my pin, this is my account. And so they just get better at the social engineering part of it.
There’s also insiders. So there’s insiders at carriers, insiders at customer support teams, or at the stores. A lot of people don’t realize that most of the mobile stores are independently owned. So there may be somebody out there that owns one store, but there are people out there that own hundreds of stores. or corporations that own hundreds and hundreds of stores.
And so you’re relying on these third parties to hire the right people and to monitor them and make sure that they’re not recording customers’ information, taking down verification information, and then selling that or later using that to help somebody else do this. So there’s just a lot of methods that they’re using to do it.
Cole French:
And frankly, this is not an area of a cyber person, cybersecurity practitioner. I’ve never really even thought about this particular type of attack and the fact that, yeah, I mean, because like you mentioned, I’ve gone and had my phone SIM swapped, right? I’ve done it and. taken family members to do the same thing. And I’d never even thought one time that this person that’s working here supporting me, who I did notice that it was an independently owned retailer. of that particular carrier. But I never even had a thought that that person that was working with me and supporting me might actually be taking all of my information and potentially selling that on the black market, essentially.
So the social engineering, I figured that was probably one of the primary ways that this takes place, but it didn’t even cross my mind that it could be the people with access to the information. But I mean, that makes complete and total sense that. If you have access to that, there’s an incentive there.
Mark Kreitzman:
Yeah, so I was a victim in 2018. And in 2018, at that point, I had around 18 years experience of building cybersecurity companies at a high level. And I’m a super techie. I’m a techie nerd, and I have been since I was 12 years old. And I’ve worked directly for a couple different co-founders for enterprise cybersecurity companies that were acquired by Microsoft and Cisco Systems. So I was. not a beginner, and I knew that I could get SIM swapped.
And even though I had all this experience, and even though I had my carrier profile set up where if I wanted any change to my account, I was supposed to be in a store physically with my passport and my driver’s license because I knew this could happen. And even though I had all this experience and I had the VPN on my phone, I was careful about everything. I had this extra info in my profile. I still got sin swapped.
And they got me when I was driving in the middle of Arizona between Tucson and Phoenix. Anyone who’s ever been in that area knows it’s dust. It’s flat. It’s just flat desert dirt. There’s no phones out there. I was by myself. So I couldn’t even call the carrier. My mobile account’s gone. It’s stolen away. And even with all that experience, I had it taken away.
And I had to trick another third-party phone store into giving me the identity, at least the employee ID of the person who did it. When I was visiting South Lake Tahoe, I went into a store. and said, hey, this person helped me on this specific date. I travel a lot. I promised them I’d send them a gift card. Could you help me identify who they are? And they gave me the employee’s ID number, which is… Not good of them to do that, for one. But that shows why they’re vulnerable, right? That I come in cheery and innocent, and they end up giving me an employee’s ID.
But then I was able to confront the carrier because they go into liability protection mode. And they’re not trying to protect the hacker. They’re protecting themselves. But they end up protecting this attacker, and you now can’t get any info. But once I told them that, they said that, oh, it was… A third-party phone store, the employees, it was their last day. They were leaving, and they picked three people to target. They were in Memphis, Tennessee. I happened to be one of those lucky people. And I haven’t been in the state of Tennessee since, I don’t know, 2012 or 2013.
And so it was just like a random person, and all it was was a third-party phone store employee that lied to. the computer and said I was there. and that I had my IDs, because the carrier was blaming me. They were like, well, somebody got a copy of your IDs, because the notes show that you were there and you had your IDs, so somebody got a copy of it, which later on cost me, because when I went to get my California driver’s license renewed, the ladies at the DMVs were like, I’ve never seen this before, but your driver’s license is frozen. And there’s notes here saying you’ve got to come to Stockton and meet with a DMV investigator. Which I had to do. I had to go to Stockton’s and stay overnight. And I didn’t even know there were investigators. But they put me in a locked room and I had to prove who I was.
Cole French:
Was it connected to the SIM swap? Was that the connection? Or did you ever find out what it was?
Mark Kreitzman:
It was connected only in the sense that the carrier blamed it on me and said that somebody got a hold of your IDs. It’s not our fault. And so you should contact the… The DMV, so I did. I sent. in a notice asking, like, hey, did somebody get a copy of my ID? So when they told me it was frozen, that there’s a report on your driver’s license, I’m like, yeah, that’s me. No, I’m the one that reported it, and I was asking, did somebody copy of it? So it wasn’t a direct result in the sense of the attacker using that against me, but it was just part of the pain that I had to endure, and that was literally like six months later.
But when I did get mobile SIM swapped, what happened was when I completed the drive to my parents’ house, the Wi-Fi kicked in when I got up to the garage, and six password resets went up my phone. So they got into an email account, two cloud accounts, a bank account. I had a Coinbase account at that point. They got 2.2 Bitcoin in 2018, which was a very low price, thankfully. And so it was very painful.
I didn’t sleep for like 90 days because not only did they port my number out, but 61 minutes later they ported my number back. So they tried to hide it. So now. when I went to sleep, I was like, well, what happens if they steal my number at 11 p.m. and then port it back at 4 a.m.? And so I didn’t use Wi-Fi for a couple months because I was afraid it would mask. I could wake up and I’d have tweets. I’d have emails, you know, things. come into my phone. it would look like it’s actually active because the wi-fi connection and then you know realize has come. nobody’s called me you know one in the afternoon and uh and so wi-fi can you know mask it in the sense that you may not you know realize that there’s an issue until you try and make a phone call or try and text somebody.
but you know a lot of people think like well they’re not going to steal money from me but they kind of forget that things like like Telegram and WhatsApp and Signal are based on your mobile number. And then also if they can, you know, get into an email account, they can sync up an email and then how many emails can they get access to in an hour? Or let’s say you’re? on a long flight or you’re playing golf and you don’t realize it for like three, four hours or you’re on a flight to Tokyo, you know, for 14 hours, you know, could they get three years worth of your email?
And if they get into the right email, then they’ve got wire distributions and all the notifications of what apps you’re using. They could set up a carbon copy. so every time you send an email out, you don’t realize that it’s actually carbon copying, sending somebody else. These are the kind of things that can be very painful over years. So it’s not always about just money. And it’s not about crypto. It’s about, you know, you have a reputation to lose. Could you be blackmailed? Could they take down your web hosting? Because that was one of the things that got into my web hosting account for a startup I was doing.
And so I was so angry that it finally exists out of anger, actually. And so it was lucky in the sense that I had that many years of being in cybersecurity building companies, and I happened to just, I had left a mobile security. solution company. So I had six years in a row of mobile security. I worked for the telcos for 10 years as well. So I had all this background. I still get synth swapped. And I think that he was lucky in the sense that I had the right background where I was so pissed off that I’m like, okay, I’m going to dump what I’m doing. And I’m going to go partner with this other guy who had solved this.
And then Afani was born out of that, out of anger, really. And the person that today is our CEO, he got synth swapped three times. He happened to be a really big name in Bitcoin at that time. His name was all over the place because he was partnering with a couple of guys building one of the biggest Bitcoin ATM networks. And we hit it off. And so in that sense, kind of lucky I had the right background to be able to go and do this. Otherwise, I would just be a really, really angry person about this.
Cole French:
Absolutely. And I definitely want to dive into more of kind of the layers you just touched on. it. I think we talk about that. It’s funny as a parent. You know, I’m always talking of teenage and young adult kids and, you know, just how attached they are to their phones. And like my focus is always on like what it’s doing to their brains and all this kind of stuff. Right. I don’t even I mean, like really thought about the fact that it’s I think we focus on like the physiological impacts of it being so much a part of and attached to us.
I don’t even think we consider as much. the real life implications of how that, you know, if you’re, if, if you do become a victim of SIM swapping, yeah, you’re right. They have literally access to everything because everything is on our phone and we can be so haphazard with it because it is just always there. It’s always on. I think it’s even easier to kind of let your guard down.
But I did want to ask you, you mentioned it was an employee at a store in Tennessee, but you hadn’t been to Tennessee in a while. Does it even have to be? How did that employee get? access to the information? Is it like these employees can access anybody’s information or do you have to have gone to this particular store? Go into a little bit of the background of maybe how someone might get access on the inside.
Mark Kreitzman:
Yeah, I mean, in my particular case, I can only guess as to what happened. At the time, I had been in cybersecurity for a long time, but I got really into crypto and I was doing my own crypto startup. And so I happened to be on a couple of YouTube videos and I was on two different websites. And so my guess is that somebody saw me, saw my name associated with crypto and thought I’d probably be a good target. And then an employee goes in their system, sees like, oh, they’re a customer. They’re on our carrier and I have access to this. And then all they got to do is just lie to the computer.
Now, I don’t think that that particular employee could. Do that on our own today. So at least the carriers, I think, have gotten two or three steps now, but they still can be tricked and soon swaps. are as bad as they ever have been. But I think that the way that I got particularly hit, that hopefully they’ve covered it. I’m going to assume they did.
But at this point, if you’re a U.S. citizen or you reside in the U.S., we have no data privacy. There’s been so many data breaches. There’s data breaches every single day. And some of them are just massive. There’s these Apache servers that companies like Facebook and Google and Amazon and other big companies that we’re using that help with authentication of users. And there’s this Apache conflict. And so billions of logins and passwords have been stolen in the last couple of years.
The company that does all the background checks on us, so anyone who’s ever gone to get a job or had to have a background check on you, that company got their entire database breached and stolen. And so that’s what, like, probably three generations or more of data on you, your siblings, your entire work history and all of that.
And so at this point, it used to be about… Going after actresses and trying to get into their iCloud. And then it was. just celebrities in general. Then they started going after people’s banks. When crypto came in, that basically sucked up all the energy of these SIM swappers. They started going after crypto because they could steal it. And then very difficult once your crypto is gone to try and get it back.
And then it became, I think, back to VIP people. And so executives started getting hit. A company started getting hit, so Marks & Spencer is one of the biggest names recently. And this is just probably five, six months ago, where a middle manager that I believe was part of their IT group gets SIM swapped. They then use that SIM swap to impersonate him internal to Marks & Spencer. They get an IT password reset. They use that access to then load ransomware on their point-of-sale devices. And that SIM swap cost Marks & Spencer €350 million because they took down their point-of-sale platform.
And this is not the first time this has happened. And so when people read the news, you have to kind of read in the details of the article to figure out and see, like, oh, this has actually started as a SIM. swap. But it’ll read, like, you know, Marks & Spencer hacked.
A financial company out of Manhattan where like two years ago, same thing, a middle manager got since swapped. It was a guy who had access to their backend systems. They deleted all the historical transactions. They stole the clientele personal information. They started getting spam messages and emails of claiming to be the company like, hey, we’ve been hacked and you need to click on this in order to secure yourself.
And then it took probably about 18 months to two years, and that company went bankrupt. They could not recover. They made all kinds of investments, and they hired a very high-level, well-known CISO. I got to talk to that. I had a video call with that CISO a couple times because we as a FONI wanted to try and help secure them. But they just couldn’t recover from. the people moved their assets out of that company, and then they just didn’t. Then they were secure wherever they moved it, and they didn’t want to move it back.
Cole French:
So you talked about the – you hinted at the fact that maybe some things have changed with. carriers as it relates to SIM swapping and maybe some improvements have been made. So talk a little bit about what were the weaknesses, and you’ve kind of touched on that already, but from a telecom perspective, like what are the weaknesses that were present that allowed this to really – persist? And then have you seen any changes in the telecom industry to curb some of this?
Mark Kreitzman:
Yeah. So the carriers, in general, you can add a pin, you can try and put something in your profile, but I doubt, I don’t think they follow it. I would say the biggest weakness 10 years ago is the same weakness that it is today. And that is that the way that the mobile carrier space is designed is all of their investments are upfront in the sales and marketing. And then just basic customer support. And that’s to sell you phones, finance you phones, get you to buy their mobile service, and try and lock you in on the mobile phone financing.
And then in the back end, when you want to do things like port out. So anyone listening to this, if you remember moving from one carrier to. another, for example, if you remember, you never had to call your carrier to cancel. And whoever you moved your… account to, your service to, they didn’t have to call your carrier as well. So there’s no humans involved in actually protecting your account in the end.
If you give another carrier a couple pieces of information about your mobile service, like when somebody wants to move to Afani, let’s say they want to use AT&T to Afani to have the security, if they give us a couple bits of information, let’s say they’re on T-Mobile today, they don’t need to call T-Mobile. We don’t need to call T-Mobile. but we have access into this portal to be able to pull them over.
And so the mobile space has determined that they’ve done the math and they’re willing to put up with X amount of fraud so that they don’t have to deal with 3X the amount of customer support it would require to actually protect you. So it’s like if you’re going to leave us, we’re not going to spend a dime on trying to keep you, other than maybe… Maybe if you had called customer support to do. it, and maybe they’ll try and keep you. But the money and the resources are not on that back end.
And so at Afani, what we’ve done is we’ve flipped it around. We’ve tried to offer the best bundle, one price, one service, make it compelling enough for the right person who’s got something to lose, provide a $5 million insurance plan. global data roaming, all for one single price, so that when people find us, we’re a no-brainer for them, so we don’t have to spend money on sales and marketing.
But if somebody ever wants to leave us, that’s where all of our resources are. And we have to do that. We’re motivated to do that because the insurance policy is our reputation, and we want to make sure it never gets utilized, and it hasn’t to this day. We’re going on our seventh year in a couple months. It’ll be our seven-year anniversary. It hasn’t been used yet. And so when somebody’s like, I want to do a risky transaction or I bought a new phone or I want to pour it out of a Fonny because I moved to Europe or something, that’s where we’re putting. all the resources. So we’re the exact opposite of what the industry is doing, and it’s all by humans.
Cole French:
Just to pull the thread a little bit on, what you said about they’re willing to put up with a certain amount of fraud. I mean, are there any consequences for these folks that, you know, these individuals at these telecom companies that are essentially perpetrating this? Have you heard of any, you know, there being any ramifications for this? or is this just like, you know, the, the, the telecom providers are just dealing with the fallout from it? or yeah, go into that a little bit.
Mark Kreitzman:
Yeah. I mean, you can Google where there’s been like insider, like gangs inside of, you know, the carriers that have been, you know, enabling these type of things for a while. They eventually get caught, and those people get charged with crimes. In terms of the CIMSWA packers themselves, like the outsiders that are not working for a carrier, but they are doing the social engineering, it’s very rare. they get caught. And typically the way they get caught is because they’re like 16 years old, and they all of a sudden have a Ferrari.
So there’s a 15-year-old kid who had worked with this older guy. And he since swapped Michael Turpin, who is a big-name investor and was a big name in Bitcoin, and they stole $24.5 million from him. And this kid’s 15 years old. And it was just simply social engineering. And that same 15-year-old kid, I think he might have turned 16 when he did this, but then he hit a guy named Rob Ross. And I actually talked to Mike. In fact, I’m talking to Michael Turpin on Friday. Rob Ross consulted for us for a while. He got hit for $1.8 million by the same 15, 16-year-old kid.
And the reason he got caught is that he was living the high life as a 16-year-old kid, but this older guy he had worked with also couldn’t control his drinking and drug use. And then I guess opened up a little bit too much. And so they eventually got caught. now now the other sort of warning for people is uh this goes back by probably eight years ago and michael turpin got since swapped and i got all that money stolen and so at that. time. what he did is he took those. he took the couple mobile numbers he had at that time when that they used to attack him and he parked it and so he didn’t want those numbers to be given up.
now he through some, there’s like some personal things that I don’t want to say, but those numbers were parked and they were parked with somebody else. And literally like six months ago, that other person decided to let him go. And somebody who was part of that original hacker group that wasn’t in prison had waited and monitored those the entire time. And as soon as they became available, they grabbed him. And then just literally a couple of months ago, they were trying to blackmail Michael Turpin again.
And so one of the questions we get is, oh, well, should I port my number over to Afani or should I get a new number? And we always say that you’ve got to be very careful. We recommend porting your existing number over to us because we’re going to protect it and we’re going to insure it and we’re going to take care of you because if you. give that up, then we don’t know who’s waiting for it. Maybe it’s even accidental. Somebody grabs it. They go to try and set up an account somewhere and realize, oh, there’s something already attached to this number.
And so anytime you’re going to give up a number, it’s best maybe park it for a couple months. so you have the time. There’s places where you can pay them like $3, $5 a month. Just simply hold your number and take the time to make sure that it’s removed from your banking, your email, from everything. Like if you get divorced, for example, make sure that your spouse’s, your ex’s numbers are removed from your personal accounts. A lot of people kind of forget about that. And they may get SIM swapped three years down the road, and maybe they weren’t intending to cause damage to you, but it ends up hurting you. So these are the kind of things that we all got to think about.
Cole French:
And that’s a lot to think about. Like you just described in that scenario, there are so many ramifications and those ramifications could be, you know, five, 10 years down the road if. you don’t take the necessary precautions right now. So before we get into more of like, how do we, how could we prevent SIM swapping? How do you protect yourself?
I just want to pivot a little bit to kind of what we do here at Kratos, which is, you know, cyber compliance, kind of live in that compliance space. Of course, multi-factor authentication is a big thing that we talk about a lot. And phones are very integrated or phone numbers, I should say, with, you know, SMS integration or SMS use within multi-factor authentication.
So just from like a compliance perspective, right? How can, in your opinion, you know, how do compliance frameworks play a part in helping reduce SIM swap exposure? Or do they? Or is that a, do you view that as a current gap? out there in the compliance space?
Mark Kreitzman:
i would say that you know the compliance. if you’re talking about the compliance regulations that are for like sec and you know financial space or like government entities or government contractors like what’s the main one for government contractors like cmmc something like that where if you look at the regulations it’s not very. specific on mobile and and so you know we get calls every once in a while from from government contractors that want to be compliant.
And so we can’t point anything out specific to say, like, hey, we’re going to make you match these five or six features of this, other than, hey, we can help protect and secure regardless. And so we’ve closed some sales there. But I think in the mobile space, the compliance regulations probably need to be looked at, maybe even made a little bit tighter. for companies to make sure that a company actually protects themselves for their own good.
Because a lot of companies out there, including government contractors, there’s a BYOD strategy left over from many, many years ago where they’re allowing employees, executives, to pay for their own mobile service, their own choice, pay for their own devices, and then they subsidize. They might pay them $50 a month or $70 a month. pay their phone bill and not thinking about the fact that mobile devices can be like Trojan horses.
So if somebody clicks on the wrong link or they have access behind the secure doors, so to speak, authentication of. an organization, and then they get SIM swapped when they have that kind of access, or they’ve clicked on links and opened up photos and things, And then they’re like a Trojan horse, go get connected to the company network. This is kind of dangerous.
And so it’s one of the trends we’re seeing is that more and more companies are going back to providing work phones. And so I just had a great call yesterday. It was a company that currently has 50 BYOD users. And they are going to supply 50 phones, brand new iPhones. 50 secure mobile service type lines, and it’s going to be work only, and they’re not allowed to use it for any kind of personal. And so that’s one of the trends that I’m seeing. And to me, I think that compliance should probably address that part of it. I think that companies need to start looking at doing that.
Cole French:
I think historically compliance has focused mostly on the device. And I’m not saying that there’s no thought given to what might be on that device, but really it’s a very simplistic mindset of the device and the data that might be on. the device. And obviously that’s important, what we’ve talked about, right? But we almost have to think about it in a third way, which is not just the data, but all of the integrations with who that person is that resides on that device. aware of and work with, I would say address that particular part of it.
Now the MFA part, it sounds like from what you just described, you even had like specific instructions on your account, not to do anything with your account without driver’s license, passport, all that stuff. So MFA is something we’ve seen proliferate quite a bit and it’s very integrated again with mobile devices. So do you see that as a good thing? Does that create an additional risk when it comes to things like? Things like SIM swapping, just talk a little bit about MFA and particularly using SMS.
Mark Kreitzman:
Yeah, SMS is definitely the biggest gap in mobile. And one of the reasons it’s still a gap is, one, people don’t really think about it. They set up their email verification just on SMS. But one of the biggest gaps is that 80% of the financial institutions in the U.S., as an. example, are still SMS.
And I have all kinds of conversations with cybersecurity consultants that are deep into these type of topics. And every time I talk to them, we always come to the conclusion that our theory is that like a big bank still uses SMS because they’ve also done the math. And they’re also willing to accept fraud in trade for – imagine a bank says, okay, you can now use authenticator apps and YubiKeys.
and all the people out there that are non-techies that set up an authenticator app, and the very next day they lose access to their authenticator app or they accidentally delete the app or reset their phone somehow, now they’re going to call the bank. And so the bank’s customer support costs are probably going to go up five, eight, tenfold. Having to deal with people that lost their YubiKeys or elderly people that… Don’t understand, like, it’s asking me for a six-digit code. What am I supposed to do? And so they just have done the math and said, yeah, we’ll just accept some fraud and deal with it on the back end.
But a lot of it is just people don’t. really know how bad this can happen, what can happen, and that it’s even a danger. A lot of people don’t, like a couple myths that people have are, well, for me to get SIM swapped, I have to physically lose my phone. The reality is that you could have the most expensive secure phone on the planet, the best antivirus, the best VPN, diamond-encrusted phone, you paid $10,000 for it, and put it in a Faraday bag, put that in a safe, drop it in South Lake Tahoe.
It’s not protected against SIM swaps because the change is made in the carrier’s network, and your phone is not even in the equation. So all the investment you’ve made on the phone, is not even part of the equation anymore because AT&T, Verizon, T-Mobile, the network is now pointing to the phone in my hand. And so that’s one of the big myths. And so a lot of people just don’t really get hit because they don’t really realize that they are even vulnerable.
Cole French:
So now that we’ve kind of gone through all of what SIM swapping is, what the ramifications are, what the consequences are, the dangers, all that kind of stuff. Now I definitely want to get into, and I’m sure our listeners out there as well, how do we protect ourselves from this? What do we do to prevent this from happening? We want to talk a little bit about things that we can do on the ground level that will help protect us.
Mark Kreitzman:
Yeah, absolutely. So I’m going to start with the things that are free and that people can do as soon as they get done listening to this that they can do. And so part of it is just kind of thinking about this and then taking action.
One of the patterns of the victims is that many of them will set up their phone, their iPhone, their Android phone with an email. They then use that email to open up and use it for their Bank of America account, for their Wells Fargo account, for their Coinbase or Kraken crypto accounts and everything else. And then they also take that email and they use that to sign up for free AI website tools. Whatever it is. It could be dating apps. And then they also use it to send emails to friends, family, everything.
And so one thing I want everybody to think about is that when you make your email public, that’s half the equation. You have a login. You have a password. So if you’re giving people the login, now what somebody can do is they could go to all the top 10 banks in the U.S., all the top 10 crypto accounts, whatever. and put your email in there and just simply say forgot password. And it’s going to react to them, and it’s going to tell them something like, we just texted you a code, enter the SMS code. Or we just sent you a six-digit code, enter the code from your authenticator app.
And so now people can prep and do work on you. And now they know what they need. So if it asks for an SMS code, now they clearly, like, all I’ve got to do is SIM swap this person. This account’s toast. And they could go through, like, all your accounts and do this. And so, you know, it’s easy for them to do prep work. And then they can even automate it. Let’s say they get lists of people, like their names and. phone numbers, and then they could actually set up some sort of AI tool that just simply rotates through it and then says, like, hey, these are the 10 targets for today because they’re all SMS.
But even if you have an authenticator app, you know, if you have an application that allows authenticator app, you definitely want to do it. It’s definitely more secure than just having SMS. But you also want to realize that if you get SIM swapped and they get into your email, they can then, via your email, also recite your authenticator app. And so I’ve talked to plenty of victims that have had their email, they got SIM swapped, their email is getting taken over, and then they use that to take over their authenticator app. They then use that to destroy their financial life, whether it’s Bitcoin or… or getting into, like, dating apps, things like that.
Now, if they can use the physical, like, the YubiKey style, then you want to do that as well. And then also you want to think about the fact that every application you want to look at it, because if you start with SMS and you. add authenticator app and add a YubiKey, you want to make sure that you’re removing the other methods, because they could SYN swap you, get into, like, your account, And then once they get in the settings, maybe they could remove one of your other authentication methods. And so you just want to be careful what you click on.
Use private emails for your proprietary accounts. So have one that you use to email family, friends, and maybe another one to use to sign up for free website tools, free trials, things like that. But have ones where you keep them totally separate. And you use those for your banking. You use those for your crypto. You use those for your business. If you own an SMB, and a lot of people, they own a small business, and their mobile account is tied to the hosting account, their payroll, everything associated with that business. And if they SIM swap you, they can just literally destroy you.
One of our customers was out of Phoenix. She built up a business with her boyfriend. Revenues of $650,000 selling IT gear. And they broke up. Her ex-boyfriend then sin-swapped her and basically destroyed. the entire business. Basically used the sin-swap to take the website down, take payroll down, take everything down. And basically bankrupt the healthy business in a matter of a couple hours. It was difficult for her to bring it back. And we like adding customers, but it’s kind of sad to talk to people like that. Yeah.
Cole French:
So then the first thing is just basically uncouple or decouple accounts as much as possible, particularly email accounts. So be purposeful about what you’re connecting to what and what the ramifications of that might be. The more sensitive the application, the institution, whatever it might be that has that information, the more it’s susceptible to being taken.
Mark Kreitzman:
All these email accounts, your landlines, your mobile numbers, your emails, they’re all being profiled to you. And there are AI tools out there where you can say, okay, go and take a look at this person. Tell me all the… phone numbers and emails associated with that person and it’ll. it’ll get like your brothers and sisters and parents phone numbers and emails as well but it will profile to you and and an example of this is a guy wanted to show me. he wanted to demo a simple ai sales lead tool to me. so i was like okay great and it had to do with linkedin.
so the first step of the tool is you. you give it some criteria to find some people and so i gave it criteria to get a thousand executives that were working for like you know big name companies but also had bitcoin in their profile or crypto in their profile and then and then we can’t. we kept adding some criteria and we got it down to a thousand people. i knew i would be in that list. i’m like okay great now show me the ai portion but only do it on me because we’re data privacy. i don’t want to see somebody else’s data.
so it runs for like a minute comes back and it had an email on there where i had Kept it so private, I thought there’s no way it would find this. And I could not wait to get off this simple demo call because I could not believe that it found this email that I had used for three different crypto accounts. And sure enough, as soon. as that call ended, I totally forgot about whether I was even interested in this product. I went immediately, created a couple different Proton emails and reset those because I was just kind of amazed. you know, profile to me.
And, uh, and so the, you know, the data collection. at this point, a lot of people, you know, they want to be off grid with their mobile account or however they use the internet. But even on like mobile accounts, there’s what’s called device fingerprinting, uh, browser fingerprinting. And even if you’re using like a brave browser and a VPN and all of that, cause like the brave browser, like randomizes your, uh, things about how you use your phone. to the Internet, even that randomization can become part of the fingerprint.
And so you could go to one website after you’ve been fingerprinted and use it, and then go to a different one, and let’s say Google Analytics can recognize you. Not by name, not by phone number, not by device ID or anything like that, but just simply because it matches this profile, and it could be an advertising profile, but it could match a device fingerprint. that’s based on font, that you mainly use, the font size, the setup you have on your phone, everything about your phone, just all the settings, everything, that it may be able to recognize.
And so a brand new company that has no relationship to you, has never seen your device before, via Google Analytics or other software they can use, could recognize you. And this is the way that… This is the world we live in. Smartphones. I had a company call and wanted me to use their advertising they do on television for smart TVs. And they’re like, we can insert ads into… People use streaming services like Google TV, things like that, insert ads. And then you just put up QR codes. And so somebody’s sitting on a couch and they can scan with a QR code. And I’m like, yeah, but… Is it measurable? And they’re like, oh, yeah, we know who they are.
And so ultimately, I didn’t decide with that because we don’t like using cookies. We don’t want trackers. That’s kind of against our whole philosophy. And so we will do videos where we’ll put QR codes in our own. type videos because. the Afani YouTube channel, we’ve got this really unusually high number of people that watch on televisions, which I guess is fine. So we’ll put up a QR code, but there’s like no tracking, none of that.
But smart TVs are tracking you. Apple AirTags can track you. You may think that you’re being private, but you go home and every day you attach to a Wi-Fi network that you pay in your name. And it can recognize your phone is connecting to like Wi-Fi devices around you. So it’s your neighbor’s Wi-Fi. So anyone who thinks that they’re going to like hide from the government, like if the government wants to know where you are, then, yeah, they’re going to look and they’re going to see a blue dot.
Cole French:
And I think what you’re getting at, you know, by sharing a lot of anecdotal examples is it’s really not that hard. It’s like it’s all around. It’s not. It’s so pervasive.
Mark Kreitzman:
It’s one of the reasons why, like, at Fonny, we also don’t make claims about, we’re security first, so we can secure you. So securing you, meaning, like, you’re not going to get your call records and your. SMS records, you know, released to the wrong person, and you’re not going to get SIM swapped, and we’ll protect phone stores and customer support reps and other carriers from being able to make changes or move your mobile account away.
But we don’t claim the off-grid type things like a couple of our competitors because it is impossible. And so anyone who makes these kind of claims, it’s a marketing claim. It’s not reality. I wish it was. And I always say this when I get interviewed or get asked about it. I always say, I heard our sales probably 5% to 10% because other people will claim they can do this.
But it’s just not. We’re using basically a public. utility that has federal laws of protection. The telco industry, the mobile industry, is protected by federal law. Even if somebody posted on public, like, I’m going to hack the carrier, or I have, you’ve broken federal law just simply by claiming that you have. Even if you didn’t, that’s how protected it is, and therefore it’s just very, very hard to hide.
Cole French:
So then what do you guys do? So you talked about the free things, right, that you can do, that everybody can do to protect themselves. Now, are there other sort of free things that people could do, you know, start doing 10 minutes from now? Or, you know, what do you guys do to help protect folks from SIM swapping?
Mark Kreitzman:
Yeah, well, definitely be careful what you click on. As I say, separate out like email IDs, proprietary, fund, family, things like that. Definitely use a VPN. Use a VPN where possible. It’s not going to save you 100%, but hiding your IP, masking your IP whenever possible is better to do that than not. Be very careful about volunteering your information all over the place with free websites, free signups, free giveaways, things like that, because people are using that information. They’re selling your information. profiling you, and so those are things that you can do for free.
Now, with Afani, the way we protect people is that we’re what’s called a full MVNO, and so we own a customer’s account. So when people use Afani, they ported their number over to Afani, and then we can assign them to use either the AT&T network or the Verizon network for their primary voice, text, and data. To the carrier, the underlying carrier, you look like an anonymous executive.
So a lot of people don’t think about the fact that when you have a carrier account, you have a credit account. They have your Social Security, your birthday, your payment information, all of that. And that’s how you can go into a phone store and finance a phone, because it’s a credit account. A phone is prepaid. We don’t have to follow the same KYC, know your customer type. So we don’t have to collect all your information. We don’t collect birthday, Social Security, and we’re not giving that to the carrier. So the address the carrier has, names that the carrier has, it’s meant to mask you. And the carriers are locked out. They can’t make changes.
And then when you port your number over to Afani, even if you gave out a couple random bits of information about your account, They can’t go to another carrier and port you out because when you port over to Afani, we’re removing you from that sort of global portal access that all the other resellers and carriers and stores have. We’re pulling you out of. that. And so for somebody to move your account, they have to call us. They have to go through 11 layers of verification in order to make that very risky transaction.
And so one of the things that we’re doing is that we’re willing to spend the time with somebody on the verification part of it to make sure we never give away call records, SMS records. We don’t collect that information, by the way. If they’re a customer of ours and they want the last 30 days of call records, they can formally submit it. We then submit that to the carrier. We aren’t required to carry it, so we don’t. And we don’t want it. But all the carriers are under what’s called CALEA law, and they’re federally acquired to keep all the – they don’t have access to content. It’s just who you called, who called you, and SMS. And so that’s available. But for us, we’re not even storing that.
But when somebody calls in and says, I’m moving to Europe, I don’t need a FONI anymore, then we’re going to take them through 11 layers of verifying them. A couple of them, they’re not going. to know what those layers are. But the easy ones are going to be like, what email account do you have on file? What’s your payment method on file? And then we’ll switch it up so they can be in different orders. We’re going to text them, make sure they can receive the text. They have control of the phone number. We’re going to call them, make sure that they’re the ones that pick up. We may email them and say, respond back to this email.
Something that we might do is, say, look at the hidden header information. Is the person claiming to be in New York, but they’re actually out of Tokyo or Australia or L.A.? Or are they trying to mask themselves? So we’re looking for something to determine whether we need to go deeper in it. So some of the steps are just sort of like the obvious. Like, hey, we just sent you a credit to your payment method. So we have some people that pay on crypto. So without telling them the payment method, it’s like we just sent you a credit. So they could go look at their crypto account. Or it could. be. we just sent a credit, and they know what credit card they use on file. And then we’re going to take them through this.
So the carriers don’t want humans involved, but we’re pretty much majority humans involved to make sure that we’re going to protect the person. And so one way to protect yourself, at least from the SIM swaps and protecting your account information, would be to port your number over to Afani. And we only offer AT&T and Verizon.
Now, a couple other things that we do to protect people is we enable Wi-Fi calling globally. So if you’re an Afani customer, you can just toggle on your Wi-Fi calling. And even if you’re at home, what it means is your phone calls and texts and everything are kept off of the cellular network, so you’re not even going through the cellular. connection between you and the tower. And so I use Wi-Fi calling, and your Wi-Fi calls are encrypted as well.
And it also means that if I’m on vacation in Bali, Indonesia, and I’m behind a Wi-Fi connection, it doesn’t matter whether it’s a hotel Wi-Fi or a hotspot, or I have a little. portable dongle. If I’ve got a secondary data connection, and you call my Afani number, it’s going to ring. And it’s free. It’s unlimited. I can talk all day long. And I can also call back to the U.S. It’s unlimited for free. And again, those are encrypted phone calls.
On our AT&T option, we offer 500 free international calling minutes. So if I’m in the U.S., I can call Spain, Germany, Australia, and there’s no additional cost. If I’m in Bali, Indonesia, and I wanted to call Spain, Germany, I have 500 free minutes to do that. Unlimited to the U.S., but 500 international calling minutes.
We also, at no extra cost, provide what we call a dual eSIM configuration. Like, for example, in my main phone, AT&T is my eSIM 1 for voice data talks. And then we also provide complimentary a secondary data eSIM. So we have an Afani global data eSIM that has over 450 carriers in it, and it has anywhere from two to four carriers in around 200 countries. In the U.S., it has AT&T, Verizon, and T-Mobile.
So even when I’m in the U.S., If I want to, I can switch my data. to the secondary data eSIM and use Verizon. I can use T-Mobile. So an example would be I used to own a cabin up in Bear Valley in the Sierras in northern California, and only Verizon worked at the top of the hill. Now, at the time, I didn’t have Verizon, so when I went skiing, I didn’t have mobile access. But now with this dual eSIM config, I could have just simply switched my data over to Verizon. I go skiing. I have data. I can use my apps and all of that if I wanted to.
And then when I travel overseas, when I land in Singapore, I have four carriers. in Singapore I can choose from. If I land in Tokyo, I have three carriers. If I land in Thailand, I have three carriers. And this LTE is 5G speed.
And so the other way you can protect yourself, whether you use a FONI or not, is stay off of 3G. So 3G and 2G are very susceptible to what’s called MZ catchers or stingrays. And these are devices. Stingrays are the official device that costs like $100,000 up to like $500,000. And these are used by. like the FBI and CIA and things like that. MZ catchers are do-it-yourself where they go on the Internet and they find a plan where it’s like. it’s illegal to build this, but if you wanted to, here’s how to do it. like a Crock-Pop bomb or something like that.
And so people can build these on themselves. If they get between you and the cell tower, then they can break down your 3G. And so they might be able to listen to a phone call. They might be able to grab a text message. And so when you travel overseas, then same thing. So we don’t want our customers using cheap travel eSIMs so that when they get outside of Bangkok or gets outside of like downtown. Sydney, Australia, then all of a sudden they’re on 3G. We don’t want people, at least our customers, to be vulnerable like that. And so another way to protect yourself is to stay off of 3G and 2G.
Cole French:
So Mark, I really appreciate you coming on today. This has been a tremendously enlightening conversation just for me. This is something that I knew existed, but I hadn’t really… peeled back the layers. of the onion on exactly what I think. if an organization wants to incorporate, you know, SIM swap considerations into their policies, compliance, things like that, what’s the best starting point for them? if they were to start, you know, right after this episode is over?
Mark Kreitzman:
Yeah. And would that be in respect to like contacting Afani or?
Cole French:
That would just be. That would be just from an organization. What should they be thinking about? What should they decide? Hey, I’m going to go research this, whatever the action is.
Mark Kreitzman:
Yeah, I would say that if I were, say, an IT manager, director, or CISO of a company, and I wanted to try and close the gap on the potential synth swap, first I would start out by inventorying. All the employees that use mobile phones for work, and do any of them use their mobile number for authentication of anything that has to do with company-related things? And start there. And then try and do a risk assessment as to what would happen if that particular phone number got SIM swapped. What could they do internally? Could they impersonate? That person inside of the company after they’ve sim-swapped them.
It may not be where they sim-swap them and they can immediately, like, hack in, but it could be sim-swapping, like with Marks & Spencer, sim-swapping, impersonating, and doing damage. And then educating all the employees on the importance of how they need to protect themselves, especially if they’re in a BYOD-type environment where the employees own risky behavior could put the company at great risk. And so they need to educate their people about that as well. But they definitely have to look at all the authentication message for all the applications and maybe start there.
Cole French:
And I think that’s great advice. We tell people sort of on the more traditional IT side of things all the time, if you don’t actually know what’s connected to your network, Then all the security things you’re doing in a lot of ways, you’re kind of shooting in the dark. You need to know and understand what kind of assets are on your network, who’s on your network, what kind of data they have access to, how is that data access to all those things. I think those are great, great places to start. And again, Mark, just really appreciate you coming. on today. And I really enjoyed this conversation. I know our listeners will too.
Mark Kreitzman:
Yeah, absolutely. I enjoyed it. Thanks a lot, Cole, for having me on. And if you ever want to have me back, maybe we want to have a session dedicated to mobile compliance. Yeah. Or having stuff. It might be interesting to do one of those.
Cole French:
Yeah, that would be fantastic. I’d definitely be interested.
Thank you for joining us on the Cyber Compliance and Beyond podcast. We want to hear from you. What unanswered questions would you like us to tackle? Is there a topic you’d like us to discuss? Or you just have some feedback for us? Let us know on LinkedIn and Twitter at Kratos Defense or by email at ccbeyond at kratosdefense.com. We hope you’ll join us again for our next episode. And until then, keep building security into the fabric of what you do.
