{"id":30452,"date":"2020-03-02T16:33:31","date_gmt":"2020-03-02T21:33:31","guid":{"rendered":"https:\/\/tcn.tidbits.com\/?p=7633"},"modified":"2020-02-24T08:55:23","modified_gmt":"2020-02-24T13:55:23","slug":"to-prevent-spearfishing-set-a-pin-or-passcode-on-your-cell-phone-account","status":"publish","type":"post","link":"https:\/\/www.computeradvantage.us\/v3\/to-prevent-spearfishing-set-a-pin-or-passcode-on-your-cell-phone-account\/","title":{"rendered":"To Prevent Spearfishing, Set a PIN or Passcode on Your Cell Phone Account"},"content":{"rendered":"

Spearfishing. It\u2019s no longer just a tropical ocean sport that could provide seafood for dinner. In today\u2019s tech world, spearfishing<\/i> is when someone targets you specifically, usually with the goal of taking over your online accounts. Once that\u2019s done, the attacker will try to siphon money from your bank account, impersonate you in an attempt to deceive family or colleagues into sending money, or attempt to ruin your reputation.<\/p>\n

You\u2019re probably thinking, \u201cNo one would ever target me. I\u2019m not interesting enough.\u201d It is true that the people who should worry the most about spearfishing attacks are high profile or have a high net worth, but modern online criminals aren\u2019t that fussy. After all have something<\/em> and getting. In particular, they\u2019re more likely to go after older people. Why older people? Older people tend to be relatively well off and less likely to notice the symptoms of a spearfishing attempt. You should also be concerned if you’ve ever been involved in an ugly divorce or legal battle, or can easily think of people who have it in for you.<\/p>\n

As we\u2019ve mentioned in the past, it\u2019s imperative that you use a secure password manager like 1Password<\/a> or LastPass<\/a> to create, store, and enter a strong, unique password for each of your online accounts. Plus, we strongly recommend using two-factor authentication\u2014where you have to enter a one-time code in addition to your password\u2014on all accounts that support it, particularly important ones like your email and banking accounts. But even if you do all that, you may be vulnerable to another tactic favored by spearfishers\u2014the cell phone SIM takeover.<\/p>\n

Here\u2019s how it works. Every cell phone, including every iPhone, has inside it a SIM card that gives it a phone number. Swap that SIM into a different phone and it will adopt the SIM card\u2019s number. The problem is that support reps at cellular carriers like AT&T, Sprint, T-Mobile, and Verizon can also move your phone number from one SIM card to another. That makes it possible for you to lose your iPhone, buy a new one, and have your phone number associated with the new one. It also lets you port the phone number to a different carrier, if you wish to switch.<\/p>\n

All an attacker has to do is call your cellular provider, pretend to be you, say that they\u2019ve lost their iPhone, and ask to have the number ported to a new device (one they control). It\u2019s likely that the support person will ask a few simple questions to verify your identity, but a clever attacker will likely know your address and be able to learn details like your mother\u2019s maiden name, first-grade teacher\u2019s name, and favorite color, all thanks to Facebook and the social media and online sources. Criminals can acquire even information like your Social Security number through other data breaches.<\/p>\n

Once the attacker controls your cell phone number, they can try to reset the password on various accounts, receiving any verification codes that would normally have been texted to your phone. They\u2019ll probably focus on your email account first because, with control over it, they can reset passwords elsewhere even more easily. And once the attacker has access to your accounts, it\u2019s game over, and you\u2019ll be faced with the difficult and complex task of retaking control and mitigating damage.<\/p>\n

How can you protect yourself from such an attack? Whenever possible, it\u2019s better to generate authentication codes with an app such as 1Password<\/a>, Authy<\/a>, or LastPass<\/a>. That removes some of your exposure, but for better or worse, your cell phone number is still the most basic form of identity for many things.<\/p>\n

The most important thing to do, then, is to set up an additional PIN or passcode that the carrier will ask for before making any changes to your account. You\u2019ll also have to provide it when logging in to your cellular account online. Such a PIN or passcode is different from a two-factor authentication code that changes continuously\u2014you set your PIN or passcode just like you do for your iPhone or ATM card. And, of course, make sure to store that PIN or passcode in your password manager alongside your other credentials so you don\u2019t forget it.<\/p>\n

Learn more about how each of the major carriers supports PINs and passcodes at the links below, and if your carrier isn\u2019t listed, call the company\u2019s support line:<\/p>\n