SIM-related frauds on the rise in Nigeria

• …Telcos, experts speak

Donning one of the telecom operators’ branded T-shirt; he approached her for a SIM upgrade assistance. He claimed his office had sent him out to help their customers upgrade their Second Generation (2G) and Third Generation (3G) networks to 4G, which is the fastest telecom network in existence in Nigeria at the moment.

She handed him her phone having believed he was sent by her telecom network, his “office’’. He collected the phone, removed her SIM without her paying, inserted another SIM and put the phone on ‘Airplane mode’. Job done! ‘SIM upgrade’ concluded!

He handed back the phone to her and told her she would not get network on the phone for 30minutes. “This is as a result of the SIM upgrade’’, he told her. She didn’t pay attention to the ‘Airplane mode’ signal and she waited for 30 minutes without network. Another 30minutes without network, she thought it would still appear. But after several hours had gone and still without network, she became worried. 

She reached out to somewhat ‘techy’ guy, who switched on ‘Airplane mode’ after examining the phone. Her telecom network appeared. She heaved a sigh of relief. She thanked the techie guy. But that was not the end of ordeal.  After powering the phone on, she started getting calls from strange people; people who weren’t from her contact, demanding to “speak with the owner of this line’’.   “Hello, I am the owner but I don’t know you’’, she would respond.

This went on until she called her husband who then asked after having recognised her voice as his wife: “why are you calling with a strange number? “Strange number?’’, she asked.  ‘’Didn’t you have my number saved in your phone?’’. “This is not your number I saved’’, he replied. It was at this juncture she realised her SIM might have been taken and substituted by another SIM. That was all. Withdrawal alerts started pouring into the phone, not from account but from account of the owner of SIM substituted for hers by the SIM upgrading fraudster.

Realised she might have been scammed by the fraudster; she rushed to her banks to check her bank accounts. But they all read zero naira and few kobos. Sad!       

What happened to Mopelola’Ibrahim (not real her name) is the trending SIM card related fraud being perpetrated by fraudsters known here in Nigeria as yahoo, yahoo boys.

They approach SIM card owner and ask him/her they want to upgrade their SIM for them, claiming they are working for one of the country’s telecom companies. Once they get hold of their potential victims’ phones, they then exchange the SIM cards with that of their previous victims. Then they ‘shut’ him or her of the network by putting on the Airplane Mode, apparently to prevent the victim from knowing that his/her money is being withdrawn from the accounts.     

This has happened to some Nigerians in recent weeks and it seems the crime is increasing by the day.  

A report by Kaspersky Lab showed that mobile payments and the banking system are suffering a wave of attacks – mostly powered by SIM card-related fraud – and people are losing their money, millions of naira, as a result.

This type of attack is used to not only steal credentials and capture one-time passwords (OTPs) sent via an SMS, but also to cause financial damage to victims, resetting the accounts on financial services, allowing the fraudsters access to currency accounts not only in banks but also in fintechs and credit unions.

Experts said a lot of people are highly ignorant to how losing their phones to fraudsters can lead to a complete clean-up of their bank accounts.

A fraudster arrested by the Police early this year confessed to how he stole money from people’s bank accounts through their SIM cards. He claimed he did the “Wire Wire” also called SIM transaction or “Joker wire” when he unlocked, transferred and withdrew from SIM cards that were linked to bank accounts.

In a viral video in February, the arrested fraudster confessed that once he got hold of such a phone, he gained access to it easily by dialing a certain code which would then reveal the bank account connected to the SIM card.

For example, if it is an AXY bank acount, he would dial a certain code (code and name the bank intentionally concealed by this reporter) to show the user’s account balance. He would then proceed to reset the PIN, and the bank would ask for the account number and date of birth of the account holder. Since a lot of people save their account number on their contact list, he would easily get it there.

He would then proceed to use the account number to get the victim’s BVN, then use the BVN to get all his/her details by dialing a certain code. With this information, he proceeded to reset the PIN, and then used the date of birth to create a new PIN. From there, he was be able to transfer money out of the account.

But this is not a Nigeria-only thing.  Senior Security Researcher of Kaspersky Lab, Fabio Assolini, said despite financial inclusion services prospering, the flip side to this is that it opens up a world of opportunities to cybercriminals and fraudsters, who are using the convenience a mobile phone offers to exploit and poke holes in a two-factor authentication processes.

   Assolini said frauds using SIM cards are becoming common in Africa and Middle East, affecting countries like South Africa, Mozambique, Turkey and UAE. According to him, the total money lost in the attacks varies by country: there are extreme cases, such as one in the United Arab Emirates, where one victim lost $ 1 million, while in South Africa one victim reported losing $ 20,000. “In average, fraudsters can steal $2,500 to $3,000 per victim, while the cost to perform the SIM swap starts with $10 to $40.”

However, a telecoms expert, Nwabuko Chike said the rise in SIM related frauds should be blamed on Nigeria’s worsening economic situation. Though, Chike didn’t justify the crime and youths involvement in it, he said it is painful that more SIM card fraudsters are emerging every day and millions of naira are being lost.  

“When the youths are not engaged constructively, they tend to go into crime’’, he said.

He noted that fraudsters use phishing attacks to obtain victims’ cellphone or Internet banking login details to wreak havoc on them.

He advised phone users who have their SIM cards linked to their accounts to jealously guard their SIMs and not make them available to any stranger in the guise of SIM upgrade. “This is the only option or solution for now’’, he said.

The Nigerian Communications Commission (NCC) refused to comment on the issue. Its spokesperson, Dr Ikechukwu Adinde did not respond to our reporter’s enquiry. 

But responding to Daily Trust’s enquiry, the joint spokesperson of the big four telecom companies, Engr Gbenga Adebayo said the data available to them showed that SIM related frauds are reducing in the country.

“That assertion is completely different from the data that is available to us’’, Adebayo told Daily Trust.

However, the NCC recently identified SIM  swaps and Unstructured Supplementary Service Data (USSD) e-payment frauds as some of the cyber threats confronting the telecom industry.

The commission disclosed that attackers target telecom networks with the intent of getting access to consumers’ information in the databank of service providers.

At the maiden edition of a sensitisation programme tagged “Shine your eyes, no fall mugu”, in Benin City, on November 25, Director, Consumer Affairs Bureau of NCC, Efosa Idehen noted that fraudsters conduct SIM swaps of targeted individuals and then carry out USSD-based transactions to defraud citizens of their money.

Idehen, who was represented by Clement Omife, a deputy director in his department, advised Nigerians to be careful when opening unfamiliar emails or responding to unfamiliar inquiries so as not to fall prey to cyber criminals.

“These fraudsters do this by stealing victims’ identities- names, address, bank information and other information which they use in gaining access to their victims’ bank accounts.”

They also use the stolen identities to defraud other people and even apply for loans or make online purchases, leaving the victims with debts,” Idehen said.

He said the enlightenment programme which was organised by the commission in conjunction with the African Entrepreneurial and Human Development Initiatives, was to empower telecom consumers with knowledge and inform them to be alert not to fall victim of fraudsters.

“As the telecom industry evolves, there are growing concerns over the rising trend of fraud perpetuated on the platform (electronic fraud) across key sectors of the Nigerian economy.

“The menace, which follows wide acceptance of new methods of mobile money and electronic banking and payment systems, has been discovered to cost the country whooping sums of money.

“It is in view of this and in line with its consumer-centric posture that the commission with relevant advocacy groups, embarked on this sensitisation programme in locations across the country, starting with Benin City, Edo State,” he said.

He emphasized that effective collaboration between government agencies, private organisations and individuals is pivotal in tackling the menace of electronic fraud.