M&S Cyber-Attack: How to Protect Yourself from Sim-Swap Fraud

The recent cyber-attack on Marks & Spencer (M&S) has highlighted the growing threat of sim-swap fraud, a form of identity theft that can have devastating consequences for individuals and businesses alike. As our mobile phone numbers become increasingly important forms of identification, it's essential to understand how to protect ourselves from this type of attack.

The M&S hack, which occurred in April, forced the company to stop taking online orders and caused disruption to some of its stores. The estimated £300m hit to profits is a stark reminder of the potential consequences of sim-swap fraud. So, what exactly is sim-swap fraud, and how can we protect ourselves from it?

Sim-swap fraud involves a scammer obtaining your mobile phone number and using it to make calls and send SMS messages in your name. This can be done by tricking your service provider into transferring your number to the scammer's device or by exploiting vulnerabilities in two-factor authentication (2FA) systems.

The problem begins when you buy a new phone or sim card, and you call your service provider to transfer your longstanding mobile number to the new device. The service provider may ask you a series of questions to verify your identity, but what if someone else has already obtained the answers to these questions? Or, what if the service provider is taken in by a convincing tale of woe and falls for a sim-swap scam?

Unfortunately, sim-swap fraud is not just a problem for individuals; it can also be used to target high-profile targets with access to sensitive systems. This has led some services to switch to sending time-limited codes to messaging services like WhatsApp, but this approach is not foolproof.

In response to the growing threat of sim-swap fraud, there is a rising adoption of authentication apps that display a synchronised code to ensure authenticity. However, even with these measures in place, nothing is 100% secure. That's why efforts to improve login security have led to the rise of what are known as passkeys – long sequences of random digits called cryptographic keys stored on your device.

Passkeys offer a more resistant alternative to traditional passwords and are less susceptible to phishing attacks and data breaches. The next time you call your mobile service provider and they ask for verification, don't be caught off guard by the series of questions. Think about what could happen if they didn't do sufficient checks, and someone carried out a sim-swap scam on your number.

Protecting Yourself from Sim-Swap Fraud

So, how can you protect yourself from sim-swap fraud? Here are some essential tips:

  • Be cautious when buying new devices or services: Always verify the identity of your service provider and ensure that they have access to your personal details.
  • Use two-factor authentication (2FA) correctly: Make sure you understand how 2FA works and set up a strong second factor, such as an authentication app or passkey, to prevent scammers from accessing your account.
  • Keep your login credentials secure: Use strong passwords and consider using passkeys instead of traditional passwords. Always keep your login information up to date and secure.
  • Monitor your bank statements and credit reports: Keep an eye on any suspicious activity on your accounts, as this can be a sign of sim-swap fraud in action.
  • Stay informed about the latest security threats: Stay up-to-date with the latest news and advice on how to protect yourself from sim-swap fraud and other cyber threats.

Conclusion

Sim-swap fraud is a growing threat that can have serious consequences for individuals and businesses alike. By understanding how it works and taking steps to protect ourselves, we can reduce the risk of falling victim to this type of attack. Remember to always be cautious when buying new devices or services, use 2FA correctly, keep your login credentials secure, monitor your accounts, and stay informed about the latest security threats.