Protect Your Digital Identity During the Holiday Rush

How to Reduce Spike in Identity Fraud During the High-Risk Holiday Season

In our increasingly interconnected digital world, sensitive personal information is more vulnerable than ever before. This risk is dramatically amplified during periods of high activity, like the holiday season, when we are frequently opening new accounts, making high-value purchases, and constantly checking financial balances. Cybercriminals capitalize on this increased digital traffic to exploit security weaknesses and compromise online identities.

Your mobile identity – including phone number, personal info, and device data – can be used by fraudsters to steal your credentials to open financial accounts, or gain access to your existing accounts. Understanding the mechanics of mobile hijacking—where fraudsters gain unauthorized control over your mobile device and number in order to impersonate you to intercept sensitive messages sent—is essential to safeguarding your personal information and digital identity during the holiday season.

Mobile Hijacking: Beyond the Password

Mobile phones have become the core of our digital lives, serving as the primary device for authentication, payments, and communication. This makes the mobile number the single most valuable asset for a fraudster.

There are many ways to hijack a phone number, including:

• Call Forwarding: The fraudster logs into the victim’s mobile account and turns on call forwarding so that all calls are automatically forwarded to the fraudster’s phone number. The fraudster then requests a voice OTP and intercepts it. Call forwarding scams are also used during security call back procedures. The fraudster is able to answer the phone call that is meant for the victim and successfully impersonate them.
• Adding a Device: The fraudster logs into the victim’s iCloud account and adds their own device to the network so that all messages go to the fraudster’s device as well. The fraudster then requests a short message service (SMS) OTP and intercepts the one-time passcode.
• Porting: The fraudster obtains the personal identification number (PIN) associated with the victim’s phone number and uses it to port the number to another carrier where it can be associated with a SIM card and the device that is in the fraudster’s possession. The fraudster then has full use of the victim’s phone number to send and receive both texts and phone calls.
• Intra-Porting: This works similar to porting. However, to avoid the detection of porting activity, the fraudster ports the victim’s phone number to a mobile virtual network operator (MVNO) of their current carrier, as opposed to an entirely different carrier. An MVNO is a wireless service provider that leases the infrastructure from a mobile network operator at wholesale rates, then sets retail prices for its services independently. The central authority does not recognize this as a port.
• SIM-swapping: The fraudster visits or calls the victim’s carrier with a request for a new SIM card due to loss or upgrade. The carrier assigns the number to a new SIM card and device that is in the fraudster’s possession. The fraudster then has full use of the victim’s phone number to send and receive both texts and phone calls.

Other less common methods include:

• Temporary Deactivation Fraud: Attackers trigger a “temporary suspension” of your number, which can redirect calls/texts or weaken security for a period, allowing them to execute an ATO via other means.
• eSIM Attacks: Though less common, attackers target accounts with eSIMs (digital SIMs), requesting a remote transfer to a device they control.
• Malware & Spyware: Direct infection of the mobile device allows criminals to read OTPs and other sensitive notifications directly from the device screen without needing to hijack the number itself.

Protect Yourself from Mobile Hijacking Attacks

Understanding these mechanics is the first step in defending yourself against this growing threat, especially as you increase your financial and/or purchase activities during the holidays.

• Move Beyond SMS-Based Two-Factor Authentication (2FA): SMS-based 2FA is the fatal flaw in SIM swapping. Instead, opt for app-based authenticators (like Google Authenticator or Microsoft Authenticator) or physical FIDO-based security keys.
• Implement a Strong Account PIN or Passcode: Contact your mobile service provider immediately and set up a unique Personal Identification Number (PIN) or a secure passcode on your mobile account. This mandatory layer of security prevents customer service agents from making changes without the secret code.
• Use Strong, Unique Passwords and Passkeys: Use a password manager to generate and store complex, unique credentials for all your financial and high-value accounts, reducing the risk of unauthorized access via credential stuffing.
• Be Cautious with Personal Information: Limit the personal information you share online, especially on social media. Cybercriminals often use publicly available data (like your pet’s name or high school) to impersonate you during social engineering attacks.
• Monitor Your Accounts Constantly: Regularly monitor bank accounts, credit reports, and online services for any suspicious activity, especially failed login attempts or unexpected texts about account changes. Promptly report any unauthorized access.
• Contact Your Mobile Service Provider Immediately: If you suspect unusual network activity (e.g., your phone loses service for no reason), contact your provider from a landline or other device immediately to report a potential unauthorized SIM change.

In conclusion, mobile hijacking attacks represent a serious and growing threat to your digital identity and personal information. As you increase your digital activity this holiday season, cybercriminals will be working overtime to exploit these vulnerabilities.

Fortunately, we can use technology to fight back. Companies like Zumigo are at the forefront, working directly with mobile network operators to provide real-time identity signals that proactively detect and block account changes and mobile fraud attempts. Remember, your digital identity is now your most valuable asset, and protecting it requires vigilance and modern, identity-centric defenses.