I ALMOST Lost $98,656 To SIM Swapping (How To Avoid SIM Swap Scams)

[@themoneyninja]

Thanks for watching! For more ways to make and save money, check out my site: themoneyninja.com/

[@johnlen6899]

Very informative, clear and concise really appreciate you going through all the steps to making it understandable hadn't even realized this was a potentiality getting all your hard worked funds stolen so quickly though thanks to you I've now set off authenticator for the majority of my financial services thank you for this. you earned a sub

[@themoneyninja]

It's so great to hear that you found this video helpful, and I have a new sub because of it! Thanks for dropping a comment 👍

[@drticzon]

Excellent video. I forward it to my family and friends. Thank you for making it.

[@themoneyninja]

I'm glad you found it helpful, and thanks for sharing this video with your family and friends!

[@tednguyen208]

If you only access important accounts from home and the bank has the option to call the number to provide one time code, you can specify your landline. Good luck trying to swap my landline.

[@themoneyninja]

Very true! This option is a hard pill to swallow for most, though. I'm always on the go and need to check things with my phone all the time 🤷‍♂️

[@bichngopham8828]

Great video. Thanks for sharing your experience and teaching us how to prevent it ourselves. Looking forward to more financial tips!

[@FredShin-m7x]

i set my bank account that can only make changes and get funds in person with id .

[@themoneyninja]

@@FredShin-m7x That's another option and a good one for those that can make that work, but how are you paying bills online? Does the bank still accept payments you make via ACH?

Great video. I'm not sure why you say you were embarrassed by this though, since you did nothing at all wrong.... ie, it just happened out of the blue. SAME PRECISE thing happened to me: I did nothing wrong (no clicking suspicious links for example). Yet at 2am some hacker SIM swapped me then took over my personal email and then cleaned out $22000 of crypto....which was at the time, 80% of my liquid life savings. It still hurts really bad to this day. I later suid my mobile provider but I only got $4000 of that $22000 loss.

[@themoneyninja]

Thank you for the kind comments. The embarrassment was more of a "I should have done these preventative measures beforehand and not let a scary situation force me into action." That's really sad that the scammers got to you - having $22,000 of crypto stolen... ouch. How did you recover $4,000 worth of crypto? Or did the mobile company pay this as compensation?

[@clumaster]

with my banking i have 2 accounts, 1 account contains a small amount for day to day use the other contains the rest and is locked, the only way to get money out of that account is in person at the bank.

[@themoneyninja]

@clumaster What bank allows you to only process transactions in-person?

[@clumaster]

@@themoneyninja all canadian banks do. i am sure most others would too. all you do is to ask the bank to lock the account and when you need money you would have to show up at that bank with your ID to unlock it for which you need a bank manager to authorize it and get your money. If a bank really cares about their customers and their financial security it should be an easy option to add, and if not, another institution might be in order.

[@madmonkey762]

Do a research on those authenticators before using it. I can't remember which one, but hackers were able to breach one or two of the companies and gain access to peoples accounts.

[@themoneyninja]

@madmonkey762 Do you remember if the incident happened with one of the authenticators I mentioned, or was it from a different company that you can't recall? Doing some quick googling, it seemed like people were storing the backup keys somewhere that hackers were able to grab, but I couldn't find that the authenticator app itself was compromised.

[@TheOne-xu5oy]

Is there a bank that allows for 2FA app authentication as an option? Most banks I know of either use email or SMS 2FA and most don’t have the option to just use your email instead of SMS 2FA.

[@themoneyninja]

Several smaller banks and credit unions do, and brokerages like Fidelity and Schwab. Many national banks don't offer it currently. For these banks, you should elect email as the 2FA option and then lock your email security to mobile authentication only. You can see the list of financial institutions that offer app authentication (listed as TOTP) here: 2fa.directory/us/#banking

[@capchemist]

I’m at First Tech FCU and they have it

[@MaxPower-11]

Banks are so bad about not having this feature! Fidelity has had it for a while but up until recently they only allowed you to use one specific brand of a TOTP-based authentication app. Now you can use any (I personally use Authy).

[@themoneyninja]

Banks are the slowest to adopt features... one of my biggest gripes with financial institutions.

[@JohnnyMoneyyy]

Great video. I had a scammer who visited a Verizon store and attempted to buy a new phone and SIM card under my account. Thankfully it was a family phone number under my master account and I was able to put a stop to it. I'm going to add an authenticator app now. You used Google in your video. Is it better than the others or did you use it because you're in the Google ecosystem?

[@themoneyninja]

It's crazy, right? Just remember to have a different password for each site, use an authenticator app where possible, and lock thar SIM card down! 💪

[@dav1dw]

I'd recommend Ente Authenticator. It's open-source and end to end encrypted. Having tried Ente, Microsoft, Google and 2FAS authenticators, Ente provide the best security and experience.

[@Sashazur]

I used Goggle authenticator for a while, then switched to Microsoft’s similar app, now I use the iPhone’s built in Passwords app. They all work pretty similar for 2FA auth codes, the main feature that’s useful is being able to have the same codes work on all of your devices. Most of these apps can do that by logging into the same account - but honestly using that feature actually reduces security a bit.

[@themoneyninja]

I just checked Ente out. Looks like a good authenticator. How did you find out about this one? It's pretty new.

[@themoneyninja]

I have a copy of the authenticator app I use on an older phone in case I lose my current one.

[@MaxPower-11]

Wow. Really, the chance fact that you were on vacation on the other side of the world may have been what saved you.

[@themoneyninja]

@MaxPower-11 100%. It was an awful breakfast experience, but the massive time zone difference saved the day. My wife tells me that we have to visit annually to "thank Maldives" for saving us. She may be the smartest ninja of all 😂

[@LerikkP]

Scary sh*t dude. Glad everything turned out well and going to Maldives annually because of what happened is a pretty good deal for the wife haha.

[@marynastasenko6222]

Maldives 🏝 ❤️

[@themoneyninja]

😂😂😂

[@marynastasenko6222]

Informative video, thanks!

[@themoneyninja]

Glad you found it helpful!

[@im4udevco]

Thanks for sharing. I use a biometric security key and authentication app.

[@themoneyninja]

@@im4udevco Which biometric key do you use?

[@dukeofthedesert]

@@themoneyninjaI need to know this too. Have been wanting a physical encryption key for ages.

[@craigf3277]

My carrier sends a text to the phone before it will switch. I believe this is pretty good.

[@themoneyninja]

@craigf3277 Mine did too, but the text notification to the SIM switch is only 10 minutes apart. If you're away from your phone within that time frame... 😔

[@gangywangy8464]

money ninja my goat thanks for the help

[@themoneyninja]

You got it, dude!

[@GeneralTso-x2q]

Create a SIM Swap PIN. Every cell company offers this option. The sad part is, this security option should be enabled by default. It's NOT.

[@themoneyninja]

I'm shocked that these things aren't turned on by default too! Keep in mind though, that while creating a SIM swap PIN # will provide an additional layer of protection, it still wouldn't prevent a swap if the fraudster was able to bribe a contact center employee to do so as they are able to override it.

[@craigf3277]

Mine does not offer PIN. I even called them to verify. They will only do a change with a code sent to the phone before switching.

[@MaxPower-11]

@@craigf3277 well, in many instances the reason one might want to do a legitimate swap is because they no longer have possession of their SIM. How does your carrier handle that?

[@akui88]

did your tmobile account have "SIM Protection" turned on?

[@Sashazur]

Yes if you have T-Mobile definitely activate that!

[@themoneyninja]

Yes. SIM Protection would help if the scammers are trying to ask or trick a mobile service provider to swap a SIM. But if scammers instead pay carrier employees directly to swap SIMs, then this is useless since a bribed employee is not going to honor any SIM protections. So while it may help someone feel completely safe having SIM protection on a line, the reality is, if the phone number is used as the two-factor authentication method to secure against a large sum of irreversible funds (like crypto), the "protection" is irrelevant, as the scammers simply bypass it.

[@kauigirl808]

T-Mobile now has a feature you can enable to prevent sim swapping. Nobody can not hook up your phone number on a different phone until that feature is disabled.

[@victortoombs4754]

And how do you enable this?

[@themoneyninja]

That works unless the scammer was able to bribe an employee. They can easily override SIM protections placed on the account. An authenticator app provides an additional layer of protection if SIM protection is breached.

[@kauigirl808]

@ no they can’t. I mean anything is possible of course anyone can do anything they want to but they would need a good motive to go the all that trouble when they can easily target someone that doesn’t have sim protection which is a ton of other vulnerable people out there.

[@JohnnyMoneyyy]

​@@kauigirl808They actually can. That's how my account was compromised and I had SIM protection on. It does nothing when a CSR can turn it off. That's how a lot of these SIM swaps happen.

[@victortoombs4754]

Why not use a Yubikey?

[@themoneyninja]

Yubikey is another option. It depends on if you want to use a hardware-based authenticator like Yubikey or a software-based solution like Google Authenticator.

[@victortoombs4754]

@themoneyninja Yeah, but with a Yubikey, it is something physical that one must have in their possession, so better than an authentication app.

[@jayteknica1175]

Damn dude having $100k in the bank to initiate tranfers is wild. They'd get into my account and be like like god damn it 😂

[@themoneyninja]

@jayteknica1175 The first $100k takes the longest, but you can get there! Start small, think big 💪

[@dav1dw]

The thing I don't understand is how the hacker know what number you use? Are you already compromised, and they're working their way deeper?

[@themoneyninja]

@@dav1dw Websites get hacked all the time, and the information that gets leaked includes your name, phone number, etc. You can check if your email address has been leaked. If it's an email you use for many websites, chances are it is. Check here: haveibeenpwned.com/

[@dav1dw]

@@themoneyninja yeh. all my emails and info has been leaked before. It took some effort to switch over to new emails and I also started using email aliases.

[@themoneyninja]

Very smart to do. It's another layer that makes it more difficult for scammers to penetrate.

[@lafavini]

Thank you 🙏

[@themoneyninja]

@@lafavini Glad you found it useful 👍

[@danielle5684]

Isn’t Esim supposed to prevent this?

[@themoneyninja]

@danielle5684 eSIMs can't prevent a scammer bribing an employee or acquiring a fake ID to claim that they lost your phone and need a replacement.

[@zenwar8835]

Don't they need your username and password for your financial accounts?

[@themoneyninja]

@@zenwar8835 Yes, and scammers can get that once they have control of your phone number and email address. They click on the "forgot username" or "forgot password?" feature and get this information sent as a text message or email.

[@johnbeene3117]

Does scam method #1 work with eSIM only phones?

[@themoneyninja]

It works with physical SIMs, too. Scammers visit mobile carrier stores pretending to be you and tell the employees that they lost the SIM card and ask for a replacement.

[@johnbeene3117]

@@themoneyninja I'll rephrase: Does method 1 work with eSIM? It seems to me that it would only work with physical SIMs but I'm not sure.

[@themoneyninja]

@johnbeene3117 Thanks for clarifying. The answer is still yes. Scammers can pretend to lose "their" phone, which includes the eSiM.

[@johnbeene3117]

@@themoneyninja Wow so replace the entire phone? I guess this would only work if you had insurance against lost phones, right? Sorry for the noob questions, this has all just gotten a lot more complicated since the last time I got a phone.

[@themoneyninja]

@johnbeene3117 Yes, they're able to replace the phone on the account with a fake ID. Call your mobile service provider and ask if they can add an additional layer of security to lock your SIM. But the advice here (adding an authenticator app) would prevent them from logging into your financial accounts. No worries about the questions, you're asking good ones!

[@ryshask]

you should really use a hardware key.

[@themoneyninja]

@@ryshask Which key do you use?

[@ToboeKey309]

Best thing to do is dont use your phone numbers for 2fa on your email accounts and just use another email as your 2fa

[@themoneyninja]

That's exactly right. Redirecting to another email address is definitely a good option, though I love having an authenticator app centralize and secure all my important accounts.

[@FrankieHyman]

@ToboeKey309 Unfortunately most banks don't offer Passkey or Authenticator app as 2fa. They have gone all in on SMS even though they have known it's not safe. Even the US government is now warning against texts for communications yet the banks won't change. They simply don't want to spend the money to upgrade their systems.

[@lostbydesign]

Gmail requires a phone though

[@azurik]

​@lostbydesign You don't need a phone number. Go to your Google settings and click on "Security". You can add multiple ways to verify yourself under the "2-Step Verification" option without requiring a phone number.

[@lololololololol444]

You can change the authenticator ​@@lostbydesign

[@saxophoneplaya]

Thank u !!

[@themoneyninja]

@saxophoneplaya You're welcome and thank you for watching! 👍

[@stephenxs8354]

Never use SMS as a 2FA!!! NEVER!

[@themoneyninja]

Preach brother! 👍

[@craigf3277]

I'm finally convinced. Now more places are using auth apps.

[@biiigdaaaddy]

Auth apps connecting to say your icloud account suffers the same issue and can be hacked easily. Opt in something like yubikey which is physical

[@SunshineFL]

I have a 12 digit passcode that you must state beforehand

[@themoneyninja]

@SunshineFL That offers some protection, but unfortunately, if scammers are able to bribe the employees, that security layer is ineffective.

[@Halfnoob]

joke on the scammer. i only have $33 to my name.

[@themoneyninja]

@Halfnoob I chuckled out loud when this popped up in my notifications. We all start somewhere, buddy. Like I always say at the end of my videos, "start small, think big."

[@ShellyBomb]

Great content; but please s-l-o-w down when speaking ... 😉

[@themoneyninja]

Thanks for the feedback! I'll make sure to keep pacing in mind for future videos.

[@ShellyBomb]

@themoneyninja 🎤 ~ Perfect; but just my opinion, of course. Happy Holidays ⛄

[@themoneyninja]

@ShellyBomb I welcome all constructive feedback. Thanks Shelly - happy holidays to you as well 🙂

[@ShellyBomb]

@@themoneyninja What a gentleman! 😉

[@themoneyninja]

@Adam-s3w7d, you wrote, "Thanks for sharing this brother" in the previous version of this video just before I replaced it due to a video glitch. I just wanted to let you know I got your comment and appreciate you watching, dude! 🙏

[@jivepatrol6833]

Good video and tips - thank you!

[@themoneyninja]

Glad you found it helpful!