Phone porting scams

Estimated reading time
 5 min

Key points

• Phone porting scams are when a criminal tries to take ownership of your phone number through an unauthorised transfer (the criminal transfers your phone number to an account with a new telecommunications provider) or a SIM swap (the criminal requests to activate a new SIM card with your number with your current telecommunications provider).
  
  
• If your phone suddenly goes into SOS mode, it’s important that you act quickly and contact your telecommunications provider to work out what’s happening – it might be a phone porting scam.
  
  
• Calling your telecommunications provider and requesting a PIN for your account is one of the many things you can do to protect yourself from phone porting

Picture this: Months ago, you received a text message, supposedly from a government agency asking for your personal information to receive a bonus tax refund. In the message, there was a link.

You clicked on it and provided your personal information – name, mobile, address and so on – however, the promised money never arrived.

Fast forward a few months, and your phone suddenly switches to SOS mode. Then you get an email saying you logged into a social media account from a different device. Or you see thousands of dollars get transferred out of your bank account, even though you activated multi-factor authentication.

“There’s no trend to mobile porting,” says Deepal Joshi from ANZ’s IDT Fraud and Customer Protection department. “Anyone can fall victim to a phone porting scam.”

Knowing the signs and acting quickly can help you get on top of the phone porting scam and put you in control of the situation.

What is a phone porting scam?

In a nutshell, a phone porting scam is when a cybercriminal transfers your mobile number, which is called porting, to a device they control or to a different SIM (either a physical SIM card or an eSIM). An eSIM allows you to connect to your telecommunication provider’s network without having to use a physical SIM card.

“What happens is that cybercriminals will get in touch with the target’s telephone provider,” explains Deepal. “And one of the things they might say is, ‘I want to port my number to a different provider, but I’d like to use the same phone number’. Or they might say that they’re getting a new device and need an eSIM.”

Phone porting might be the next step a cybercriminal takes after initially getting your personal information through other means, such as through a phishing link (a suspicious link that takes you to an unsafe website) or an impersonation scam, which may allow them to answer any security questions from your telecommunications provider.

How does phone porting work?

Phone porting in itself is not a scam, many people use this legitimate service to move from one telecommunication provider to another. But when it happens without your knowledge or consent it is a scam.  

“It can be as simple as a chat over the phone,” Deepal explains. “Sometimes the cybercriminal might call the telecommunication provider and come up with a story to convince them that they have to move providers, such as they’re experiencing domestic violence, and they don’t want their partners to know.”

There are two ways a cybercriminal can port your phone number:

1. Unauthorised porting
2. SIM porting

So, what’s the difference between the two?

Unauthorised porting is when a cybercriminal sets up an account with a telecommunications provider and requests a phone number transfer from your current provider. They might use your personal information, such as your name or mobile number, to initiate the phone porting. Your provider may send you a text message to verify the transfer, which means you may be able to prevent your phone number from being ported. However, if a criminal has installed malware onto your phone, they might be able to get the information in the text message to impersonate you and complete the transfer.

SIM porting (or SIM swapping) is the other phone porting option, where the cybercriminal requests a new SIM card or eSIM with your phone number.

“Once a cybercriminal has control of your phone, they can do so many things,” explains Deepal. “Like receiving one-time passcodes to access your bank account on a new device or they might use your phone number to make spoof calls – they can do anything.”

Signs of a phone porting scam

There are some clear signs that you’re affected by a phone porting scam, for example:

• “The target’s phone will go into SOS mode,” says Deepal. “Sometimes, targets might think there’s no network, but it’s your number that has been taken over and is under the control of the cybercriminals.”
  
  
• You might receive an unexpected text message from your telecommunications provider with a request to port your number to a new device or telecommunications provider.
  
  
• You’re alerted by emails and notifications about new logins on different devices (that aren’t yours) and are subsequently locked out of your accounts.
  
  
• You notice there are unauthorised transactions in your bank account that would require a text message to confirm.

How to help avoid falling victim to phone porting scams

You can follow these simple tips to help protect yourself against phone porting scams:

• Contact your telecommunications provider and request to set up a PIN for your account. This means that whenever you need to make changes or perform transactions related to your telephone account, your provider can send that verification PIN to the device that’s associated with your phone number.
  
  
• Remove or hide any personal information from your social media, like your date of birth and phone number.
  
  
• Shred any physical documents that contain your personal information, like bills or shipping labels. This can make it harder for scammers to access and use your personal information against you.
  
  
• Avoid clicking on any suspicious links that are sent to you unexpectedly. Pause and consider if you need to share your information with another website or person.
  
  
• Use something other than your mobile number for multi-factor authentication, such as an authenticator app.
  
  
• “Use different passwords for different accounts,” says Deepal. “That way if one account is compromised that doesn’t mean the others are.”

What can you do if you think you’ve been scammed? 

If you think you’ve experienced a phone porting scam, know that you’re not alone. This type of scam can happen to anyone, but here are some steps you can take to minimise the impact. 

• “Call your telecommunications provider straight away,” Deepal says. “Don’t wait for the SOS mode to sort itself out and explain what’s happened.”
  
  
• If you’ve shared financial information or transferred money, contact your bank immediately. If you’re an ANZ customer, contact us immediately to report the fraud.
  
  
• If you’ve shared credit card details, ‘block’ or cancel those cards immediately. If your cards are with ANZ, you can report the stolen card through the ANZ app or by calling us. 

Who can you contact if you’ve been targeted by a phone porting scam?

• Help others by reporting to Scamwatch or to the Australian Signals Directorate’s Australian Cyber Security Centre’s ReportCyber.
  
  
• For phishing or identity theft associated with government accounts such as Centrelink, Medicare, or Child Support, contact the Services Australia scams and identity helpdesk on 1800 941 126 or visit their website.  
  
  
• You can also contact IDCare, a not-for-profit organisation providing support to those experiencing identity and cyber security concerns.
  
  
• Contact your bank immediately if you share personal or financial information.
  
  
• If you’re an ANZ customer, you can report fraud or suspicious activity in multiple ways, such as through the ANZ app or by calling us