The loss of a SIM card evokes immediate thoughts of data security and identity abuse. As services such as WhatsApp, Gmail, Facebook and YouTube become more synonymous with your phone number, losing control of your SIM card can leave you in a critical vulnerability.

The article will demystify how your data can be compromised on Android and Apple (iOS) devices, as well as define the most effective measures to take in protecting your accounts, especially by protecting it at the Sim-level such as through PUK lock which is the best shield of protection of all.

Lost SIM Card

It does not matter whether your SIM card belongs to Jio, Airtel, AT&T, Verizon, or any other telecom company in the world. The impact of any SIM lost can similarly affect your social accounts, and your account may get compromised. Apart from mobile phones (devices), SIM cards can be individually lockable with PUK numbers.

The PUK lock is a built-in security feature provided by the SIM card manufacturer and telecom operator. Once the user has set the PUK lock, the SIM card goes into secure mode, and whenever the phone has been switched off, the PUK lock is activated. Now, if anyone restarts a mobile phone with a PUK-protected SIM card, the SIM card asks to submit the PUK number. If you don't have the PUK lock code, the SIM card is nothing more than an electronic chip.

Which means no PUK code = no signal in the SIM card.

Is It Possible to Misuse Whatsapp in Case of a Sim Loss?

What happens is yes, your WhatsApp account can be abused in case someone gets hold of your lost SIM card. WhatsApp uses mainly the ownership verification on one-time passwords (OTP) based on SMS messaging. Should a rogue impose your SIM into an illegal phone, he can:

• Ask to get verification OTP.
• Turn on WhatsApp on a new device.
• Make your chats accessible, in case backups exist.
• The aggressor cannot see your messages in a chat, unless he or she also gets access to your cloud storage (Google Drive on Android, iCloud on iOS).

What Data is Mainly at Risk?

Once your SIM is connected to your Google account, there is a possibility that you will lose all accounts associated with Gmail:

1) Google account (Gmail) at Risk

Your mobile number is commonly employed for password restoration and two-factor validation. A hacker having access to your SIM can:

• Change your Gmail password.
• Access to emails, Google Drive, Photos, Calendar, etc.

2) YouTube Channel at Risk

As far as YouTube is connected to your Google account, with Gmail access, YouTube is compromised effectively too.

3) Facebook at Risk

If your Facebook account is signed up with Google account or mobile number, then it can also be at risk. In case Facebook relies on your phone number to sign in or 2FA, an attacker can:

• Get the OTP on the SIM
• Hack your Facebook profile unless you lock it soon

3) Instagram at Risk

Often phone numbers are used to log in to Instagram, reset a password, or two-factor authorization. An attacker can do the following with SIM access:

• Start resetting a password.
• Get the OTP reset.
• Pay attention to taking over the account in the case of its connection with the stolen number only.

Apple / iOS: Have You Become Safer?

Apple devices are run using Apple ID/iCloud which is more secure most times because authentication is devices based. Nevertheless, in the case your SIM will be utilized in the other device:

• SMS verification can also be done in WhatsApp.
• Even more severe data compromise can occur in case your iPhone is stolen together with SIM and was not secured with a long pass code or biometricsGet the OTP reset.
• The recovery of Apple ID does not depend on the SIM, however, SIM is abused it would let in OTPs to Apple services that are otherwise secured.

How to Lock Down Your Accounts after losing SIM Secure Steps

1) Put the SIM on Carrier Block (Immediately)

1. Speak to your mobile telco and Report lost, stolen SIM.
2. Ask SIM blocking so that OTPs can not be received.
3. Apply to have your number reissued, in the case it is needed.

This is the first and the immediate step you should take.

2) Lock the SIM using PUK Code

The most powerful security at the SIM level is the PUK (Personal Unblocking Key). Being activated, it:

• Freezes your SIM when you fail to enter correct PIN several times in a row.
• Stops SIM reuse without PUK code 8 digits entry

The PUK code is normally given, but can only be copied by the original SIM owner (you):

• On the outside of your SIM kit/Packing
• As part of the customer care of your mobile operator.
• Through the operator web based account management site.

2.1) The Reason Why PUK Lock Is better

A locked SIM with an activated PUK request can never be re-used by an attacker under any other normal condition, as opposed to, email or cloud-based 2FA, which can be breached using SIM abuse.

3) Secure WhatsApp Login

Send an email to WhatsApp on [email protected] with the title:

1. Lost / Stolen: Please Deactivate my account.
2. After your number is reissued to a new SIM, you might want to install WhatsApp and turn on two-step verification.
3. Visit WhatsApp > Settings > Account > Two-step verification.
4. Specify a PIN mandatory to activate new devices.

4) Protect Gmail and Google Account

1. As soon as possible, change your password in your Google account at https://myaccount.google.com/security
2. Delete the unrecognized or unauthorized devices on your account.
3. Recovery of changes: select a second email or Google Authenticator as an alternate to SMS-based 2FA.

Note: - Although Google 2FA is a great layer in terms of security, it can be undone under certain conditions, such as a situation where your SIM is under the control of an attacker, so securing the SIM is a step higher than 2FA.

Conclusion

When it comes to any possible countermeasures, there are no safer and implemented into hardware measures, than enabling and using SIM PUK (Personal Unblocking Key) lock. As opposed to authentications at the software level that could be intercepted or evaded using software-based OTPs, a locked SIM with PUK becomes useless to use without the original owner-identifying details.

---

You may also like this: