Here's how they work and how to stop them. Your phone can be tracked, your SMS two-factor codes can be intercepted, and your number can be impersonated, all without malware, a phishing link, or any access to your device. The attacks happen inside the telecom network, in the carrier-to-carrier control protocols known as signaling, the automated descendants of the old telephone switchboard.
Most users never see them, and most carriers can't reliably stop them. Most recently, they made headlines when Iranian-linked actors reportedly exploited outdated network technology to locate the phones of US personnel in the Middle East during the Iran war. But the vulnerability has been around for decades, and it's been used for far more everyday crimes, like intercepting bank one-time passcodes.
It has even been showed by popular YouTubers: Veritasium hijacked a tech influencer's calls and texts using only his phone number. Criminals have reportedly exploited signaling protocols in attacks on bank accounts and global telecom infrastructure.
