Wireless and Mobile Network Attacks: Phreaking, SIM Swap, NFC and QR

Historical phreaking exploited particular telephone control mechanisms, including in-band supervisory or multifrequency signalling. A famous 2600 Hz story is not evidence that all abuse began with one person or that every network changed on a single date.

Modern vishing is voice-based social engineering. The attacker can present a plausible caller identity and pretext without exploiting the same signalling flaw as a historical blue box.

Caller-line identity can be manipulated or relayed through service chains. Network authentication/attestation measures, where used, concern defined claims and do not guarantee the caller’s honesty or every display label.

Preserve the call as lawfully available, its displayed identity, timing, account interactions and relevant provider records. A screenshot of a number is not proof of the originating subscriber or call path.

SS7 and Diameter are distinct signalling technologies with defined trust and security mechanisms. Abuse depends on network access, configuration and particular messages; do not assume every participant is universally trusted or assign one rental price to the capability.

Correlate an alleged call with independently recorded actions, such as credential changes or a payment. Treat caller statements and user recollections as sources with their own evidential limits.

Wi-Fi interception can involve a malicious access point, local neighbour manipulation, compromised infrastructure or a rogue VPN application. An open SSID and one local host are not universal prerequisites for every MITM mechanism.

ARP manipulation concerns an applicable IPv4 local segment. Client isolation, switches, protected traffic and actual host behaviour affect its reach. A tool option alone does not prove successful bidirectional interception.

Correctly authenticated HTTPS is not automatically downgraded because a site lacks an HSTS preload entry. Insecure initial navigation and browser policy matter; a proxy cannot simply strip protection from every existing TLS connection.

Application encryption and Wi-Fi link protection have different endpoints. A hostile link can observe some metadata while TLS still protects content. A captive portal uses IP/application communication; it does not collect a submitted web form before any IP traffic exists.

Preserve routing/neighbour state, relevant captures and endpoint changes where available. Separate an interception hypothesis, visible plaintext and demonstrated content modification.

Use clearly labelled controlled examples rather than undocumented airport exercises or prosecutions. New validation tests can change state and belong in a separate record.

A fake hotspot can imitate a venue’s network identity, but joining depends on client security settings and authentication. Matching SSID and stronger signal do not force every saved-network client to associate.

WEP is obsolete; weak personal-mode passphrases can permit candidate testing with suitable material. Enterprise EAP methods and WPA3 SAE have different properties. Do not convert every historical attack into a universal fixed-minute recovery promise.

For enterprise Wi-Fi, appropriate server trust and identity validation matter alongside the chosen EAP method. EAP-TLS does not simply expose a reusable password to any rogue AP accepting the exchange.

Captive-portal phishing is an application-layer deception. Link encryption does not certify the portal’s legitimacy, but client authentication can affect whether a rogue network is joined in the first place.

Hardening can include current firmware, appropriate WPA3/enterprise configuration, strong credentials and removal of obsolete WPS/PIN exposure. A firmware date alone is not a current patch assessment.

Use actual device capability and policy, not one minimum OS-version table, to establish support. Hidden SSIDs and MAC lists are not strong substitutes for authentication.

Cellular impersonation and identifier capture depend on generation, handset policy and network behaviour. A country code is not an operator’s unique code; MCC and MNC must be interpreted together under the relevant allocation.

GSM lacks equivalent network authentication to the handset, while later AKA-based systems provide mutual-authentication mechanisms. Temporary identities and 5G concealed identifiers complicate a simplistic “first message always reveals IMSI” account.

Downgrade or interference can be relevant under specific conditions. It does not mean a stronger transmitter universally forces 4G/5G phones to 2G or automatically yields readable SMS and calls.

A radio-generation change can result from coverage, roaming, settings or service behaviour. It is a lead requiring technical corroboration, not the single most reliable proof of an IMSI catcher.

Network slices are logical service/network constructs, not simply three radio partitions. A slice-identifier field does not automatically grant privileged access; evaluate actual authorisation and configuration.

Handset detection tools have chipset, permission and interpretation limits. Preserve their raw observations and independent provider information rather than treating an alert as identified malicious infrastructure.

SIM replacement and port-out fraud target provisioning processes. An attacker may use stolen account access, deception or insider assistance; a specific forged-document or biometric story requires evidence.

Correlate the provider’s request, approval and activation records with original/replacement profile identities and independent account changes. Record number assignments and actual service restrictions for the relevant period.

Cooling-off, messaging and banking controls vary by country, operator and service. Do not equate a porting delay, a SIM-replacement SMS restriction and a bank transaction limit, or invent a universal twenty-four-hour financial-OTP rule.

Loss of service can prompt urgent verification with the operator through a trusted channel, but an outage alone is not proof of fraud. Account protection and transaction response should follow the affected services’ verified processes.

Equipment blocking addresses a handset identity; it does not reverse a stolen subscription on a different device. Do not tell a SIM-swap victim to block their own original handset as a universal recovery step.

Forensic reporting should distinguish when subscription control changed, what authentication/transactions occurred and what links an actor to those actions. Subscriber KYC and a phone number alone do not establish the operator.

NFC reading, identifier emulation, cryptographic cloning and real-time relay are different capabilities. A tool can read selected public fields without possessing protected keys or being able to complete an authenticated transaction.

Legacy access/transit technologies and EMV payment applications have different security. EMV contactless transactions use dynamic security data; copying a static UID or card number does not generally create a functioning payment-card clone.

Relay forwards an interaction between a genuine credential and reader rather than necessarily extracting its secret. Feasibility and countermeasures depend on timing, protocol and implementation.

Malicious NFC tags and QR codes can direct a user to an unintended destination. Actual phone handling depends on OS, application and user confirmation; a tag does not universally auto-open or silently exploit every device.

Preserve the physical display/tag, decoded data, surrounding claim and relevant device events. A destination shown in encoded data is distinct from a site actually opened or a payment approved.

For suspected QR substitution, compare intended merchant details with the actual confirmation and settlement records. Independently verify transaction identifiers and beneficiary mapping rather than rely only on an app screenshot.

Payment records differ by application and service. Preserve the actual transaction references and compare them with independently obtained records. A displayed approval screen does not establish settlement, refund rights or who authorised the payment.