Wireless and Mobile Network Attacks: Phreaking, SIM Swap, NFC and QR

Your journey to becoming a forensic professional starts here.

Practice with national-level exam (FACT, FACT Plus, NET, CUET, etc.) mocks, learn from structured notes, and get your doubts solved in one place.

Start Free Mock Test Create Your Account

Wireless and Mobile Network Attacks: Phreaking, SIM Swap, NFC and QR | ForensicSpot

Mobile network attacks sit on a continuum that starts with John Draper blowing a 2600 Hz tone into a payphone in 1971 and ends with a fraudster in a Jamtara call centre porting a Mumbai accountant's SIM at 11 pm on a Friday and draining the salary account before the Monday office opens. The physics changed (PSTN tones, then GSM signalling, then LTE Diameter, then 5G slicing), but the playbook is steady: find a layer where authentication is weaker than the user expects, impersonate something the user trusts, and convert that trust into a transaction the user did not approve.

This topic covers the wireless and mobile attack surface as the digital forensics Mobile paper and the NFSU MSc course frame it. The arc runs from phone phreaking and call tampering through Wi-Fi man-in-the-middle attacks on Indian public networks, WEP and WPA recaps from the mobile client perspective, fake hotspots at airports and metro stations, IMSI catchers and the 4G to 2G downgrade, the SIM swap playbook under TRAI's 24-hour cool-off rule, NFC card cloning with Flipper Zero and Proxmark, and the QR fraud variants that dominate Indian high-street complaint filings. Cross-link references run to wireless network attacks (WEP/WPA/WPA3), mobile phone forensics, digital first responder and the chain of custody primer.

Key terms

Phreaking: Tone-based exploitation of the public switched telephone network, pioneered in the 1960s and 1970s. The 2600 Hz tone, generated by a toy whistle from a Cap'n Crunch cereal box, disconnected billing on AT&T trunks while keeping the call up. The modern descendant is signalling-layer abuse on SS7 and Diameter.
CLI spoofing: Caller Line Identification spoofing: the caller forges the Calling Party Number sent in the SS7 IAM or SIP From header so the receiver's phone displays a chosen number. Used in vishing scams that impersonate TRAI, DoT, banks or police.
IMSI catcher: A rogue base station (commercial: Stingray, Hailstorm, KingFisher; research: USRP plus srsRAN or YateBTS) that impersonates a cellular cell, forces nearby phones to attach, and logs the IMSI and IMEI. Often paired with a forced downgrade from 4G or 5G to 2G GSM.
SIM swap: Fraud pattern where the attacker convinces the telco to port the victim's MSISDN to a SIM the attacker holds. Once active, the new SIM receives all SMS OTPs, letting the attacker reset banking, wallet and email credentials. TRAI mandates a 24-hour OTP cool-off after any SIM swap.
QRJacking: Physical replacement or overlay of a legitimate merchant QR (typically a UPI QR at a shop counter) with a fraudster's QR pointing to the attacker's VPA. Customers scan the wrong code and the funds settle to the attacker; the merchant only notices at end-of-day reconciliation.
TRAI 24-hour cool-off: Telecom Regulatory Authority of India directive (2018 and tightened thereafter) requiring that after a SIM swap the new SIM cannot be used for OTP-bearing transactions for 24 hours. The window forces the rightful subscriber to notice the original SIM going silent and dispute the swap before financial fraud completes.

Phreaking, vishing and the long history of trusting a phone line

The 2600 Hz whistle started it; CLI spoofing keeps it running.

Phone phreaking is the historical root of every mobile network attack on the syllabus. John Draper, working under the handle Captain Crunch, discovered in 1971 that the plastic toy whistle packaged in Cap'n Crunch cereal produced a clean 2600 Hz tone. AT&T's analogue long-distance trunks used 2600 Hz as the in-band supervisory signal that meant "this trunk is idle". A phreaker who dialled a long-distance number, waited for the call to connect, then blew the whistle into the handset, dropped the trunk's billing state while keeping the voice path up. The next dialled digits, sent as multi-frequency MF tones from a blue box, set up a free call to anywhere on the network.

Three generations of boxes mattered. The blue box generated MF tones for free long-distance. The black box, on the called side, fooled the local exchange into never billing the caller. The red box generated the coin-deposit tones a payphone used to signal that a quarter had been inserted, so the payphone counted phantom coins. Steve Wozniak and Steve Jobs sold blue boxes at Berkeley before they founded Apple. The arc closed in 1980 when AT&T moved supervisory signalling out of band onto Common Channel Signalling System 7, ending the in-band attack class.

The modern descendant of phreaking is signalling-layer abuse on SS7 and Diameter. The attacker no longer whistles into a handset; the attacker rents an SS7 global title from a complicit carrier and sends crafted MAP messages to redirect SMS or query subscriber location. The economics are very different (the rental costs four figures a month rather than a cereal-box toy) and the targets are very different (a high-value mark rather than a free overseas call), but the trust model is the same: the telephone signalling layer assumes any participant is who they claim to be.

Wi-Fi MITM on a public airport SSID: a walkthrough

One open network, one ARP burst, one full session in clear.

The man-in-the-middle attack on public Wi-Fi is the most common path from "free internet" to credential theft. The setup needs three pieces: an open or weakly-shared-key SSID that several strangers use, a host on the same broadcast domain, and a tool that can rewrite Layer 2 forwarding. The walkthrough below is reconstructed from a 2024 internal red-team exercise at an Indian Tier-1 airport's airside lounge, run with carrier consent and a closed test SSID. Names and MACs are redacted.

The attacker's laptop joined the lounge's open SSID and ran arp-scan -l to enumerate active hosts on the /24. Five mobile clients and one printer were visible. The attacker ran bettercap -iface wlan0 and used the arp.spoof module to spoof the gateway MAC on the target client and the client MAC on the gateway, inserting the laptop between them at the ARP layer. net.sniff on plus https.proxy on brought the SSL stripping module up. From this point any HTTP request from the target client transited the attacker; any HTTPS request to a site without HSTS preload was downgraded by the proxy to HTTP and the response stripped of https:// URLs in anchors. Most legitimate banking sites are HSTS preloaded, but the auxiliary OAuth and tracker domains are not, and the user's session cookies on cross-domain hits were captured intact.

Join open SSID, enumerate the segment
arp-scan -l on the connected interface lists every responsive host on the broadcast domain. The gateway, the DHCP server, and every active client appear with MAC and vendor. Filters down to interesting clients (phones, laptops) within seconds.
Insert at the ARP layer with bettercap

Fake hotspots, WEP and WPA recaps from the mobile client side

Same airport, same SSID, stronger signal: the phone never asks the user.

The fake hotspot pattern has a stable shape across Indian airports, metro stations, malls and cafés. A portable AP (Wi-Fi Pineapple, a flashed OpenWrt mini-router, or a laptop running hostapd) broadcasts the venue's SSID at higher transmit power than the venue's real AP. Phones with that SSID in their saved networks auto-associate. The first HTTP request triggers a captive portal that imitates the venue branding and asks for a phone number, an OTP, or a "verify your bank account to enable free Wi-Fi" prompt. Credentials harvested are sold downstream to SIM-swap and UPI-fraud crews. CERT-In's late-2024 wireless advisory named sustained campaigns at Delhi Metro, Bengaluru Metro and Hyderabad Metro stations with this exact pattern.

From the mobile client's perspective, the WEP and WPA layers below the hotspot matter mostly because of legacy exposure. Cafés and shops that still run a 2010-vintage Linksys WRT54G on WEP let any examiner with aircrack-ng recover the 104-bit key in under 15 minutes (the full walkthrough lives at wireless network attacks). Once the WEP key is recovered, the attacker is a normal client on the LAN and runs the same ARP-spoofing attack from Section 2. WPA2-PSK with a weak passphrase is recovered offline against a captured 4-way handshake or PMKID using hashcat -m 22000. WPA-TKIP is functionally obsolete; the Beck-Tews attack of 2008 broke MIC reuse in a 60-second window.

Wi-Fi layer	Attack against mobile client	Indian exposure	Mitigation on the phone
Open SSID, no encryption	Passive sniffing, ARP-spoof MITM, captive-portal phish

IMSI catchers, 4G to 2G downgrade and Diameter abuse

The radio layer impersonation that bridges Wi-Fi to mobile.

IMSI catchers are the cellular cousin of the rogue AP. The device impersonates a base station: it broadcasts a Mobile Country Code and Mobile Network Code that match a real operator (404 for Bharti Airtel, 405 for Reliance Jio, 405 for BSNL among others, allocated by the ITU) plus a Location Area Code that nearby phones consider plausible, at a transmit power higher than the legitimate cell at the spot. Phones in the area perform a routine cell re-selection and attach to the rogue cell. The first message in a GSM attach exchange carries the IMSI in clear; the catcher logs it, then either releases the phone back to the real network or holds the attach for surveillance.

The 4G to 2G downgrade is the practical lever the IMSI catcher needs against modern phones. LTE includes mutual authentication: the network authenticates the SIM with EPS-AKA and the SIM authenticates the network with the same exchange, so a rogue LTE cell cannot trivially impersonate the operator. GSM (2G) does not authenticate the network at all; the SIM authenticates to the network with a single challenge-response in COMP128, but the network sends no proof of its own identity. A catcher that advertises 2G at a strong signal and refuses or jams the LTE bands causes the phone to fall back, at which point the catcher is fully trusted. From 2G the catcher reads SMS in transit, listens to A5/1-encrypted voice (A5/1 is broken; A5/2 was withdrawn in 2007), and bounces calls through itself.

5G slice spoofing is the emerging variant. 5G stand-alone networks segment the radio into slices (eMBB for consumer broadband, URLLC for low-latency industrial, mMTC for massive IoT). A misconfigured operator core that does not authenticate the slice identifier sent in the Registration Request lets a malicious UE claim a privileged slice and receive routing it should not. The risk is operator-side rather than consumer-facing in current Indian 5G deployments, but the research is moving fast and CFSL Hyderabad has started fielding 5G specific training for examiners.

4G to 2G downgrade by an IMSI catcher. The rogue cell jams or refuses LTE on the band the victim is using and advertises a strong 2G cell on the same MCC and MNC. The victim phone re-selects, attaches to the rogue 2G cell, and authenticates one-way only, letting the catcher read SMS and bounce voice.

SIM swap: the TRAI 24-hour cool-off and where the playbook still works

A new SIM, an OTP delay, and an account-drain race against the clock.

SIM swap fraud is the highest-loss mobile attack category in current Indian crime statistics. RBI's 2023 banking fraud bulletin attributed losses in the hundreds of crores to SIM-swap-enabled account takeovers, with public sector banks taking the largest exposure because of lower friction in legacy banking flows. The mechanics are mostly social engineering against the telco's customer service layer rather than radio-layer cryptography.

Step 1: KYC harvest
The attacker sources the target's KYC documents (Aadhaar copy, PAN, driving licence) from a phishing site, a leaked database, or a corrupt insider at a small KYC vendor. The target's MSISDN, full name, parent's name and last billed amount are valuable; the attacker only needs enough to satisfy a customer-service script.
Step 2: Loss claim to telco
The attacker calls the telco IVR or walks into a reseller posing as the customer, claims the SIM is lost or damaged, and requests a replacement. Aadhaar-based eKYC since 2017 is supposed to require biometric verification at the port; small resellers and informal points-of-sale have been documented bending or skipping this step.
Step 3: SIM activation flip
Once the telco approves, the old SIM goes inactive within an hour or two. The new SIM, in the attacker's phone, attaches to the network and starts receiving the victim's voice and SMS. The victim sees a sudden loss of signal on a working phone, which is the one chance to notice the swap.

NFC cloning, QRJacking and UPI fraud at the counter

Tap-to-pay and scan-to-pay both inherit physical-world trust.

NFC card cloning is the short-range analogue of SIM swap: instead of porting a number, the attacker copies a card's identity onto a device the attacker controls. Three tools dominate the kit. The Proxmark3 RDV4 (around 30,000 INR landed in India) is the long-standing professional choice, with full ISO 14443 A/B and 15693 support, key recovery tools for MIFARE Classic, and DESFire authentication for weak deployments. The Flipper Zero (around 15,000 INR grey-market in India after the formal sales restrictions in some jurisdictions) is the consumer-grade entrant: smaller, with a screen, and packaged for one-tap clone-and-emulate against MIFARE Classic. Open-source firmware on a PN532 module costs under 2,000 INR and reaches the same MIFARE Classic recovery with more setup.

Three NFC attack patterns matter for examiners. First, simple cloning: a victim's MIFARE Classic transit card or office access card is read at close range (a bus queue, a shared elevator), the keys are recovered with the Hardnested or DarkSide attacks, and the card is emulated back to the legitimate reader. Older Bengaluru BMTC Smart Card and Delhi Metro Smart Card generations using MIFARE Classic were documented as cloneable in academic papers; modern deployments use DESFire EV2 or EV3 with AES key management. Second, relay attacks (ghost-and-leech): one device near the victim card reads its responses and a second device near the legitimate reader replays them in real time over a network link, completing a transaction without ever copying the card. Third, malicious tags: a sticker tag placed over a legitimate venue NFC tag (or simply on a poster) carries a URL that the victim phone auto-opens, dropping the user on a phishing site or triggering an intent:// deep link to a vulnerable app.

QR code attacks dominate Indian high-street fraud filings, and the dominant subset is QRJacking against UPI counters. The playbook is short: a fraudster prints a UPI QR pointing to a mule VPA on a sticker the same size as the merchant's legitimate QR; visits the shop during a busy moment; sticks the fraudulent QR over the original. Customers scan the wrong code and pay the mule. The merchant only notices at end-of-day reconciliation when the UPI receipts do not match the till count. NPCI's 2023 and 2024 advisories named QRJacking specifically and recommended laminated single-print QRs with the merchant's VPA and merchant name printed in large readable text above the code so customers can compare before tapping confirm.

Worked example

A SIM-swap timeline reconstructed for a Mumbai BFSI victim

Five hours, three banking apps, one missed signal-loss alert.

The victim is a Mumbai-based equity research analyst, MSISDN on Reliance Jio, banking primarily with ICICI plus an HDFC salary account and a Paytm wallet. The timeline below is reconstructed from the FIR (Bandra Cyber Police Station, 2023), the bank's customer dispute file, and Jio's CSR ticket. Names and amounts have been generalised.

19:42 IST on a Friday: an attacker calls Jio customer care from a CLI-spoofed number that displays the victim's own number, gives the victim's full name, last four digits of the registered Aadhaar (sourced from a leaked KYC scan), and the last month's billed amount. The attacker reports the SIM as damaged and requests a replacement at a specific Andheri reseller. The CSR approves the swap pending biometric verification at pickup.

20:14 IST: an accomplice walks into the Andheri reseller, presents a printed Aadhaar with the victim's name and a forged photo, and clears the biometric step with a silicone fingerprint dummy lifted from a prior physical interaction at the victim's gym. The new SIM is issued and activated. The old SIM goes inactive at 21:04.

21:07 IST: the victim, at dinner, notices a "No Service" indicator on his phone. He assumes a Jio network outage, restarts the phone, and continues. The single most reliable signal of an in-progress SIM swap is this exact symptom; the victim missed it.

21:09 to 22:30 IST: the attacker, holding the new SIM, initiates banking password resets on ICICI internet banking, HDFC NetBanking and Paytm. SMS OTPs arrive on the new SIM. The TRAI 24-hour cool-off should have blocked the OTP-bearing transactions on the swapped number, but at the time of the incident ICICI and HDFC's SMS gateway integration with Jio's swap-flag API was inconsistently enforced for retail-channel originations; the OTPs went through. Paytm's wallet held lower funds and was drained first; ICICI savings was drained within the next 40 minutes through a chain of UPI to mule wallet to e-commerce voucher.

22:35 IST: the victim, still without signal, walks to a Jio store the next morning and discovers the SIM swap. CEIR is filed at 09:20 IST Saturday. Bank dispute filings begin at 10:00 IST Saturday. Forensic recovery of part of the funds proceeded over the following six months via NPCI's transaction-trace process, and three of the mule accounts were frozen. The remaining funds were not recovered.

The teaching points are practical. First, the victim should have treated the unexplained "No Service" as a possible swap and called Jio from a friend's phone within 15 minutes. Second, the bank should have hard-enforced TRAI's cool-off rather than treating it as an advisory check. Third, biometric eKYC at the reseller failed against a moderately sophisticated forged-fingerprint attack, which is a known gap and the reason Aadhaar's UIDAI added live-finger detection to its newer biometric devices from 2022 onward. Cross-link to for the imaging and CDR analysis steps the cyber cell took on the recovered attacker devices.

Practice

Question 1 of 5· 0 answered

An IMSI catcher most reliably succeeds against a modern LTE phone by:

Frequently asked questions

How can a phone user tell that an IMSI catcher is operating in the area?

The single most reliable consumer-visible artefact is the phone's status bar dropping to 2G or E for an extended period in a location with normal LTE coverage. Apps like SnoopSnitch on Android (root preferred) and CellularPrivacy AIMSICD log cell tower IDs, BCCH frequencies, and unusual paging or rejection patterns and flag anomalies. Neither is conclusive on its own, but a 2G fallback in central Mumbai or central Bengaluru for more than a few minutes is suspicious.

Does WPA3 protect a phone against a captive-portal phish on a public network?

No. WPA3 protects the radio layer (key exchange and link encryption) and prevents offline dictionary attacks against a captured handshake. A captive portal sits above the radio layer at the application layer. WPA3 does not validate that the portal page is legitimate or that the SSID is operated by the venue claimed. The same evil-twin attack works whether the rogue AP runs Open, WPA2 or WPA3.

What should a SIM-swap victim do in the first hour after losing signal unexpectedly?

Treat the unexplained 'No Service' as a possible swap. Call the telco from a friend's phone within 15 minutes and request a freeze on the MSISDN pending verification. Log into bank apps from a clean device and force a logout of all sessions, then change passwords. File a CEIR report at ceir.gov.in for the original IMEI. File a 1930 call to the national cyber crime helpline and an online complaint at cybercrime.gov.in. Speed matters: the TRAI 24-hour cool-off is the only buffer.

Is it legal to own a Flipper Zero in India?

Importing and possessing a Flipper Zero in India is currently legal for personal research and CTF use; there is no specific prohibition under the Wireless Telegraphy Act or the IT Act. Use to clone another person's NFC card, transit card or office access card without authorisation is an offence under IT Act Sections 43, 66 and 66C and potentially BNS Sections 318 and 319. Customs has flagged some import shipments and required declaration of intended use; the device is not on a banned list as of 2026 but the regulatory posture continues to evolve.

QR fraud variant	Mechanics	Indian context	Defence
QRJacking (overlay)	Fraudster sticks own UPI QR over merchant's at the counter	Common at small kiranas, tea stalls, autos	Laminate QR, print VPA in large text above code, daily reconciliation
Malicious QR poster	QR on lamp post or poster redirects to phishing URL or APK download	Used in fake job, fake refund, fake KYC campaigns	Preview URL before opening, treat any QR-driven APK as hostile
Request-money confusion	Victim is sent a 'scan to receive' QR that is in fact a 'pay request'; victim approves the debit	Dominant pattern in Telegram and WhatsApp UPI scams	Never approve UPI requests for incoming money; receivers do not need to approve
UPI Collect Request via push	Attacker sends a UPI Collect request that the victim approves thinking it is a refund	Documented across NPCI advisories 2022 to 2024	Read the request screen carefully; debit vs credit is shown but missed
NFC tag overlay	Sticker tag placed over a legitimate venue tag carries a phishing URL	Less common in India but growing in metro stations	Disable NFC auto-launch in phone settings; tap to read URL first