Scammers Exploit Dubai Missile Crisis to Target Bank Accounts Through SIM-Swap Attacks

Scammers are exploiting the chaos following Iranian missile strikes on Dubai to target vulnerable citizens with sophisticated SIM-swap attacks aimed at draining bank accounts, Dubai Police have warned.

The financial cybercrime campaign began mere hours after missiles struck the city on Saturday, with criminals posing as officials from a fictitious "Dubai Crisis Management" department supposedly tied to Dubai Police. These fraudsters are specifically targeting individuals affected by the deadly attacks, attempting to gather sensitive personal information that could be used to hijack mobile phone accounts.

According to Dubai Police, the scammers are impersonating crisis management officials to acquire "sensitive information, including UAE Pass credentials and Emirates ID details, from vulnerable individuals rocked by the deadly Iranian missile attacks." The police emphasized that such data could enable criminals to carry out SIM swap operations and gain unauthorized access to bank accounts through mobile banking applications.

SIM swapping, also known as SIM jacking, is a form of social engineering attack where criminals gather personal details about victims and use this information to convince mobile network operators to transfer control of a victim's phone number to a SIM card controlled by the attackers. Once successful, the attackers can intercept one-time passcodes and authentication messages sent to the victim's phone number, effectively bypassing security measures on mobile banking apps and other sensitive accounts.

These types of attacks have proven highly effective for cybercrime groups in recent years. Scattered Spider, a notorious cybercrime collective, historically relied heavily on SIM swapping as their primary tactic for gaining access to high-value accounts and cryptocurrency wallets. The method's effectiveness stems from its ability to circumvent traditional two-factor authentication systems that rely on SMS-based verification codes.

Dubai Police have issued a stern warning to residents, stating unequivocally that "they do not request confidential information or verification codes via telephone calls or text messages under any circumstances." The department has urged the public to remain vigilant and avoid sharing personal or banking information with any unverified parties.

Citizens who suspect they have been targeted by these fraudulent activities are encouraged to report incidents immediately through official channels. Dubai Police have provided two primary reporting methods: calling 901 or using the eCrime platform, which is dedicated specifically to cybercrime reports.

The scam campaign emerges against the backdrop of severe geopolitical tensions in the region. The United States and Israel launched aerial strikes on Iran starting February 28, reportedly resulting in hundreds of civilian casualties, including children, and the deaths of top officials such as Supreme Leader Ali Khamenei. Iran responded with missile attacks targeting US military bases and various locations, including a UK Royal Air Force base in Cyprus and multiple sites in Dubai.

The missile strikes on Dubai were particularly devastating, with the city's airport and Abu Dhabi's airport both being bombed, leading to multiple casualties and fatalities. Drone strikes also hit luxury hotels in the area, where staff were forced to guide guests into underground car parks for safety. The attacks have created an atmosphere of fear and uncertainty, which criminals are now exploiting to carry out their fraudulent schemes.

US President Donald Trump has defended the US-Israel strikes as a response to "longstanding campaigns of violence toward the US" and Iran's continued refusal to end its nuclear program. Meanwhile, Iran has characterized its missile retaliation as a "legitimate act of self-defense," highlighting the complex and volatile nature of the current conflict.

The convergence of actual crisis and criminal exploitation presents a particularly dangerous situation for Dubai residents. While the city grapples with the aftermath of missile strikes and the broader implications of regional conflict, citizens must also remain alert to opportunistic cybercriminals seeking to capitalize on the chaos.

Security experts note that crisis situations historically create ideal conditions for various forms of fraud and cybercrime. The combination of heightened emotions, disrupted communication channels, and increased reliance on digital services during emergencies provides criminals with multiple attack vectors. SIM swapping attacks are particularly insidious because they can be executed remotely, require relatively little technical expertise compared to other forms of cybercrime, and can result in immediate financial losses for victims.

The Dubai Police warning serves as a crucial reminder that official government agencies and law enforcement will never request sensitive personal information or authentication codes through unsolicited phone calls or text messages. Citizens are advised to verify any unexpected communications claiming to be from government departments through official channels before providing any information.

As the situation in the region continues to evolve, both the immediate threat of further military action and the ongoing risk of cybercrime campaigns targeting vulnerable populations remain significant concerns. The incident underscores the importance of maintaining robust cybersecurity practices even during times of genuine crisis, as criminals will invariably seek to exploit any opportunity for financial gain.