Does a SIM card have value? Yes, the data it contains is highly valuable.

At first glance, a SIM card may seem like nothing more than a tiny chip that gives your phone access to a cellular network. But hidden within that plastic card lies sensitive personal information that actually makes SIM cards quite valuable – especially to cybercriminals.

As a security expert, I can definitively say that the subscriber identity data stored on SIM cards is extremely useful for hackers and fraudsters. By understanding exactly how SIM cards work and what data they contain, you‘ll see why it‘s so important to protect and properly dispose of SIMs.

What is a SIM card?

A SIM, or subscriber identity module, is a small, removable microchip that allows a cell phone or mobile device to connect to a carrier‘s network. Every mobile phone needs a SIM card inserted into the phone to function (unless the device is CDMA only and doesn‘t require a SIM).

The SIM card performs two key functions:

• It identifies the user to the mobile network. Each SIM contains a unique ICCID number that is assigned to the user‘s account. This associates the subscriber with the phone number and services.

• It authenticates the phone to connect to the carrier‘s network. The SIM stores network authorization keys that allow the device to access the network.

Additionally, SIM cards provide space to store contacts, text messages, and other data that can be helpful to retain when switching phones.

According to Mobiles.com, the typical storage capacity of a SIM card is:

• Contacts: 250 names

• Text messages: 25 SMS messages

This may not seem like a lot of storage space. But as we‘ll explore next, the data stored on each tiny SIM card can provide tremendous value.

Why is the data on a SIM card so valuable?

To an average consumer, the contacts, text messages and other personal information stored on their SIM card may not seem very significant. But in the hands of a hacker or cybercriminal, this data can be extremely useful to facilitate a number of nefarious activities.

Access to someone‘s SIM card provides the ability to:

• Intercept phone calls and text messages: By inserting the SIM into another device, an attacker could potentially monitor incoming and outgoing communication.

• Access contacts and messages: Any stored names, numbers and text messages would be visible. This provides valuable reconnaissance for social engineering attacks.

• Impersonate the user: The phone number could be used with another device to pretend to be the victim. Imagine how much damage could be done if a fraudster impersonated you to your contacts.

• Connect to accounts: Many services authenticate users via the phone number on their SIM. Access allows circumventing 2-factor authentication.

According to the Identity Theft Resource Center, SIM swapping enabled over $68 million in funds to be stolen from victims in 2020. As Europol reports, organized cybercrime groups actively target and trade SIM card data on the black market.

I‘d advise being extremely cautious about keeping old SIM cards around or casually selling them online. You never know who might end up with that data.

Who wants to buy SIM card data?

On the dark web, SIM cards are a hot commodity. Various actors have an appetite for procuring SIM data:

• Cybercriminals use SIM cards to assist identity theft, financial fraud, and hacking into accounts.

• Private investigators may use SIM data to uncover information about a target.

• Surveillance agencies are eager to get their hands on SIM data for espionage purposes.

• Marketing firms will pay for SIM contacts to expand advertising reach.

According to UK telecom operator O2, a single SIM card sells for £5-10 on the black market. While not a huge profit for one SIM, this adds up at scale.

At full 256KB storage capacity, a SIM could contain:

• 250 Contacts
• 25 Text messages
• Other account data

For a skilled hacker, this data cache on each SIM card has incredible utility to enable a wide array of criminal activity.

Options for reusing and reselling SIM cards

Given the sensitive personal information they contain, you might wonder if there is a legitimate way to reuse or resell old SIM cards. There are a few options available:

• Exchange for a new SIM: Some carriers like Verizon and T-Mobile will give a discount or credit if you trade in your old SIM when upgrading phones. This properly recycles the SIM rather than exposing the data.

• Resell online: Sites like eBay do allow selling used SIMs. However, offers are usually only a few bucks given the minimal resale value. And handling buyer disputes can be a headache.

• Donate to charities: Organizations like GreenSIM collect donated SIMs to reuse for providing free calling and data to those in need. This is a great way to keep them out of the trash.

• Sell overseas: In developing markets, recycled SIMs can sometimes be resold at a markup. But navigating international reselling is complex.

As you can see, trying to resell one or a few used SIM cards offers very little ROI for the typical consumer. To make real money requires a sophisticated large-scale SIM recovery operation – which carries big legal and regulatory risks.

Disposing of SIM cards properly

When it‘s time to upgrade your mobile device, it‘s critical that you properly dispose of your old SIM card. Given what‘s at stake, simply tossing SIM cards in the garbage is extremely risky.

Here are a few best practices to destroy SIM cards safely:

• Remove SIM before selling/trading devices: Never leave SIM cards behind in a phone you are getting rid of.

• Cut into smaller pieces: Use scissors to cut the SIM card into smaller parts before disposal. This helps destroy the internal chip.

• Burn the SIM: Incinerating the SIM card will ensure the data can‘t be recovered. Just make sure to do so safely.

• Use carrier disposal box: Some providers like AT&T offer secure disposal boxes to submit old SIM cards for proper destruction.

Taking these steps minimizes the chances of your SIM card data falling into the wrong hands. As the CEO of CyberScout writes, "When in doubt,destroy it and leave nothing to chance." I couldn‘t agree more when it comes to protecting sensitive personal data.

The bottom line

In summary, while the gold and other commodities in SIM cards are not inherently valuable, the subscriber identity data stored on the chip has tremendous worth, particularly to cybercriminals. Trying to resell your old SIM is usually not worth the effort. But failure to properly dispose of SIM cards poses a real security threat. I hope this breakdown has helped underscore why it‘s so important to safeguard and destroy your SIMs. Please feel free to reach out with any other mobile security questions!