I used to work at BestBuy mobile about 3 years ago. The level of access I had to as a retail employee making $9 an hour was incredible. Verizon accounts are by

I used to work at BestBuy mobile about 3 years ago. The level of access I had to as a retail employee making $9 an hour was incredible. Verizon accounts are by default secured only by the last 4 SSN numbers of the account holder, with an optional 5 alphanumeric password. AT&T was worse as there was no default verification required, it was only presented as a recommended validation to me. I could type in any AT&T phone number and click the "Skip Verification" button. Many employees get in the habit of doing this by default to save time and that makes the problem worse, as they ignore the large "VERIFY CUSTOMER" text. Don't remember the password? No problem, It was not uncommon for me to make a quick call to my account manager for whatever carrier and simply ask them for the last 4 digital of the social or the password. Im not sure if they just trusted me, or if this was normal practice. But I could get into anybodys account, for the 3 major carriers, with little to no verification. Thats not even mentioning being able to search through BestBuys entire customer database. Porting of numbers if an obvious vector for this kind of attack, but its also worth noting that swapping the ICCID on the line (the SIM card number) is a much more effecient solution, as it doesn't require the attacker to setup new cell phone service anywhere. Carriers are starting to catch on to this though as more of these attacks happen to high profile users.