3 ms·

"Apparently after I had left, someone went into a T-Mobile store and somehow convinced the associate that my number was theirs." How that can happen? When I vi

by kbart 9y ago

"Apparently after I had left, someone went into a T-Mobile store and somehow convinced the associate that my number was theirs." How that can happen? When I visit my cell provider's store, nobody is going to talk about any account details while you haven't provided a government issued ID to prove that you are an account holder. Sure, it's not 100% bulletproof method, but if somebody went a great lengths to counterfeit my ID, phone number is the least of my worries then. I assume, this happened in USA, so is ID check so unpopular there or it's easily circumvented somehow?

konceptz 9y ago
Yes, ID check is easily circumvented. People are the weakest link. The store reps are not government officials or police officers, nor do they scan ids. They may be convinced not to check your if, accept an id that isn't your drivers license, or anything else. The point is that by using an SMS as 2fa, is placing much of your security in underpaid cell phone store workers.
- kbart 9y ago
  "The store reps are not government officials or police officers, nor do they scan ids." Neither they are here (in EU), but nobody is going to talk to you unless you provide an ID anyway. Asking for ID doesn't seem too hard, even for non-trained personnel. You don't have to be a detective to match name/code on ID with the name/code on account.
  - rdtsc 9y ago
    Having access to potentially thousands of dollars from cleaning up victim's accounts is an incentive to go and obtain a fake ID. Do the store clerks scan and verify that the ID is genuine somehow (check against a database, look at the photo) or do they just look at it in passing and give it back.
    - PeterisP 9y ago
      From an EU perspective, obtaining a fake ID isn't that likely - counterfeiting anything certainly is possible, but it's hard and expensive (harder than counterfeiting money), risky (being caught with a fake means jail time, it's a more severe crime than theft and there's no "take-backsies" if they don't like the ID) so fraud with fake IDs is extremely rare. It may happen with certain large scale scams involving organized crime, but not for small amounts; it simply doesn't show up in practice. What does happen is use of real IDs that are stolen (or bought from homeless people), but most places that have some risks have access to registries where they can verify if the ID has been reported as stolen.
  - noeu8inoeui 9y ago
    Sure, but the excuse is then, "I had everything stolen! My phone, my wallet, etc. I just need to get my phone back so I can pay my rent and get an Uber to the DMV to get my new license." Then if the clerk says, "Sorry can't help you until you have an ID," you freak out and start yelling and the manager comes over and says, "I'm so sorry sir, let's get this worked out," and does whatever you ask him to.
    - PeterisP 9y ago
      Not happening in EU - since in such a case the company not verifying the ID tend to get liability for losses, all companies have policies where such managers are prohibited to do so; they would be risking their own money (and job) for giving you stuff without proper authorisation. I mean, as soon word would get out that some company allows that, they'd be exploited for free stuff in large amounts; all of the obvious loopholes have been tried and plugged in the last couple decades. USA has the problems only because they treat it as "stolen identity" instead of "someone defrauded a company with fake ID", and don't have proper universal IDs and try to make do with a mishmash of driver licences, names, addresses, SSNs, etc.

by kbart 9y ago

konceptz 9y ago

Yes, ID check is easily circumvented. People are the weakest link. The store reps are not government officials or police officers, nor do they scan ids. They may be convinced not to check your if, accept an id that isn't your drivers license, or anything else. The point is that by using an SMS as 2fa, is placing much of your security in underpaid cell phone store workers.

kbart 9y ago
"The store reps are not government officials or police officers, nor do they scan ids." Neither they are here (in EU), but nobody is going to talk to you unless you provide an ID anyway. Asking for ID doesn't seem too hard, even for non-trained personnel. You don't have to be a detective to match name/code on ID with the name/code on account.
- rdtsc 9y ago
  Having access to potentially thousands of dollars from cleaning up victim's accounts is an incentive to go and obtain a fake ID. Do the store clerks scan and verify that the ID is genuine somehow (check against a database, look at the photo) or do they just look at it in passing and give it back.
  - PeterisP 9y ago
    From an EU perspective, obtaining a fake ID isn't that likely - counterfeiting anything certainly is possible, but it's hard and expensive (harder than counterfeiting money), risky (being caught with a fake means jail time, it's a more severe crime than theft and there's no "take-backsies" if they don't like the ID) so fraud with fake IDs is extremely rare. It may happen with certain large scale scams involving organized crime, but not for small amounts; it simply doesn't show up in practice. What does happen is use of real IDs that are stolen (or bought from homeless people), but most places that have some risks have access to registries where they can verify if the ID has been reported as stolen.
- noeu8inoeui 9y ago
  Sure, but the excuse is then, "I had everything stolen! My phone, my wallet, etc. I just need to get my phone back so I can pay my rent and get an Uber to the DMV to get my new license." Then if the clerk says, "Sorry can't help you until you have an ID," you freak out and start yelling and the manager comes over and says, "I'm so sorry sir, let's get this worked out," and does whatever you ask him to.
  - PeterisP 9y ago
    Not happening in EU - since in such a case the company not verifying the ID tend to get liability for losses, all companies have policies where such managers are prohibited to do so; they would be risking their own money (and job) for giving you stuff without proper authorisation. I mean, as soon word would get out that some company allows that, they'd be exploited for free stuff in large amounts; all of the obvious loopholes have been tried and plugged in the last couple decades. USA has the problems only because they treat it as "stolen identity" instead of "someone defrauded a company with fake ID", and don't have proper universal IDs and try to make do with a mishmash of driver licences, names, addresses, SSNs, etc.