3 ms·
In fact this is a method of stealing people's investment accounts -- a victim with an investment account is identified. That person's phone number is then "capt
by jackhack 8y ago
In fact this is a method of stealing people's investment accounts -- a victim with an investment account is identified. That person's phone number is then "captured". The investment account asks for 2FA and the thief now has that phone #, and "authenticates." The next step is to transfer all the money in the account to a third party and disappear.
It's disgusting how twisted these criminal activities have become.
- sitkack 8y agoI remember a reading about an activist that had all of their online accounts wiped by this vary mechanism. They had 2FA protecting everything, but someone called their cellular carrier and switched their account over to a new SIM. They then did password resets on all the accounts and wiped them. Every alternative way in is a larger attack area.
- aaron_m04 8y agoHow does the phone number get identified? You would think that'd be confidential.
- gowld 8y agoYou mean how incompetent the banks have become? Everyone has a phone that can a proper 2fa app like Authenticator. using SMS is inexecusable.
- packet_nerd 8y agoI got a Yubikey a few weeks ago and thought I'd switch to an online bank that offered Yibikey login... I spent hours looking and couldn't find any. Not even one. Couldn't even find any offering Google Authenticator. I saw that a few of the biggest banks will ship you an RSA token/similar device if you ask, but not quite what I had in mind.