3 ms·

It's much simpler. The attackers simply go to the service provider, claim they lost the sim card/phone and provide your details. If they're convincing enough th

It's much simpler. The attackers simply go to the service provider, claim they lost the sim card/phone and provide your details. If they're convincing enough the provider will deactivate your SIM and activate theirs within 10 minutes or so and by the time you notice your mobile connection doesn't work anymore they're already busy entering TANs sent to your number. Now I don't know how easy that is to pull off in the US, but it varies in different countries. In some it takes a day to switch to a new SIM, in some you only need the real owner's name and a codeword and it'll get switched within minutes, for free and no questions asked.

sodafountan 7y ago
It seems to me like there needs to be far more security in place before a SIM card can be swapped out over the phone. You should need to state your SSN, answer a few security questions and maybe let them know how much you paid on your last three bills or something like that. That doesn't mitigate the risk of bribery but if you have the right software in place for the person on the line at T-Mobile or AT&T then they wouldn't be able to proceed without the proper verification. Seems like a pretty big but easy to solve problem to me.