6 ms·

I'm a blockchain pro and there was a couple month period in 2017 when tons of people I know got SIM swapped including me. The T-Mobile call person kept asking m

I'm a blockchain pro and there was a couple month period in 2017 when tons of people I know got SIM swapped including me. The T-Mobile call person kept asking me "Are you sure you didn't go into a store in Detroit and ask for your phone to be changed? They showed an ID!" No, I didn't do that. Luckily I had 2-factor for everything, but I know some people who lost a lot. SMS is totally broken, use 2FA and hardware key if you can. The craziest one was two people at another firm were sending each other a lot of money, and sent the address over Telegram. The hacker manipulated the address in the message - they checked after the (failed) transaction and the address sent was different than the address in the message received! I think the most likely cause was that the receiver's computer was rooted and the application itself was manipulated on the device, rather than the message contents changed en-route. This is why I recommend both visual and audio confirmation when sending large amounts.

ericschn 6y ago
I was also the victim of a T-Mobile SIM swap back in February. My assumption is that the attackers target individuals that have a high likelihood of owning bitcoin or other digital currency. This can be easily determined by looking at data breaches, and targeting emails that are found both on a cryptocurrency breach and a personal information breach with phone number, name, address, and anything else that would help impersonate the victim. They accessed my insecure email with SMS authentication, but everything else was locked down more securely. Also, since that day I have been getting 20 times more spam calls and texts, I'm guessing they added my number to some other targeted list.
- schoolornot 6y ago
  I SIM swapped myself twice on Sprint without authorization at an Apple store. Sales reps can generate a one time code for Sprint Support that allows them to bypass some of the IVRs and prove the call is coming from an Apple Store. Sprint support won't ask for a PIN or SSN. Just the line's number. Bam! How many people can do this? See those mom and pop "authorized resellers" at the mall? Yeah.
  - wil421 6y ago
    When someone stole my identity and opened up 8 lines they did it all at “authorized reseller” phone booths. I believe it was at a Costco. AT&T still let them order 4 new lines on a new account even though I already had an account with 2 lines.
- octoberfranklin 6y ago
  > This can be easily determined by looking at data breaches, and targeting emails that are found both on a cryptocurrency breach and a personal information breach with phone number, name, address ... and this is why you should never use your identity for these things. KYC is a security liability.
- ThatPlayer 6y ago
  Happened to one of my friends who was also on T-mobile and had some bitcoins at some point. They got into his email and coinbase account, but he was holding any bitcoin so they tried to buy some which was declined by the credit card.
R0b0t1 6y ago
Why are the phone companies not responsible for swapping the number over? In a similar vein, I've known people who had unsigned checks stolen and their signature forged very poorly. The banks are supposed to check the signature, so why aren't the banks liable?
- deleted 6y ago
  [deleted]
- x87678r 6y ago
  The phone company is giving you a phone number, it doesn't want to be responsible for providing security for your financial and private life.
  - lotsofpulp 6y ago
    Yes, it's really quite amazing to watch all companies including the US government pretty much task the mobile networks with providing plausible deniability that they verified your identity. They get to point to the mobile networks (or you) if there's a problem, and the mobile networks get to say, legally, it's not their problem...because it isn't.
- octoberfranklin 6y ago
  > The banks are supposed to check the signature, Actually no, not anymore after the "Check 21" act. They're not responsible for verifying any aspect of the check. Kind of a crock.
shiftpgdn 6y ago
I know of a number of oil companies who had tens, if not hundreds of millions of dollars stolen in 2016. Their accountants were spear phished and their outboxes were closely monitored. When an outbound invoice was sent the email was caught and then altered to show the fraudsters bank and routing numbers. Oil companies are notoriously slow to pay (and frequently take lots of nudging to get a payment out) so the payment never showing up didn't seem out of the ordinary. It was all kept hush hush to prevent copycat attacks. It took intervention from the FBI and a big netsec firm to even figure out how it had happened.
- airstrike 6y ago
  OK, time to write an article and submit here. That sounds way too interesting for just a comment!
kyrra 6y ago
(Googler, opinions on my own) This is a nice benefit of Google Fi. Since swap attacks are not possible with it, as customers support agents aren't able to do sim swaps. Sims for Google Fi are fully tied to your Google account, and you must have access to that account to be able to register or unregister a phone.
- graton 6y ago
  I'm guessing this likely also applies to a Google Voice account phone number.
- ericabiz 6y ago
  Unfortunately Google Fi has its own set of issues that make it unpalatable as a primary mobile phone service: https://onemileatatime.com/google-fi-review/ https://onemileatatime.com/google-fi-review/
  - kyrra 6y ago
    I believe this is around when Google Fi expanded to support iOS? I think there were some admitted growing pains around that time, and they've worked to improve it since then. Hard to say.
- devenblake 6y ago
  What happens when Google spontaneously bans your account for no reason?
  - ThePowerOfFuet 6y ago
    What do you think happens?
- est31 6y ago
  Is there a guarantee that Google won't add this feature in the future? What if people lost their phones etc.? I think the risk is too big. Use U2F, or something similar.

ericschn 6y ago

I was also the victim of a T-Mobile SIM swap back in February. My assumption is that the attackers target individuals that have a high likelihood of owning bitcoin or other digital currency. This can be easily determined by looking at data breaches, and targeting emails that are found both on a cryptocurrency breach and a personal information breach with phone number, name, address, and anything else that would help impersonate the victim. They accessed my insecure email with SMS authentication, but everything else was locked down more securely. Also, since that day I have been getting 20 times more spam calls and texts, I'm guessing they added my number to some other targeted list.

schoolornot 6y ago
I SIM swapped myself twice on Sprint without authorization at an Apple store. Sales reps can generate a one time code for Sprint Support that allows them to bypass some of the IVRs and prove the call is coming from an Apple Store. Sprint support won't ask for a PIN or SSN. Just the line's number. Bam! How many people can do this? See those mom and pop "authorized resellers" at the mall? Yeah.
- wil421 6y ago
  When someone stole my identity and opened up 8 lines they did it all at “authorized reseller” phone booths. I believe it was at a Costco. AT&T still let them order 4 new lines on a new account even though I already had an account with 2 lines.
octoberfranklin 6y ago
> This can be easily determined by looking at data breaches, and targeting emails that are found both on a cryptocurrency breach and a personal information breach with phone number, name, address ... and this is why you should never use your identity for these things. KYC is a security liability.
ThatPlayer 6y ago
Happened to one of my friends who was also on T-mobile and had some bitcoins at some point. They got into his email and coinbase account, but he was holding any bitcoin so they tried to buy some which was declined by the credit card.

R0b0t1 6y ago

Why are the phone companies not responsible for swapping the number over? In a similar vein, I've known people who had unsigned checks stolen and their signature forged very poorly. The banks are supposed to check the signature, so why aren't the banks liable?

deleted 6y ago
[deleted]
x87678r 6y ago
The phone company is giving you a phone number, it doesn't want to be responsible for providing security for your financial and private life.
- lotsofpulp 6y ago
  Yes, it's really quite amazing to watch all companies including the US government pretty much task the mobile networks with providing plausible deniability that they verified your identity. They get to point to the mobile networks (or you) if there's a problem, and the mobile networks get to say, legally, it's not their problem...because it isn't.
octoberfranklin 6y ago
> The banks are supposed to check the signature, Actually no, not anymore after the "Check 21" act. They're not responsible for verifying any aspect of the check. Kind of a crock.

shiftpgdn 6y ago

I know of a number of oil companies who had tens, if not hundreds of millions of dollars stolen in 2016. Their accountants were spear phished and their outboxes were closely monitored. When an outbound invoice was sent the email was caught and then altered to show the fraudsters bank and routing numbers. Oil companies are notoriously slow to pay (and frequently take lots of nudging to get a payment out) so the payment never showing up didn't seem out of the ordinary. It was all kept hush hush to prevent copycat attacks. It took intervention from the FBI and a big netsec firm to even figure out how it had happened.

airstrike 6y ago
OK, time to write an article and submit here. That sounds way too interesting for just a comment!

kyrra 6y ago

(Googler, opinions on my own) This is a nice benefit of Google Fi. Since swap attacks are not possible with it, as customers support agents aren't able to do sim swaps. Sims for Google Fi are fully tied to your Google account, and you must have access to that account to be able to register or unregister a phone.

graton 6y ago
I'm guessing this likely also applies to a Google Voice account phone number.
ericabiz 6y ago
Unfortunately Google Fi has its own set of issues that make it unpalatable as a primary mobile phone service: https://onemileatatime.com/google-fi-review/ https://onemileatatime.com/google-fi-review/
- kyrra 6y ago
  I believe this is around when Google Fi expanded to support iOS? I think there were some admitted growing pains around that time, and they've worked to improve it since then. Hard to say.
devenblake 6y ago
What happens when Google spontaneously bans your account for no reason?
- ThePowerOfFuet 6y ago
  What do you think happens?
est31 6y ago
Is there a guarantee that Google won't add this feature in the future? What if people lost their phones etc.? I think the risk is too big. Use U2F, or something similar.