4 ms·

Got my t-mobile SIM hijacked and the hackers changed my email, then tried to get access to my Coinbase account. Thank god I was using a 2FA app for the latter.

by rafale 5y ago

Got my t-mobile SIM hijacked and the hackers changed my email, then tried to get access to my Coinbase account. Thank god I was using a 2FA app for the latter. To this day I don't know how the hackers did it. Thru social engineering on phone? In person at an agency with fake id? Or a corrupt insider working at T-mobile. This happened after the Ledger hack. My SSN was also leaked in the Equifax hack. This experience made me realize how much of a joke the concept of "identity" is in our society. It can be bought and stolen like any asset.

arkadiyt 5y ago
Most carriers, including T-Mobile, support a "NOPORT" feature to disallow porting your phone number: https://www.vice.com/en/article/ywa3dv/t-mobile-has-a-secret-setting-to-protect-your-account-from-hackers-that-it-refuses-to-talk-about https://www.vice.com/en/article/ywa3dv/t-mobile-has-a-secret...
- toast0 5y ago
  I can't figure out how to get these enabled for prepaid accounts (t-mobile and verizon). And I'm not going to switch to post paid for 2-3x the cost just for this. I'm already paying extra to use carrier prepaid instead of an MVNO.
- deleted 5y ago
  [deleted]
- netsec_burn 5y ago
  When you say most carriers, which ones are you specifically referring to?
  - rafale 5y ago
    All of them practically. I think at the beginning the feature was mostly used for celebrities and public figures. But I think it should become the default. The main reason it's not, in my understanding, is because of a federal telecom law that states it should be easy to transfer phone numbers across providers.
- post_break 5y ago
  T-Mobile is a joke about that though. So many reports of people having that on their account and still getting it ported.
- rl3 5y ago
  I was told that this was no longer a thing at T-Mobile. However, reps can still add notes to your file indicating to not port unless you're physically present with a valid ID. That doesn't cover ports conducted online via unauthorized account access, though. Adding a similar note prohibiting account recovery assistance unless physically present is a good idea as well.
b8 5y ago
Google Fi is resistant against SIM swapping[1]. They would have to hijack the google account associated with the Google Fi number in order to transfer the phone number. I wonder if Google Fi customers PI is apart of this data dump. Since Google Fi uses T-Mobile networks[2]. 1. https://support.google.com/fi/answer/9834243?hl=en https://support.google.com/fi/answer/9834243?hl=en 2. https://en.wikipedia.org/wiki/Google_Fi https://en.wikipedia.org/wiki/Google_Fi
- tmp_anon_22 5y ago
  If your account is deactivated on a separate google service (let's say, adsense) what happens to your Google Fi?
- supertrope 5y ago
  Now you're just vulnerable to Google shutting down your account with no recourse. It's rumored that can be triggered by a credit card decline due to fraud.
  - b8 5y ago
    I presume that can also happen with T-Mobile, Verizon etc. As long as you follow the Terms of Service then you should be ok. I've read the stories on HN about people's Google account being supposedly arbitrary closed. But in the comments someone from Google usually replies that they investigated the incident and the account closure was valid. I would hope that Google would cancel the service and release the phone number if an account is closed. T-Mobile and Verizon has actual retail stores. But I doubt retail staff could actually help a customers account that was closed due to fraud etc. I chatted with a Google customer rep and they said that they could recover a phone number from a deleted Google account if the person still had the original sim card + a new Google account.
    - 542354234235 5y ago
      Yes, you should be ok. But if you aren’t, there is no mechanism for you to fix it or recourse to contest it. You are simply at the mercy of Google and what they decide to tell you and decide to provide to you. Maybe consumers should not have important services they rely on dropped arbitrarily. Maybe consumers deserve more than “Google said they investigated and said it was valid, so case closed”. Maybe rights and protections should not default to the massive powerful company, but to the individual with no a fraction of the resources. Maybe we should recognize that those two entities are not on equal footing and that maybe the burden should be on the entity with an army of lawyers and not the entity with no legal training.
kencausey 5y ago
It has been a bit over a year now but my T-mobile SIM was hijacked twice in one weekend. After the first time I reset the PIN to a six or eight digit PIN expecting that to be good enough. After the second time I made it even longer. That said, I believe that it was some sort of inside job and the PIN was never actually needed. I vaguely recall some story in the following months regarding prosecution of T-Mobile staff for related activity. CORRECTION: This was almost 3 years ago. sigh
- smellsinore 5y ago
  How was your SIM hijacked? Do you mean eSIM? or your phone was cloned somehow?
  - zinekeller 5y ago
    I don't know where you are, but in America you can request SIM replacements with the same number. These should be only in cases where you lose or damaged the original SIM, but either some staff got a bit lenient or the impostor have forged the necessary documents to prove ownership. Oh, and you can request it on-phone too (plus mailbox interception!) It seems that in this case, the poster alleges that some staff might be actually involved in this process (which in this case, it's game over).
    - dkrysl 5y ago
      Sorry, can you explain this? > you can request it on-phone too (plus mailbox interception!)
      - zinekeller 5y ago
        Like, contact the customer service hotline, and since they're sending the SIM card through the registered address, someone must get it in delivery. Alternatively, just literally ask the customer service to change the address. They should checked these kinds of requests, but considering that currently the T-mobile data leak is on the front page, you shouldn't be really shocked on how lax American security standards (except for their military) are.
JTbane 5y ago
>To this day I don't know how the hackers did it. Thru social engineering on phone? In person at an agency with fake id? Or a corrupt insider working at T-mobile. Usually these SIM swaps are from an outside person socially engineering over the phone or in a store. It's not unheard of to have an insider though.

by rafale 5y ago

arkadiyt 5y ago

Most carriers, including T-Mobile, support a "NOPORT" feature to disallow porting your phone number: https://www.vice.com/en/article/ywa3dv/t-mobile-has-a-secret-setting-to-protect-your-account-from-hackers-that-it-refuses-to-talk-about https://www.vice.com/en/article/ywa3dv/t-mobile-has-a-secret...

toast0 5y ago
I can't figure out how to get these enabled for prepaid accounts (t-mobile and verizon). And I'm not going to switch to post paid for 2-3x the cost just for this. I'm already paying extra to use carrier prepaid instead of an MVNO.
deleted 5y ago
[deleted]
netsec_burn 5y ago
When you say most carriers, which ones are you specifically referring to?
- rafale 5y ago
  All of them practically. I think at the beginning the feature was mostly used for celebrities and public figures. But I think it should become the default. The main reason it's not, in my understanding, is because of a federal telecom law that states it should be easy to transfer phone numbers across providers.
post_break 5y ago
T-Mobile is a joke about that though. So many reports of people having that on their account and still getting it ported.
rl3 5y ago
I was told that this was no longer a thing at T-Mobile. However, reps can still add notes to your file indicating to not port unless you're physically present with a valid ID. That doesn't cover ports conducted online via unauthorized account access, though. Adding a similar note prohibiting account recovery assistance unless physically present is a good idea as well.

b8 5y ago

Google Fi is resistant against SIM swapping[1]. They would have to hijack the google account associated with the Google Fi number in order to transfer the phone number. I wonder if Google Fi customers PI is apart of this data dump. Since Google Fi uses T-Mobile networks[2]. 1. https://support.google.com/fi/answer/9834243?hl=en https://support.google.com/fi/answer/9834243?hl=en 2. https://en.wikipedia.org/wiki/Google_Fi https://en.wikipedia.org/wiki/Google_Fi

tmp_anon_22 5y ago
If your account is deactivated on a separate google service (let's say, adsense) what happens to your Google Fi?
supertrope 5y ago
Now you're just vulnerable to Google shutting down your account with no recourse. It's rumored that can be triggered by a credit card decline due to fraud.
- b8 5y ago
  I presume that can also happen with T-Mobile, Verizon etc. As long as you follow the Terms of Service then you should be ok. I've read the stories on HN about people's Google account being supposedly arbitrary closed. But in the comments someone from Google usually replies that they investigated the incident and the account closure was valid. I would hope that Google would cancel the service and release the phone number if an account is closed. T-Mobile and Verizon has actual retail stores. But I doubt retail staff could actually help a customers account that was closed due to fraud etc. I chatted with a Google customer rep and they said that they could recover a phone number from a deleted Google account if the person still had the original sim card + a new Google account.
  - 542354234235 5y ago
    Yes, you should be ok. But if you aren’t, there is no mechanism for you to fix it or recourse to contest it. You are simply at the mercy of Google and what they decide to tell you and decide to provide to you. Maybe consumers should not have important services they rely on dropped arbitrarily. Maybe consumers deserve more than “Google said they investigated and said it was valid, so case closed”. Maybe rights and protections should not default to the massive powerful company, but to the individual with no a fraction of the resources. Maybe we should recognize that those two entities are not on equal footing and that maybe the burden should be on the entity with an army of lawyers and not the entity with no legal training.

kencausey 5y ago

It has been a bit over a year now but my T-mobile SIM was hijacked twice in one weekend. After the first time I reset the PIN to a six or eight digit PIN expecting that to be good enough. After the second time I made it even longer. That said, I believe that it was some sort of inside job and the PIN was never actually needed. I vaguely recall some story in the following months regarding prosecution of T-Mobile staff for related activity. CORRECTION: This was almost 3 years ago. sigh

smellsinore 5y ago
How was your SIM hijacked? Do you mean eSIM? or your phone was cloned somehow?
- zinekeller 5y ago
  I don't know where you are, but in America you can request SIM replacements with the same number. These should be only in cases where you lose or damaged the original SIM, but either some staff got a bit lenient or the impostor have forged the necessary documents to prove ownership. Oh, and you can request it on-phone too (plus mailbox interception!) It seems that in this case, the poster alleges that some staff might be actually involved in this process (which in this case, it's game over).
  - dkrysl 5y ago
    Sorry, can you explain this? > you can request it on-phone too (plus mailbox interception!)
    - zinekeller 5y ago
      Like, contact the customer service hotline, and since they're sending the SIM card through the registered address, someone must get it in delivery. Alternatively, just literally ask the customer service to change the address. They should checked these kinds of requests, but considering that currently the T-mobile data leak is on the front page, you shouldn't be really shocked on how lax American security standards (except for their military) are.

JTbane 5y ago

>To this day I don't know how the hackers did it. Thru social engineering on phone? In person at an agency with fake id? Or a corrupt insider working at T-mobile. Usually these SIM swaps are from an outside person socially engineering over the phone or in a store. It's not unheard of to have an insider though.