13 ms·

NY Man Pleads Guilty in $20M SIM Swap Theft

152 points by picture 5y ago

71a54xd 5y ago
How on earth did they catch this guy? Curious if the victim was high profile enough to merit some kind of "real" investigation?
toomuchtodo 5y ago
Tangentially, the FCC is forcing the hand of mobile carriers on this. T-Mobile just the other day has updated their policy so that two employees must be present and part of the process to swap a customer’s SIM. The perils of your phone number being your identity. Refreshing to see these active theft and wire fraud prosecutions.
- thathndude 5y ago
  Lawyers have been making bank filing claims against the Telecoms for sim swap losses. Never did any myself, but have friends who have done well with these cases. They essentially allow the lawyers to share in the appreciation of crypto.
- krebsonsecurity 5y ago
  That's nice to hear. So the SIM swappers have to double their bribes. I think the best solution is to cut the mobile providers out of the equation altogether. I've long advised removing your phone number from anything you can, or at least substituting a voip service that can't be social engineered over the phone. Some services don't let you use voip services for multi-factor or signup, so your mileage may vary. Also, it's important where possible to use types of multi-factor that don't rely on your phone number. The tricky part is, so many sites will let you reset your password if you can receive a link via SMS at the phone number on file for the account. Which means anyone who SIM-swaps you then can reset the passwords on those accounts that allow SMS resets (which is a lot, still).
  - ghaff 5y ago
    One of the few things I miss about giving up my landline a couple years ago is that I pretty much have to give out my cell phone number for anything that needs a valid phone number. (yes, I could use Google Voice or some sort of VOIP number but that starts making things complicated.) I used to be very selective at giving out my cell number.
    - Maursault 5y ago
      > yes, I could use Google Voice or some sort of VOIP number but that starts making things complicated. You should soldier through it. Google Voice is a decent free service domestically, unless paranoid. I use it in the reverse manner as I expect you would intend (if you'd intend to generate many virtual throw away numbers to forward back to your phone until the forwarding is manually severed). My actual phone number has changed many times over the years, but my GV number stays the same. Eventually, I got rid of my phone altogether. That was January 2014. But jobs will often require I carry the on-call cell (which I almost never need to use and just for work). Boy I sure miss those cell phone bills every month, not. I just realized GV has saved me at least $10K since I cancelled my cell contract.
      - Larrikin 5y ago
        More and more places refuse to accept my Google voice number for verification. It started out with nearly all banks but has gotten ridiculous recently. Target outright refused for Target circle a couple years ago. Recently 7-11 had accepted my Google voice number to get points on in store purchases but now that I live somewhere where I need a car, the gas pump decided the number was invalid when I tried to get the discount on gas from the pump I'm worried since I basically never gave out my actual cell for over a decade now
        Maursault 5y ago
        Good point, that is a problem, though I can't fathom why a bank wouldn't accept it, but I do recall having issues before with some site not accepting it (possibly Craigslist?). My solution is simple: if my GV number is not accepted, I take my business elsewhere.
supernova87a 5y ago
I wonder if the following idea has occurred to anyone else? We have more and more kinds of accounts, financial products, online services, etc. that would benefit from some kind of real in-person verification at points in the process (initial application, maintenance, changes to account) that are imperfectly done with credit checks, questions/answers, logins, etc. We have Post Offices in nearly every corner of this country. How about turning them into a kind of value-added identity verification service where any company wanting/needing an identity verification could rely on the Post Office to accept someone in person to prove who they are (through fingerprint, document, etc) and be the 3rd party to make this proof easy? Sure you would need to have normal fraud protections, etc. but I bet the act of having to come to a post office would make things very secure / reliable. And it would give the post office a new function. I heard of this being done in some other countries. It seems like a way to avoid us all having to pay for fraud so frequently.
- lordnacho 5y ago
  There's a number of KYC services where you're basically asked to be filmed and a person in a call centre looks at it and decides whether it's really you. When I went looking at them they were boasting with using AI, and then in the meeting it turned out it was mostly farmed out to someone in India.
  - ribosometronome 5y ago
    You misread. They're using Al, he's in Chennai and on call 24/7.
- Tenoke 5y ago
  >We have Post Offices in nearly every corner of this country. How about turning them into a kind of value-added identity verification When I opened a bank account (n26) in Germany this is how they verified my identity (along with a brief video call) as a foreigner so the idea has merit.
  - froh 5y ago
vmception 5y ago
He only got caught because he bragged about it? Horrible deterrent, because it isnt a deterrent
- miohtama 5y ago
  6 weeks Fear and Loathe and living like a king in Las Vegas is worth of 5 years of jail mate sex? Unless… > “On the surface, Pinsky is an ‘All American Boy,'” Terpin’s civil suit charges. “The son of privilege, he is active in extracurricular activities and lives a suburban life with a doting mother who is a prominent doctor.”
- paulpauper 5y ago
  He would have been caught eventually when cashing out. he does not seem careful enough.
Jerrrry 5y ago
>Truglia is still being criminally prosecuted in Santa Clara, Calif., the home of the REACT task force, which pursues SIM-swapping cases nationwide. In November 2018, REACT investigators and New York authorities arrested Truglia on suspicion of using SIM swaps to steal approximately $1 million worth of cryptocurrencies from Robert Ross, a San Francisco father of two who later went on to found the victim advocacy website stopsimcrime.org. holy shit, no wonder people are going dark. yall better hide.
- syspec 5y ago
  Silicon Valley REACT task force? In the end Truglia's bragging to gain /props/ for a /component/ of this crime, is what lead to the REACT task force getting their /hooks/ into his /lifecycle/.
walrus01 5y ago
1) The ability to reset account credentials or get into a service just by using a phone number is not real 2FA and is a huge security risk generally. SMS based 2FA is not real 2FA. 2) Social engineering mobile phone first-tier customer service reps into doing a SIM swap is not hard at all.
admn2 5y ago
So is it recommended to remove your phone number from your Google account to ensure it's not used to ever reset the password?
- paulpauper 5y ago
  never keep a lot of crypto on anything that is connected to a phone and or email
- jyap 5y ago
  Yes, definitely.
- dbuder 5y ago
  They are currently trying to force me to add my mobile number to gmail. If I get logged out they are going to lock me out until I do.
- thathndude 5y ago
  Yes. Google will constantly remind you to add one to “secure” your account, but just ignore it. You want no recovery emails and just an authenticator app.
deleted 5y ago
[deleted]
shiado 5y ago
SMS-based 2FA needs to be eliminated completely. Authenticator apps need to come preinstalled as an essential utility on every OS. There doesn't seem to be a whole lot of pressure to improve 2FA security.
- rib3ye 5y ago
  I don't think it's too heavy handed to make the practice of implementing SMS 2FA straight-up illegal. If credit card processing requires PCI compliance why wouldn't we apply similar thought to 2FA?
- m4rtink 5y ago
  Doesnt that force people to not only use smartphones, but "approved" smartphones (read Android/iOS) with locked bootloaders and no root access (or the bank authenticator app will refuse to run)?
  - PeterisP 5y ago
    A dedicated 2FA token (yubikey, or many other brands) is also a reasonable option, and many systems support these standards (U2F/FIDO2).
- kevin_thibedeau 5y ago
  Apps just embolden employers to shirk on providing secure TOTPs or work phones. You should not be forced to use your personal property to conduct job duties.
- mikestew 5y ago
  There doesn't seem to be a whole lot of pressure to improve 2FA security. I gave up on that ten years ago when I worked at a biometric authentication company. Banks were soon to be regulated to use 2FA, and our system was easy to use, we're all gonna be rich! Then the banks were allowed to use security questions as 2FA. Not only were the employees not "all gonna be rich", everyone else was going to get fucked when they accidentally post something on Facebook about how their mother (neé Mary $MAIDEN_NAME) used to do $SOMETHING on $STREET_I_GREW_UP_ON. So the continued use of SMS-base 2FA, despite its frequently-published flaws, isn't going anywhere until a new way to fuck up 2FA is found. If I had a viable solution to it all, well, I'd be rich.
kingcharles 5y ago
I just posted this in another thread... Also, don't let your mobile phone number expire and someone else get it. I can log in to the previous owner's TikTok account with just his number. I signed up for a food delivery service two days ago and it autofilled all the details with his full name and address for me. How many other sites let you log in with just a phone number? Asking for a friend...
- tentacleuno 5y ago
  > Also, don't let your mobile phone number expire and someone else get it. How would you do this, then? I believe old numbers are kept for a certain time (6 months?) and then put back into the public pool. If we had a more technical solution (think IPv6 addresses, but for phone numbers) this shouldn't be an issue in theory. Of course, having to remember something resembling an IPv6 address to contact somebody would be a pain. I would say we could use a username system, but I believe we've seen the downsides of that way too many times already.
  - jktogjfnn 5y ago
    > How would you do this You port your number to a super-cheap carrier and keep paying for their lowest subscription, even if you don't need it anymore. I payed for 5 years $5 per month to keep a number alive, even if I wasn't living anymore in the country that issued it.
- paulpauper 5y ago
  you can register expired emails addresses too
wly_cdgr 5y ago
Such small potatoes. Enterprise software companies steal that much probably every day
paulpauper 5y ago
I don't think people appreciate just how big the crypto fraud problem is, and how much bigger it will get. Crypto is so big, to put it in perspective, the gambling sector worldwide was estimated to be worth roughly $265 billion U.S. dollars in 2019. That is just 2/3 the market cap of Ethereum alone. Crypto is bigger than pretty anything right now. Bigger than pro sports. bigger than the entertainment industry. Only the tech, real estate, retail, and finance industries are bigger. But those are composed of thousands of companies.
- hoofedear 5y ago
  It’s almost some sort of very large, round thing that is just growing and growing I’m sure there’s a better term for it
- dvt 5y ago
  SIM swapping has really nothing to do with crypto per se, people use it to steal identities/fiat all the time. Crypto is big, but to be fair "just" Apple is bigger than crypto. Compared to the NYSE or Nasdaq, it's small, and when compared to forex (maybe a more apt comparison), it barely registers. Incidentally, I think this is why crypto's here to stay (probably forever): it's huge and growing, very popular, and the masses seem to like it. It's like the McDonalds of financial instruments. I don't think governments care to (or can) regulate it, so as long as we're paying taxes on gains, they will let it slide.
  - paulpauper 5y ago
    crypto is money. So you got $2.2 trillion of money lying around. So of course criminals are going to go through any means to get some, including sim swaps, but soo much more. You cannot steal stock or real estate in the same way you can steal crypto. Crypto by definition is irreversible and unbreakable. SO even way more attractive to criminals just for that property.
    - miohtama 5y ago
      > You cannot steal stock or real estate in the same way you can steal crypto. In fact you can https://www.bbc.com/news/uk-england-essex-59069662 https://www.bbc.com/news/uk-england-essex-59069662
kumarski 5y ago
This is exactly why I gambled on Efani.
- cobrabyte 5y ago
  > efani enforces 11-layer propriety military-grade client layer authentication I'm sure they're an upstanding company, but using the word 'propriety' instead of 'proprietary' is an instant turnoff for me. Security is a details-oriented endeavor, and everything from marketing to implementation needs to be squeaky clean. But, maybe that's just me!
  - mikestew 5y ago
    The phrase "military-grade" is used, and a typo is what sets you off? :-)
  - kevin_thibedeau 5y ago
    The grammar checker is layer 12. The first 11 are nested ROT13. Ultra secure.
  - quickthrower2 5y ago
    Although “propriety” is a word and the sentence still makes sense with it.
    - metabagel 5y ago
      Propriety is a noun
      - kumarski 5y ago
        Pinged the founder with this. Thank you.
reactspa 5y ago
> Following the theft, Terpin filed a civil lawsuit against Truglia with the Los Angeles Superior court Request: can anyone help clarify why this needed to be civil and didn't qualify for criminal?
- paxys 5y ago
  It may have qualified as a criminal case, but you as a citizen can't really do much to get the police, AG or a federal agency to devote their resources to it. Suing someone in a civil court is a pretty straightforward thing to do.
- paulpauper 5y ago
  because the criminal has much higher burden of proof , requires charges to be pressed .
  - reactspa 5y ago
    It would seem like a failure of the justice system if they didn't consider that this met the criteria of a criminal case. Could have also helped set a lot of precedents to deter such crimes in future.
moneywoes 5y ago
Wow, judging those pics looks like they got to “live the life”

152 points by picture 5y ago

How on earth did they catch this guy? Curious if the victim was high profile enough to merit some kind of "real" investigation?

toomuchtodo 5y ago

Tangentially, the FCC is forcing the hand of mobile carriers on this. T-Mobile just the other day has updated their policy so that two employees must be present and part of the process to swap a customer’s SIM. The perils of your phone number being your identity. Refreshing to see these active theft and wire fraud prosecutions.

thathndude 5y ago
Lawyers have been making bank filing claims against the Telecoms for sim swap losses. Never did any myself, but have friends who have done well with these cases. They essentially allow the lawyers to share in the appreciation of crypto.
krebsonsecurity 5y ago
That's nice to hear. So the SIM swappers have to double their bribes. I think the best solution is to cut the mobile providers out of the equation altogether. I've long advised removing your phone number from anything you can, or at least substituting a voip service that can't be social engineered over the phone. Some services don't let you use voip services for multi-factor or signup, so your mileage may vary. Also, it's important where possible to use types of multi-factor that don't rely on your phone number. The tricky part is, so many sites will let you reset your password if you can receive a link via SMS at the phone number on file for the account. Which means anyone who SIM-swaps you then can reset the passwords on those accounts that allow SMS resets (which is a lot, still).
- ghaff 5y ago
  One of the few things I miss about giving up my landline a couple years ago is that I pretty much have to give out my cell phone number for anything that needs a valid phone number. (yes, I could use Google Voice or some sort of VOIP number but that starts making things complicated.) I used to be very selective at giving out my cell number.
  - Maursault 5y ago
    > yes, I could use Google Voice or some sort of VOIP number but that starts making things complicated. You should soldier through it. Google Voice is a decent free service domestically, unless paranoid. I use it in the reverse manner as I expect you would intend (if you'd intend to generate many virtual throw away numbers to forward back to your phone until the forwarding is manually severed). My actual phone number has changed many times over the years, but my GV number stays the same. Eventually, I got rid of my phone altogether. That was January 2014. But jobs will often require I carry the on-call cell (which I almost never need to use and just for work). Boy I sure miss those cell phone bills every month, not. I just realized GV has saved me at least $10K since I cancelled my cell contract.
    - Larrikin 5y ago
      More and more places refuse to accept my Google voice number for verification. It started out with nearly all banks but has gotten ridiculous recently. Target outright refused for Target circle a couple years ago. Recently 7-11 had accepted my Google voice number to get points on in store purchases but now that I live somewhere where I need a car, the gas pump decided the number was invalid when I tried to get the discount on gas from the pump I'm worried since I basically never gave out my actual cell for over a decade now
      - Maursault 5y ago
        Good point, that is a problem, though I can't fathom why a bank wouldn't accept it, but I do recall having issues before with some site not accepting it (possibly Craigslist?). My solution is simple: if my GV number is not accepted, I take my business elsewhere.

supernova87a 5y ago

I wonder if the following idea has occurred to anyone else? We have more and more kinds of accounts, financial products, online services, etc. that would benefit from some kind of real in-person verification at points in the process (initial application, maintenance, changes to account) that are imperfectly done with credit checks, questions/answers, logins, etc. We have Post Offices in nearly every corner of this country. How about turning them into a kind of value-added identity verification service where any company wanting/needing an identity verification could rely on the Post Office to accept someone in person to prove who they are (through fingerprint, document, etc) and be the 3rd party to make this proof easy? Sure you would need to have normal fraud protections, etc. but I bet the act of having to come to a post office would make things very secure / reliable. And it would give the post office a new function. I heard of this being done in some other countries. It seems like a way to avoid us all having to pay for fraud so frequently.

lordnacho 5y ago
There's a number of KYC services where you're basically asked to be filmed and a person in a call centre looks at it and decides whether it's really you. When I went looking at them they were boasting with using AI, and then in the meeting it turned out it was mostly farmed out to someone in India.
- ribosometronome 5y ago
  You misread. They're using Al, he's in Chennai and on call 24/7.
Tenoke 5y ago
>We have Post Offices in nearly every corner of this country. How about turning them into a kind of value-added identity verification When I opened a bank account (n26) in Germany this is how they verified my identity (along with a brief video call) as a foreigner so the idea has merit.
- froh 5y ago

vmception 5y ago

He only got caught because he bragged about it? Horrible deterrent, because it isnt a deterrent

miohtama 5y ago
6 weeks Fear and Loathe and living like a king in Las Vegas is worth of 5 years of jail mate sex? Unless… > “On the surface, Pinsky is an ‘All American Boy,'” Terpin’s civil suit charges. “The son of privilege, he is active in extracurricular activities and lives a suburban life with a doting mother who is a prominent doctor.”
paulpauper 5y ago
He would have been caught eventually when cashing out. he does not seem careful enough.

Jerrrry 5y ago

>Truglia is still being criminally prosecuted in Santa Clara, Calif., the home of the REACT task force, which pursues SIM-swapping cases nationwide. In November 2018, REACT investigators and New York authorities arrested Truglia on suspicion of using SIM swaps to steal approximately $1 million worth of cryptocurrencies from Robert Ross, a San Francisco father of two who later went on to found the victim advocacy website stopsimcrime.org. holy shit, no wonder people are going dark. yall better hide.

syspec 5y ago
Silicon Valley REACT task force? In the end Truglia's bragging to gain /props/ for a /component/ of this crime, is what lead to the REACT task force getting their /hooks/ into his /lifecycle/.

walrus01 5y ago

1) The ability to reset account credentials or get into a service just by using a phone number is not real 2FA and is a huge security risk generally. SMS based 2FA is not real 2FA. 2) Social engineering mobile phone first-tier customer service reps into doing a SIM swap is not hard at all.

admn2 5y ago

So is it recommended to remove your phone number from your Google account to ensure it's not used to ever reset the password?

paulpauper 5y ago
never keep a lot of crypto on anything that is connected to a phone and or email
jyap 5y ago
Yes, definitely.
dbuder 5y ago
They are currently trying to force me to add my mobile number to gmail. If I get logged out they are going to lock me out until I do.
thathndude 5y ago
Yes. Google will constantly remind you to add one to “secure” your account, but just ignore it. You want no recovery emails and just an authenticator app.

deleted 5y ago

[deleted]

shiado 5y ago

SMS-based 2FA needs to be eliminated completely. Authenticator apps need to come preinstalled as an essential utility on every OS. There doesn't seem to be a whole lot of pressure to improve 2FA security.

rib3ye 5y ago
I don't think it's too heavy handed to make the practice of implementing SMS 2FA straight-up illegal. If credit card processing requires PCI compliance why wouldn't we apply similar thought to 2FA?
m4rtink 5y ago
Doesnt that force people to not only use smartphones, but "approved" smartphones (read Android/iOS) with locked bootloaders and no root access (or the bank authenticator app will refuse to run)?
- PeterisP 5y ago
  A dedicated 2FA token (yubikey, or many other brands) is also a reasonable option, and many systems support these standards (U2F/FIDO2).
kevin_thibedeau 5y ago
Apps just embolden employers to shirk on providing secure TOTPs or work phones. You should not be forced to use your personal property to conduct job duties.
mikestew 5y ago
There doesn't seem to be a whole lot of pressure to improve 2FA security. I gave up on that ten years ago when I worked at a biometric authentication company. Banks were soon to be regulated to use 2FA, and our system was easy to use, we're all gonna be rich! Then the banks were allowed to use security questions as 2FA. Not only were the employees not "all gonna be rich", everyone else was going to get fucked when they accidentally post something on Facebook about how their mother (neé Mary $MAIDEN_NAME) used to do $SOMETHING on $STREET_I_GREW_UP_ON. So the continued use of SMS-base 2FA, despite its frequently-published flaws, isn't going anywhere until a new way to fuck up 2FA is found. If I had a viable solution to it all, well, I'd be rich.

kingcharles 5y ago

I just posted this in another thread... Also, don't let your mobile phone number expire and someone else get it. I can log in to the previous owner's TikTok account with just his number. I signed up for a food delivery service two days ago and it autofilled all the details with his full name and address for me. How many other sites let you log in with just a phone number? Asking for a friend...

tentacleuno 5y ago
> Also, don't let your mobile phone number expire and someone else get it. How would you do this, then? I believe old numbers are kept for a certain time (6 months?) and then put back into the public pool. If we had a more technical solution (think IPv6 addresses, but for phone numbers) this shouldn't be an issue in theory. Of course, having to remember something resembling an IPv6 address to contact somebody would be a pain. I would say we could use a username system, but I believe we've seen the downsides of that way too many times already.
- jktogjfnn 5y ago
  > How would you do this You port your number to a super-cheap carrier and keep paying for their lowest subscription, even if you don't need it anymore. I payed for 5 years $5 per month to keep a number alive, even if I wasn't living anymore in the country that issued it.
paulpauper 5y ago
you can register expired emails addresses too

wly_cdgr 5y ago

Such small potatoes. Enterprise software companies steal that much probably every day

paulpauper 5y ago

I don't think people appreciate just how big the crypto fraud problem is, and how much bigger it will get. Crypto is so big, to put it in perspective, the gambling sector worldwide was estimated to be worth roughly $265 billion U.S. dollars in 2019. That is just 2/3 the market cap of Ethereum alone. Crypto is bigger than pretty anything right now. Bigger than pro sports. bigger than the entertainment industry. Only the tech, real estate, retail, and finance industries are bigger. But those are composed of thousands of companies.

hoofedear 5y ago
It’s almost some sort of very large, round thing that is just growing and growing I’m sure there’s a better term for it
dvt 5y ago
SIM swapping has really nothing to do with crypto per se, people use it to steal identities/fiat all the time. Crypto is big, but to be fair "just" Apple is bigger than crypto. Compared to the NYSE or Nasdaq, it's small, and when compared to forex (maybe a more apt comparison), it barely registers. Incidentally, I think this is why crypto's here to stay (probably forever): it's huge and growing, very popular, and the masses seem to like it. It's like the McDonalds of financial instruments. I don't think governments care to (or can) regulate it, so as long as we're paying taxes on gains, they will let it slide.
- paulpauper 5y ago
  crypto is money. So you got $2.2 trillion of money lying around. So of course criminals are going to go through any means to get some, including sim swaps, but soo much more. You cannot steal stock or real estate in the same way you can steal crypto. Crypto by definition is irreversible and unbreakable. SO even way more attractive to criminals just for that property.
  - miohtama 5y ago
    > You cannot steal stock or real estate in the same way you can steal crypto. In fact you can https://www.bbc.com/news/uk-england-essex-59069662 https://www.bbc.com/news/uk-england-essex-59069662

kumarski 5y ago

This is exactly why I gambled on Efani.

cobrabyte 5y ago
> efani enforces 11-layer propriety military-grade client layer authentication I'm sure they're an upstanding company, but using the word 'propriety' instead of 'proprietary' is an instant turnoff for me. Security is a details-oriented endeavor, and everything from marketing to implementation needs to be squeaky clean. But, maybe that's just me!
- mikestew 5y ago
  The phrase "military-grade" is used, and a typo is what sets you off? :-)
- kevin_thibedeau 5y ago
  The grammar checker is layer 12. The first 11 are nested ROT13. Ultra secure.
- quickthrower2 5y ago
  Although “propriety” is a word and the sentence still makes sense with it.
  - metabagel 5y ago
    Propriety is a noun
    - kumarski 5y ago
      Pinged the founder with this. Thank you.

reactspa 5y ago

> Following the theft, Terpin filed a civil lawsuit against Truglia with the Los Angeles Superior court Request: can anyone help clarify why this needed to be civil and didn't qualify for criminal?

paxys 5y ago
It may have qualified as a criminal case, but you as a citizen can't really do much to get the police, AG or a federal agency to devote their resources to it. Suing someone in a civil court is a pretty straightforward thing to do.
paulpauper 5y ago
because the criminal has much higher burden of proof , requires charges to be pressed .
- reactspa 5y ago
  It would seem like a failure of the justice system if they didn't consider that this met the criteria of a criminal case. Could have also helped set a lot of precedents to deter such crimes in future.

moneywoes 5y ago

Wow, judging those pics looks like they got to “live the life”