4 ms·

https://www.t-mobile.com/support/plans-features/sim-protection#add https://www.t-mobile.com/support/plans-features/sim-protecti... https://www.t-mobile.com/sup

https://www.t-mobile.com/support/plans-features/sim-protection#add https://www.t-mobile.com/support/plans-features/sim-protecti... https://www.t-mobile.com/support/plans-features/account-takeover-protection https://www.t-mobile.com/support/plans-features/account-take... The document reveals that SIM card changes will now require either SMS verification from the customer or the credentials of two employees.

fullspectrumdev 3y ago
> or the credentials of two employees Unfortunately, most SIM swapping gangs these days are using stolen carrier credentials.
- simfree 3y ago
  Can vouch, all three of the SIM swapping attacks that have been done on Enterprise T-Mobile accounts I'm involved in were done using stolen employee credentials, and the records would just say that the store employee verified the ID of the customer. Store employees do not ask for the security pin or password on the account, even if it's notated that they should be asked for every time. Pretty much any account security notes like "Please email this address to request authorization for any account changes" get ignored by store reps. T-Mobile's fraud team will tell you to file a police report about the incident, then they will ghost the police department and provide no details about what occurred, who was involved, where it happened and such. Without a subpoena you are SOL, about the only action you can take is filing a small claims court case against them and subpoenaing T-Mobile in the process. They do freak out when you send a friend to show up in Bellevue to serve the notice of said court case and the subpoena, but it's the only way to get them to acknowledge what happened and provide details so you can mitigate the compromise that occurred.
iisan7 3y ago
I believe T Mobile also allows you to require a secret 6-8 number PIN that is not texted to you. It's opt-in however, and I am not sure whether it can be overridden by a service tech.
- instagib 3y ago
  Looks like they are changing their policies. Only call customer service or do something in store for now.

fullspectrumdev 3y ago

> or the credentials of two employees Unfortunately, most SIM swapping gangs these days are using stolen carrier credentials.

simfree 3y ago
Can vouch, all three of the SIM swapping attacks that have been done on Enterprise T-Mobile accounts I'm involved in were done using stolen employee credentials, and the records would just say that the store employee verified the ID of the customer. Store employees do not ask for the security pin or password on the account, even if it's notated that they should be asked for every time. Pretty much any account security notes like "Please email this address to request authorization for any account changes" get ignored by store reps. T-Mobile's fraud team will tell you to file a police report about the incident, then they will ghost the police department and provide no details about what occurred, who was involved, where it happened and such. Without a subpoena you are SOL, about the only action you can take is filing a small claims court case against them and subpoenaing T-Mobile in the process. They do freak out when you send a friend to show up in Bellevue to serve the notice of said court case and the subpoena, but it's the only way to get them to acknowledge what happened and provide details so you can mitigate the compromise that occurred.

iisan7 3y ago

I believe T Mobile also allows you to require a secret 6-8 number PIN that is not texted to you. It's opt-in however, and I am not sure whether it can be overridden by a service tech.

instagib 3y ago
Looks like they are changing their policies. Only call customer service or do something in store for now.