3 ms·

This just happened to me. The same timeframe, the same vector of attack, but a different target. They wanted my Twitter handle. Fortunately it was an old handle

This just happened to me. The same timeframe, the same vector of attack, but a different target. They wanted my Twitter handle. Fortunately it was an old handle that Twitter had locked down and was not transferable. The hacker succeeded in making me lose my handle for a few days, but some friends came to my aid and I was able to get resolution through Twitter support. My telecom company was helpful at first, but then we began to see circle-the-wagons behavior from them. We were at least able to get the call forwarding off of the account, but they would not tell us any details about what had happened on the account. Until your story (and even now) I'm not exactly sure if my hacker had been able to forward the text messages or simply routed the phone call to his phone and using Google's password reset process was able to get a robo call to accomplish the same thing. All of this is seriously making me consider creating my own 2FA service, only slightly better. One quick recommendation I would add would be to put a passcode on your account with your mobile provider. Just call them and say "I'd like to add a passcode to my account", so you can at least add one extra layer of security there.

abandonliberty 12y ago
I would advise to have them write on the account that in no circumstance are they to authorize you without the passcode. This is the weakest part of the chain. We all forget our passwords.
- snuxoll 12y ago
  Every cell phone carrier out there CAN NOT allow you to make changes to an account or get any personal information from an account without properly identifying yourself with an authorized name on the account, plus the last four of the account holders social OR an account PIN. If a customer can not provide these over the phone they need to visit a store with a photo ID matching the account holder to get access to the account. Note, this isn't specific to any carrier, this is FCC regulations that poorly trained CSR's ignore.
  - meowface 12y ago
    Unfortunately it is not that hard to get someone's first name, last name, and their entire SSN (not just the last 4 digits), especially if you have a bit of money to spend and know the right places to look. Personal aside: does anyone know if I could call Verizon support and ask them to require a specific passcode be used before accepting any call relating to my account? Before I call and ask, I'd like to know the odds of them actually agreeing and actually abiding by it.

abandonliberty 12y ago

I would advise to have them write on the account that in no circumstance are they to authorize you without the passcode. This is the weakest part of the chain. We all forget our passwords.

snuxoll 12y ago
Every cell phone carrier out there CAN NOT allow you to make changes to an account or get any personal information from an account without properly identifying yourself with an authorized name on the account, plus the last four of the account holders social OR an account PIN. If a customer can not provide these over the phone they need to visit a store with a photo ID matching the account holder to get access to the account. Note, this isn't specific to any carrier, this is FCC regulations that poorly trained CSR's ignore.
- meowface 12y ago
  Unfortunately it is not that hard to get someone's first name, last name, and their entire SSN (not just the last 4 digits), especially if you have a bit of money to spend and know the right places to look. Personal aside: does anyone know if I could call Verizon support and ask them to require a specific passcode be used before accepting any call relating to my account? Before I call and ask, I'd like to know the odds of them actually agreeing and actually abiding by it.