Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

forbes.com

Post reply on HN
Print view View original

261–270 of 382 posts

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#261

Post by kbart »

konceptz wrote: post #258
kbart wrote: post #216

Earlier quoted context omitted.

"Apparently after I had left, someone went into a T-Mobile store and somehow convinced the associate that my number was theirs." How that can happen? When I visit my cell provider's store, nobody is going to talk about any account details while you haven't provided a government issued ID to prove that you are an account holder. Sure, it's not 100% bulletproof method, but if somebody went a great lengths to counterfei…

Yes, ID check is easily circumvented. People are the weakest link. The store reps are not government officials or police officers, nor do they scan ids. They may be convinced not to check your if, accept an id that isn't your drivers license, or anything else. The point is that by using an SMS as 2fa, is placing much of your security in underpaid cell phone store workers.

"The store reps are not government officials or police officers, nor do they scan ids."

Neither they are here (in EU), but nobody is going to talk to you unless you provide an ID anyway. Asking for ID doesn't seem too hard, even for non-trained personnel. You don't have to be a detective to match name/code on ID with the name/code on account.

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#262

Post by zAy0LfpBZLC8mAC »

hourislate wrote: post #163
TaylorSwift wrote: post #56

This happened to me. 1. I believe it began with the hacker getting DOB/SSN. 2. Called wireless provider, and hacker forward all calls and texts to a burn phone. Eventually, the hacker ported my wireless phone to another provider/number (not sure which), and the phone registered to my provider did not work anymore. The landline phone was also forwarding calls to another number.* 3. Hacker gained access to email (as th…

Yeah, Identity theft is one of those crimes where the authorities don't really care. It can be quite lucrative for the folks carrying it out since there are no consequences. The police are so overwhelmed and typically it is out of jurisdiction so their options are 0 to none to prosecute. The only way to guard against it is to keep your foot print small and give as little info as required.

> Yeah, Identity theft is one of those crimes where the authorities don't really care.

There is no such thing as "identity theft". You can't steal who someone is, that's bullshit. It's rather some party not making sure it's actually you they are talking to, and then claiming that you are responsible for it anyway because they fell for someone else's scam.

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#263

Post by njx »

adekok wrote: post #62
TaylorSwift wrote: post #56

This happened to me. 1. I believe it began with the hacker getting DOB/SSN. 2. Called wireless provider, and hacker forward all calls and texts to a burn phone. Eventually, the hacker ported my wireless phone to another provider/number (not sure which), and the phone registered to my provider did not work anymore. The landline phone was also forwarding calls to another number.* 3. Hacker gained access to email (as th…

> The entire situation was communicated to the FBI, local police, and bank institutions, but I do not think anyone cared. Why would they care? It happens dozens of times a day, and the criminals are out of their jurisdiction. If only the police, FBI, politicians, etc. could go after the banks and telcos to improve their security. But no... they see it as their job to destroy security, in order to make you "safe".

Did you file a report with FBI? I once was scammed on ebay for a laptop worth $1200 around year 2002. The local police did not get involved so I went to the FBI website and filed a report. I thought nothing is going to happen. They eventually caught the guy and I got my payments in installments (restitution) over several years.

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#264

Post by drdaeman »

zAy0LfpBZLC8mAC wrote: post #262
hourislate wrote: post #163

Earlier quoted context omitted.

Yeah, Identity theft is one of those crimes where the authorities don't really care. It can be quite lucrative for the folks carrying it out since there are no consequences. The police are so overwhelmed and typically it is out of jurisdiction so their options are 0 to none to prosecute. The only way to guard against it is to keep your foot print small and give as little info as required.

> Yeah, Identity theft is one of those crimes where the authorities don't really care. There is no such thing as "identity theft". You can't steal who someone is, that's bullshit. It's rather some party not making sure it's actually you they are talking to, and then claiming that you are responsible for it anyway because they fell for someone else's scam.

And piracy is an act of robbery on the high seas.

When the name sticks, there's usually nothing we can do. Sad but true.

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#265

Post by yladiz »

Can anyone recommend a US based bank (or a bank that accepts US customers) that 1) has either a 2FA token for phone e.g. with Google Authenticator, a hardware token, or some kind of other token based factor; and 2) has strong security when calling? I generally don't need a physical presence.

My current two banks don't have direct 2FA enabled. As far as I remember, the questions available to one of my banks (credit union) are simple enough that you could probably find out by doing a public info search somewhere, and the other bank (Chase) has SMS 2fa, but outside of that it's just public database questions (I know this because I had my card number stolen recently, I currently don't have access to my phone as I'm out of the country, and they asked me a few different questions from a public database, like if I had ever lived at ABC Dr., do you know this person, and what is the full name, etc.). I'd much rather be able to give the banks some kind of information that they are required to verify before they can access my account, like a verbal passphrase, but I don't think that's possible (as in, I wouldn't be able to access my account over the phone without the passphrase).

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#266

Post by 0xfeba »

txmx2000 wrote: post #173
pascalxus wrote: post #153

So, I've read the article a couple of times, It's pretty long. For those of you looking to get the most bang for your buck, I think the following advice is Golden: 1. Do NOT secure your sensitive accounts (facebook, primary email, bank accounts, twitter, etc) with your telco phone #. Telco Phone number is NOT secure! "Create a brand new Gmail email account. Do not connect it to any of your existing email accounts. (W…

Or use a Google Voice number to setup 2FA on the same account. That way you can only ever login if you have a device on your person already logged in. If somehow you're away from technology long enough that all your devices are locked, use a printed backup code to unlock one.

Use Google Authenticator or any other time-based token app. Print out the private key, store in a safe. Also print out extra codes and also put in a safe.

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#267

Post by mackncheesiest »

yladiz wrote: post #265

Can anyone recommend a US based bank (or a bank that accepts US customers) that 1) has either a 2FA token for phone e.g. with Google Authenticator, a hardware token, or some kind of other token based factor; and 2) has strong security when calling? I generally don't need a physical presence. My current two banks don't have direct 2FA enabled. As far as I remember, the questions available to one of my banks (credit un…

I know that USAA offers TOTP 2FA. Not sure about calling though.

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#268

Post by yladiz »

mackncheesiest wrote: post #267
yladiz wrote: post #265

Can anyone recommend a US based bank (or a bank that accepts US customers) that 1) has either a 2FA token for phone e.g. with Google Authenticator, a hardware token, or some kind of other token based factor; and 2) has strong security when calling? I generally don't need a physical presence. My current two banks don't have direct 2FA enabled. As far as I remember, the questions available to one of my banks (credit un…

I know that USAA offers TOTP 2FA. Not sure about calling though.

Sadly, USAA is only open to military service members and their kids. That would be my choice if I could use it.

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#269

Post by CWuestefeld »

llukas wrote: post #172
closeparen wrote: post #121

Earlier quoted context omitted.

The ACH model is fundamentally insecure: anyone who knows your account number can pull money from it, and the protocol makes no allowance for the bank to check with you first. I don't think choice of bank matters very much. You can manage your risk somewhat by: 1) Using credit and not debit cards for day to day spending. 2) Maintaining your long term wealth in separate accounts at separate institutions and not linkin…

Why they keep that system? In most of Europe you got "normal" banking system where you can give everyone your account number and worse thing they can do is to put some money there. In US it seems #freemarket is putting externalities (security) on the customer.

it seems #freemarket is putting externalities (security) on the customer.

More like corporatist government regulations are putting the burden on the customer.

Re: Hackers Are Hijacking Phone Numbers and Breaking into Email, Bank Accounts

#270

Post by FabHK »

weinzierl wrote: post #231
kbart wrote: post #222

Earlier quoted context omitted.

Gmail didn't mandate phone number the last time I created dummy account (~1 month ago). I don't have phone number linked even with my primary account.

I don't doubt that. In my experience sometimes a phone number is required and sometimes not. When it prompted for a phone I didn't find a way to work around that.

I find that when I create a dummy account from a clean browser (no cookies) with a VPN, a phone number is required. I wouldn't be surprised if they do some internal risk/dodginess assessment based on several factors.
Post reply on HN