Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Two Charged in SIM Swapping, Vishing Scams

krebsonsecurity.com

Post reply on HN
Print view View original

11–20 of 71 posts

Re: Two Charged in SIM Swapping, Vishing Scams

#11

Post by ericabiz »

kyrra wrote: post #8
seibelj wrote: post #4

I'm a blockchain pro and there was a couple month period in 2017 when tons of people I know got SIM swapped including me. The T-Mobile call person kept asking me "Are you sure you didn't go into a store in Detroit and ask for your phone to be changed? They showed an ID!" No, I didn't do that. Luckily I had 2-factor for everything, but I know some people who lost a lot. SMS is totally broken, use 2FA and hardware key…

(Googler, opinions on my own) This is a nice benefit of Google Fi. Since swap attacks are not possible with it, as customers support agents aren't able to do sim swaps. Sims for Google Fi are fully tied to your Google account, and you must have access to that account to be able to register or unregister a phone.

Unfortunately Google Fi has its own set of issues that make it unpalatable as a primary mobile phone service: https://onemileatatime.com/google-fi-review/

Re: Two Charged in SIM Swapping, Vishing Scams

#12

Post by [deleted] »

R0b0t1 wrote: post #6
seibelj wrote: post #4

I'm a blockchain pro and there was a couple month period in 2017 when tons of people I know got SIM swapped including me. The T-Mobile call person kept asking me "Are you sure you didn't go into a store in Detroit and ask for your phone to be changed? They showed an ID!" No, I didn't do that. Luckily I had 2-factor for everything, but I know some people who lost a lot. SMS is totally broken, use 2FA and hardware key…

Why are the phone companies not responsible for swapping the number over? In a similar vein, I've known people who had unsigned checks stolen and their signature forged very poorly. The banks are supposed to check the signature, so why aren't the banks liable?

[deleted]

Re: Two Charged in SIM Swapping, Vishing Scams

#13

Post by wil421 »

schoolornot wrote: post #9
ericschn wrote: post #5

Earlier quoted context omitted.

I was also the victim of a T-Mobile SIM swap back in February. My assumption is that the attackers target individuals that have a high likelihood of owning bitcoin or other digital currency. This can be easily determined by looking at data breaches, and targeting emails that are found both on a cryptocurrency breach and a personal information breach with phone number, name, address, and anything else that would help…

I SIM swapped myself twice on Sprint without authorization at an Apple store. Sales reps can generate a one time code for Sprint Support that allows them to bypass some of the IVRs and prove the call is coming from an Apple Store. Sprint support won't ask for a PIN or SSN. Just the line's number. Bam! How many people can do this? See those mom and pop "authorized resellers" at the mall? Yeah.

When someone stole my identity and opened up 8 lines they did it all at “authorized reseller” phone booths. I believe it was at a Costco.

AT&T still let them order 4 new lines on a new account even though I already had an account with 2 lines.

Re: Two Charged in SIM Swapping, Vishing Scams

#14

Post by devenblake »

kyrra wrote: post #8
seibelj wrote: post #4

I'm a blockchain pro and there was a couple month period in 2017 when tons of people I know got SIM swapped including me. The T-Mobile call person kept asking me "Are you sure you didn't go into a store in Detroit and ask for your phone to be changed? They showed an ID!" No, I didn't do that. Luckily I had 2-factor for everything, but I know some people who lost a lot. SMS is totally broken, use 2FA and hardware key…

(Googler, opinions on my own) This is a nice benefit of Google Fi. Since swap attacks are not possible with it, as customers support agents aren't able to do sim swaps. Sims for Google Fi are fully tied to your Google account, and you must have access to that account to be able to register or unregister a phone.

What happens when Google spontaneously bans your account for no reason?

Re: Two Charged in SIM Swapping, Vishing Scams

#17

Post by lotsofpulp »

teej wrote: post #15

It's insane to me that the only thing standing between me and having my life ruined is some minimum wage cell phone store employee. Text message based 2FA needs to die.

The only solution I have found to this is to have accounts for which I never give out the account number to anyone and only leave a little bit of cash in the accounts I transfer money out of.

Re: Two Charged in SIM Swapping, Vishing Scams

#18

Post by x87678r »

R0b0t1 wrote: post #6
seibelj wrote: post #4

I'm a blockchain pro and there was a couple month period in 2017 when tons of people I know got SIM swapped including me. The T-Mobile call person kept asking me "Are you sure you didn't go into a store in Detroit and ask for your phone to be changed? They showed an ID!" No, I didn't do that. Luckily I had 2-factor for everything, but I know some people who lost a lot. SMS is totally broken, use 2FA and hardware key…

Why are the phone companies not responsible for swapping the number over? In a similar vein, I've known people who had unsigned checks stolen and their signature forged very poorly. The banks are supposed to check the signature, so why aren't the banks liable?

The phone company is giving you a phone number, it doesn't want to be responsible for providing security for your financial and private life.

Re: Two Charged in SIM Swapping, Vishing Scams

#19

Post by jtsiskin »

CamelCaseName wrote: post #2

Ah yes, of course they were only caught because the two had a falling out and then one swatted the other.

It’s the 21st century prisoners dilemma.

You and your partner stole a bunch of Bitcoin via SIM swapping. If you split it, you each get half. If you don’t split it, the other one will SWAT you and you both go to jail.

Re: Two Charged in SIM Swapping, Vishing Scams

#20

Post by est31 »

kyrra wrote: post #8
seibelj wrote: post #4

I'm a blockchain pro and there was a couple month period in 2017 when tons of people I know got SIM swapped including me. The T-Mobile call person kept asking me "Are you sure you didn't go into a store in Detroit and ask for your phone to be changed? They showed an ID!" No, I didn't do that. Luckily I had 2-factor for everything, but I know some people who lost a lot. SMS is totally broken, use 2FA and hardware key…

(Googler, opinions on my own) This is a nice benefit of Google Fi. Since swap attacks are not possible with it, as customers support agents aren't able to do sim swaps. Sims for Google Fi are fully tied to your Google account, and you must have access to that account to be able to register or unregister a phone.

Is there a guarantee that Google won't add this feature in the future? What if people lost their phones etc.?

I think the risk is too big. Use U2F, or something similar.

Post reply on HN