O2 account hacked and phone number stolen

XeNoN89 · 8 Feb 2021 at 00:50

It's really easy to trick mobile phone networks into doing sim swaps, which is why you should not use text messaging for your MFA on accounts. Only use authenticator apps .

mattyg · 8 Feb 2021 at 01:39

Paypal have rejected the claim. Ive sent another with more detail and I'll contact ikea at 7am

Fubsy · 8 Feb 2021 at 09:20

PayPal

Any further news?

bloodiedathame · 8 Feb 2021 at 09:24

Get onto the police via 101.

subbytna · 8 Feb 2021 at 10:16

Rannoch said:
Inside job?

Very possibly.

uvarvu · 8 Feb 2021 at 12:42

Zeeflyboy said:
Just FYI Paypal does... you can choose to use google authenticator etc and remove the option for SMS message.

If you use a password manager like 1Password it will notify you when a site enables 2FA via access codes rather than SMS. I've moved all of my logins over but it sucks that banks still send access codes via SMS.

mattyg · 8 Feb 2021 at 18:57

Fubsy said:
PayPal

Any further news?

I got up at 6.30am to call IKEA and see if I could put a stop on the order.. They cancelled it straight away... Then whilst on the phone Paypal emailed and said they had looked into it on the 2nd attempt and refunded me..

O2 however have been useless. I called their business support team and managed to get put through to the same person that dealt with the initial fraud a few months back.. Told her I need a call back from the fraud team asap
Still nothing..
If I dont hear this week I'll be taking our business elsewhere. I'll also be recommending to one of our accounts to put a piece in the company newsletter regarding Sim swap fraud and lack of giving a **** from o2

over 3500 employees will get that newsletter

mattyg · 8 Feb 2021 at 18:59

Zeeflyboy said:
Just FYI Paypal does... you can choose to use google authenticator etc and remove the option for SMS message.

I've looked for this and cant find it..

I use google Auth for account access but for password recovery one of the options is a code to be text to the registered number

ubern00b · 8 Feb 2021 at 19:45

mattyg said:
I've looked for this and cant find it..

I use google Auth for account access but for password recovery one of the options is a code to be text to the registered number

Settings - Security - 2factor and remove any backups.

Zeeflyboy · 8 Feb 2021 at 20:59

^^ what he said

mattyg · 9 Feb 2021 at 01:42

ubern00b said:
Settings - Security - 2factor and remove any backups.

Zeeflyboy said:
^^ what he said

I have 2fa already switched on But it seems to only be for logging into my paypal account direct...... Have you tried to make a purchase and see if it needs the 2fa App before proceeding. And can you check to see if SMS password reset is still there

I've just tried it again and if you click the having trouble logging in. Recieve an SMS is still there as an option

Zeeflyboy · 9 Feb 2021 at 02:31

mattyg said:
Have you tried to make a purchase and see if it needs the 2fa App before proceeding. And can you check to see if SMS password reset is still there

Yes, requires 2FA from authenticator app before a purchase (assuming you haven’t trusted this device of course) and no option to use any other means.

However you just made me try to hack myself out of interest. Despite removing the phone as a backup option I can still reset password using text message... so far so stupid. Having reset the password successfully by text, I am then presented with a 2FA code requirement before logging in with my new password... so the system works. Nope, if I now click trouble logging in I can be texted a code and log straight into the account with my new password bypassing authenticator 2FA.

Dumb as bricks.

mattyg · 9 Feb 2021 at 03:10

Zeeflyboy said:
Yes, requires 2FA from authenticator app before a purchase (assuming you haven’t trusted this device of course) and no option to use any other means.

However you just made me try to hack myself out of interest. Despite removing the phone as a backup option I can still reset password using text message... so far so stupid. Having reset the password successfully by text, I am then presented with a 2FA code requirement before logging in with my new password... so the system works. Nope, if I now click trouble logging in I can be texted a code and log straight into the account with my new password bypassing authenticator 2FA.

Dumb as bricks.

I've sent Paypal feedback of the situation and info on sim swap fraud.
It'll probably not get anywhere though.

I've now removed my main number and have added a number by a different provider.

Crazy having the security that can be bypassed so easily. Granted a number of things have to fail first but Sim swap fraud is massive in america so wont be long before it comes here in a big way

platinum87 · 9 Feb 2021 at 11:02

What do you need to swap my o2 sim?

Rids · 9 Feb 2021 at 11:41

Sim Swap fraud was a massive thing when I worked in telecomms retail 12+ years ago. We used to see it all the time back then, was pretty easy to shut down in store as we'd just demand a proof of ID before we'd do a sim swap, its a lot more challenging over the phone as if they know if your security details then the agent is ****ed.

Quartz · 9 Feb 2021 at 12:14

How does this work? Surely if doing it over the phone, the new SIM gets sent to the address on the account? I.e. your address.

mattyg · 9 Feb 2021 at 12:18

Quartz said:
How does this work? Surely if doing it over the phone, the new SIM gets sent to the address on the account? I.e. your address.

No you can use any o2 (the same provider as your currently using) sim. So you get a pay as you go sim. Initiate the sim swap and your number gets transferred to the new sim. You can buy them pretty much anywhere these days.
You just input the new sim's "serial" number into the system...

It has its uses.

Say you sim card went faulty. You can grab another ism form tesco and be back up and running in a few mins. But its that ease of use which makes it insecure

Quartz · 9 Feb 2021 at 12:22

mattyg said:
No you can use any o2 sim. So you get a pay as you go sim. Initiate the sim swap and your number gets transferred to the new sim. You can buy them pretty much anywhere these days.
You just input the new sim's "serial" number into the system...

That's very insecure.

Resident · 9 Feb 2021 at 12:26

Rids said:
Sim Swap fraud was a massive thing when I worked in telecomms retail 12+ years ago. We used to see it all the time back then, was pretty easy to shut down in store as we'd just demand a proof of ID before we'd do a sim swap, its a lot more challenging over the phone as if they know if your security details then the agent is ****ed.

My wife was a manager in a call centre a while back for a major network. The main source of failure they had with regards to account security were undeniably via overseas call centres that the company employed. She remembers one report that stated that in 200 test calls 86% of agents neglected to complete correct authentication procedures. Several agents gave account details to callers that the account holder should know (address, DOB etc).

Further investigations also found that a certain 3rd party call centre company, based in a country known for telecommunications scams, was SELLING customer data.

Quartz said:
How does this work? Surely if doing it over the phone, the new SIM gets sent to the address on the account? I.e. your address.

You can easily obtain a SIM from anywhere. Easiest option is to pick one up for a quid or so at a local low cost supermarket and then call and give the serial to have it activated. Many operators don't even required you to call, you can activate a SIM via online portals.

Quartz · 9 Feb 2021 at 12:54

Resident said:
You can easily obtain a SIM from anywhere. Easiest option is to pick one up for a quid or so at a local low cost supermarket and then call and give the serial to have it activated. Many operators don't even required you to call, you can activate a SIM via online portals.

I see, but as a security measure, shouldn't they send a new SIM or a code by post to the registered address?