Re: "'Scammers stole £40k after EDF gave out my number"

On 3/15/2025 7:46 AM, Java Jive wrote:

On 2025-03-14 18:49, Theo wrote:

>
Speculating, I would guess they started with the SIM swap.

 The original report suggests that they started with an email hack, and used that to facilitate the SIM swap.
 

   That's not what it said. "Suggests" gets into speculation.
The reoprt does imply that conning the phone company
into a SIM swap was where it started. Which also makes
the most sense. The point being that if you have someone's
phone then you have their texts, email, etc. So the rest is fairly
simple. His email server then assumes 2FA is adequate to let
him change his email password, so the scammer doesn't
need answers to security questions. It all centers on the
cellphone being depended upon as the most secure identity.
In that scenario, the scammer only needs some public facts,
like the email addess, name, maybe street address, etc. A
casual friend could have those things, or they might be found
in a data dump online. So the weak points are 2FA and the
human factor. The phone company wants to help, doesn't want
to anger the customer, so they can sometimes be tricked.
    Though it would be interesting if this story is ever clarified
officially. Maybe they avoided details in order not to give
other scammers ideas. Taking away all human factors is also
a problem.
    Meanwhile, I look forward to seeing a Bill Murray movie,
where his cellphone dies and he begins a comedic odyssey,
trying to convince everyone from his employer to his family
that he exists. (His family haven't looked up from their cellphones
for 30 years, so naturally they assumed that poor Bill died
when he stopped answering texts... and they don't know what
he looks like. Maybe they could call it Brazil 2.0. :)