Re: "'Scammers stole £40k after EDF gave out my number"

In uk.telecom.mobile Java Jive <java@evij.com.invalid> wrote:

On 2025-03-16 15:13, Theo wrote:

In uk.telecom.mobile Java Jive <java@evij.com.invalid> wrote:

>
It makes perfect sense, what you are claiming makes no sense, and shows
that you have lost the chronological sequence of events.  For one thing,
the use of the word 'had' implies that the hack was already in place at
the time of scammer's phone call, otherwise they would have said
something like "... and hacked ..." or "... used it to hack ..." or "...
and went on to hack ...".  Further, if you reread the original report in
its entirety, how would he have persuaded EDF to give up the victim's
mobile number without personal identifying information that came from
access to his emails?  Next, how would he have been able to confirm the
request for a replacement SIM without being able to reply to the
confirmatory email?

 
When I've had to do a SIM swap (some time ago) it was all done on security
questions, there was no confirmatory email.  I don't think the mobile
networks required an email address, and if you're on PAYG they still
don't.
 
I think there is not enough information to be clear about the sequencing,
especially since emails and mobile are provided by the same company.

 
No, how would he have known the answers to the security questions to
enable the SIM swap, and his emails were from Virgin Media, while the
SIM was from O2.  Although not initially, my reading of the original
article is now unambiguously that the email hack preceded the SIM swap
and provided the initial personal information necessary to accomplish
everything that followed.

Virgin Media O2 are one company - VM and O2 merged June 2021.  I don't know
whether they have merged customer accounts such that the same security
details are used for both.  In which case it may be that one set of details
gives access to both mobile and emails.

Theo