Re: "'Scammers stole £40k after EDF gave out my number"

Newyana2 <newyana@invalid.nospam> wrote:

On 3/4/2025 3:13 AM, Chris wrote:

Newyana2 <newyana@invalid.nospam> wrote:

On 3/3/2025 4:38 PM, Chris wrote:
 

Ironically, unless someone can hack into my computer they have
virtually zero chance of taking over my accounts. First, I don't have
online accounts, generally. Second, since I don't use 2FA an attacker
would have to somehow get my email passwords.

 
How does that work? 2FA requires a code *and* the password. You're removing
a layer of security.
 

 
If they're able to take over your phone # they can just go
around to accounts and click "I lost my password". A reset
code wll then be sent to the cellphone.

 
That's not how it works. At best you get sent a reset link to your email.
This means the attacker needs to know your email account details as well as
the username/login for the service.
 

  That's not typically necessary with 2FA.

Yes it is.

Remember, you've
clicked the link that says you forgot your password. Typically
that would trigger security questions.

Correct.

With 2FA it could involve
a code sent to a cellphone...

Only after you've correctly answered additional security. Usually it's an
email not a 2FA code via SMS as it's known to be insecure.

which the scammer now controls.
That's the whole point. That's how people are being compromised
by only doing a SIM swap. In many cases the scammer need only
know a few personal details, which they might have found in a
data dump online.
 

You're dependent on a single factor. If your password is exposed or, more
likely, the company's security has been compromised via other means then an
attacker has free reign.
 
Yes, the chances are low, but the potential damage is much higher then if
had 2FA.
 

   So you say. Yet this man was compromised. Someone was
able to do a SIM swap and get the rest from that.

Where does the story say that 2FA was the weak point?  in fact where is 2FA
mentioned at all?

They may
have even got some of that information by simply waiting for
texts and emails after the swap.

The primary issue is how was it possible to swap the sim in the first
place.

The problem is that the
cellphone has become the centerpiece of personal security,
and that trust is not justified.

That's true.

   In my case all they need is my email password, but how are
they going to get it? Pretty much the only chance would be
a total data hack of my email host. Or they'll need to know
the answers to my security questions. Again, that will almost
certainly require hacking my email host. And since I don't bank
online or write credit card numbers in email, there's not much
that the scammer could benefit. They could order books in my
name from the library. But even then they'll need my library
card or my drivers license to pick up those books. And since
I use POP3 email, auto-deleting mail on the server, the scammer
can't look through my old email. So they can't even be a wiseguy
and change my dentist appt. :)

Basically, with everything so interdependent if someone wants to target you
specifically they will find a way.

 
2FA is not a security improvement. It's a gimmick to enable
far more exptensive tracking of people by linking phone ID and
location to other data.

 
Your paranoia is clouding your judgement.
 

 
  Famous last words of the ostrich. The whole point of this
thread is about a man who got SIM swapped and lost 40K
pounds!

None of which has anything to do with 2FA which you brought up.

There's definitely a lot more to this story. For example, there's a daily
limit of £10k for bank transfers.

Plus, I also use the Nationwide bank and their security is pretty strict
especially around new types of transactions.

Your neighbor has just been eaten by a lion. Keeping
his head in a hole didn't protect him. What a shocker!

Reading the whole article it seems they also compromised his email account
and then tried to use his Nationwide credit card, which was blocked
automatically, and stole the £40k from his Premium Bonds. Real nightmare
scenario.

If someone has your emails and your mobile phone number you are royally
screwed. Yes, even you.

Fortunately, the victim has had his 40k refunded.