Re: "'Scammers stole £40k after EDF gave out my number"

On 2025-03-06 01:56, Brian Gregory wrote:

>
On 03/03/2025 12:27, Java Jive wrote:

>
So, EDF allowed them to go from his email address to obtaining his mobile phone number for a SIM-swap scam, but I wonder how they managed to go from either to all his savings accounts, unless they'd also compromised his PC or phone as well; if the latter, why did they need to go via EDF?

 Once you've got the email and done the SIM swap scam or hacked SS7 to read someone’s incoming SMS, that's enough, or almost enough, to get in to all sorts of things via the I've forgotten my password link on their websites.

But how would they know which banks, savings accounts, etc, to target without additional information?  Just knowing his email address on its own would not be enough for this, there must be hundreds of people who know my email address, because they send me emails via it, but that fact alone doesn't make me vulnerable to hacking.
At very least, they would have had to be able to read his emails, which would imply that the original problem was not EDF giving out his mobile number  -  which certainly they should not have done, and without that second breach of confidentiality it is true that the scam could not have progressed further, so they are undeniably at fault  -  but something like his email password being hacked somehow or other beforehand.  How the latter could happen would be pure speculation as the original report I linked gave no details, but most probably either he clicked on something in a phishing scam email, or installed some dodgy software, or a site he visits was hacked and he used the same password in too many places.
--
Fake news kills!
I may be contacted via the contact address given on my website: www.macfh.co.uk