Re: "'Scammers stole £40k after EDF gave out my number"

On 2025-03-17 08:53, Nick Finnigan wrote:

On 16/03/2025 18:00, Theo wrote:

In uk.telecom.mobile Java Jive <java@evij.com.invalid> wrote:

>
No, how would he have known the answers to the security questions to
enable the SIM swap, and his emails were from Virgin Media, while the
SIM was from O2.  Although not initially, my reading of the original
article is now unambiguously that the email hack preceded the SIM swap
and provided the initial personal information necessary to accomplish
everything that followed.

>
Virgin Media O2 are one company - VM and O2 merged June 2021.  I don't know
whether they have merged customer accounts such that the same security
details are used for both.  In which case it may be that one set of details
gives access to both mobile and emails.

 "If you've linked your Virgin Media and O2 details to create a new Virgin Media O2 ID, sign in with it here."
 https://accounts.o2.co.uk/signin

But Theo's own transcription of events from the BBC Radio documentary makes clear that he had not done so (first and last entries from this excerpt):
In brief:
- received a text from O2 (mobile operator) saying he'd changed his password
- contacted O2 straight away and told SIM had been swapped
- told they'd stop that and send out a new SIM card, emailed to confirm
- next morning, email from EDF (energy supplier) asking for feedback on recent contact with customer services
- called EDF, told they'd pass it on to the fraud section and get back to him
- nothing happened for over a week
- called O2 again to make sure everything was stopped, put through to fraud department
- just after received an email saying new SIM card had been sent out,
connected to a different number.  Queried with fraud department, said didn't know, need to go to an O2 shop
- O2 shop couldn't do much as account had been stopped, couldn't look at it
- told them to check his emails
- contacted Virgin Media (ISP, merged with O2), told he'd changed his password, had to go through changing password back again, told they'd pass it to the fraud section
It's difficult to deduce from this the exact ordering of events ...
Because he had to contact VM to find out that he'd changed his email password, rather than them contacting him at the time he did so, we can't tell when his email password was actually changed.  Further, the scammer could have been reading his emails for a while before actually deciding that, as unfolding events began to suggest that the scam was in danger of being closed down, that it was time to change the password in an attempt to prolong it.  Most probably his email account would have been compromised around the same time as all the other stages of the scam, yet "nothing happened for over a week" before he discovered it, and, in between, he received emails from both EDF and O2.
However, I still think that some identifying personal information would have been necessary to enable the SIM swap, and most probably this came from the email hack occurring earlier.  A search for "what is the minimum personal information required to be a victim of a SIM swap scam" using both DuckDuckGo and Google didn't yield anything definitive or that probably most of us didn't know already, but did yield preventative advice ...
 From the Met:
https://www.met.police.uk/SysSiteAssets/media/downloads/force-content/met/campaigns/fraud/cyber-protect_protect-yourself-from-sim-swap-fraud.pdf
 From Which:
https://www.which.co.uk/news/article/sim-swap-fraud-doubles-year-on-year-how-scammers-steal-your-phone-number-aB0TF1O6hUrv
--
Fake news kills!
I may be contacted via the contact address given on my website: www.macfh.co.uk