Re: "'Scammers stole £40k after EDF gave out my number"

On 3/4/2025 3:13 AM, Chris wrote:

Newyana2 <newyana@invalid.nospam> wrote:

On 3/3/2025 4:38 PM, Chris wrote:
>

Ironically, unless someone can hack into my computer they have
virtually zero chance of taking over my accounts. First, I don't have
online accounts, generally. Second, since I don't use 2FA an attacker
would have to somehow get my email passwords.

>
How does that work? 2FA requires a code *and* the password. You're removing
a layer of security.
>

>
  If they're able to take over your phone # they can just go
around to accounts and click "I lost my password". A reset
code wll then be sent to the cellphone.

 That's not how it works. At best you get sent a reset link to your email.
This means the attacker needs to know your email account details as well as
the username/login for the service.
 

   That's not typically necessary with 2FA. Remember, you've
clicked the link that says you forgot your password. Typically
that would trigger security questions. With 2FA it could involve
a code sent to a cellphone... which the scammer now controls.
That's the whole point. That's how people are being compromised
by only doing a SIM swap. In many cases the scammer need only
know a few personal details, which they might have found in a
data dump online.

You're dependent on a single factor. If your password is exposed or, more
likely, the company's security has been compromised via other means then an
attacker has free reign.
 Yes, the chances are low, but the potential damage is much higher then if
had 2FA.
 

    So you say. Yet this man was compromised. Someone was
able to do a SIM swap and get the rest from that. They may
have even got some of that information by simply waiting for
texts and emails after the swap. The problem is that the
cellphone has become the centerpiece of personal security,
and that trust is not justified.
    In my case all they need is my email password, but how are
they going to get it? Pretty much the only chance would be
a total data hack of my email host. Or they'll need to know
the answers to my security questions. Again, that will almost
certainly require hacking my email host. And since I don't bank
online or write credit card numbers in email, there's not much
that the scammer could benefit. They could order books in my
name from the library. But even then they'll need my library
card or my drivers license to pick up those books. And since
I use POP3 email, auto-deleting mail on the server, the scammer
can't look through my old email. So they can't even be a wiseguy
and change my dentist appt. :)

>
   2FA is not a security improvement. It's a gimmick to enable
far more exptensive tracking of people by linking phone ID and
location to other data.

 Your paranoia is clouding your judgement.
 

   Famous last words of the ostrich. The whole point of this
thread is about a man who got SIM swapped and lost 40K
pounds! Your neighbor has just been eaten by a lion. Keeping
his head in a hole didn't protect him. What a shocker!