Re: "'Scammers stole £40k after EDF gave out my number"

Java Jive <java@evij.com.invalid> wrote:

On 2025-03-06 01:56, Brian Gregory wrote:

 
On 03/03/2025 12:27, Java Jive wrote:

 
So, EDF allowed them to go from his email address to obtaining his
mobile phone number for a SIM-swap scam, but I wonder how they managed
to go from either to all his savings accounts, unless they'd also
compromised his PC or phone as well; if the latter, why did they need
to go via EDF?

 
Once you've got the email and done the SIM swap scam or hacked SS7 to
read someone’s incoming SMS, that's enough, or almost enough, to get in
to all sorts of things via the I've forgotten my password link on their
websites.

 
But how would they know which banks, savings accounts, etc, to target
without additional information?  Just knowing his email address on its
own would not be enough for this, there must be hundreds of people who
know my email address, because they send me emails via it, but that fact
alone doesn't make me vulnerable to hacking.
 
At very least, they would have had to be able to read his emails, which
would imply that the original problem was not EDF giving out his mobile
number  -  which certainly they should not have done, and without that
second breach of confidentiality it is true that the scam could not have
progressed further, so they are undeniably at fault  -  but something
like his email password being hacked somehow or other beforehand.  How
the latter could happen would be pure speculation as the original report
I linked gave no details, but most probably either he clicked on
something in a phishing scam email, or installed some dodgy software, or
a site he visits was hacked and he used the same password in too many
places.
 

If the scammer has passed EDF’s security, which seems to have happened,
perhaps they have the login credentials to the account. That would allow
them to obtain a pdf of the utility bill. Unfortunately a utility bill is
often demanded as a proof of ID. So perhaps the utility bill allowed access
to the mobile phone account.