Re: "'Scammers stole £40k after EDF gave out my number"

On 2025-03-07 15:17, Newyana2 wrote:

On 3/6/2025 1:36 PM, Carlos E.R. wrote:
 

They're also getting
2FA codes. With the email address they go to that and say they
forgot their password. Then there are two possiiblities. They may
need to know security questions, or they may have a password
reset link sent to their cellphone. If it's the latter then they have
email access. That's part of the lesson here. 2FA is not safer. It's
riskier. It's bringing an insecure, portable device into the mix and
trusting that device fully.

>
2FA is safer, provided the bad guys can not clone the SIM.
>

    Exactly. But that's what happened. So, let's see,
we don't need raincoats as long as it never rains, thus
we don't need raincoats... Wait... :)

No.
You are looking at it wrong.
We need 2FA, and also we need secure practices by everyone involved on the handling of SIMS. Any weak link and you are at risk. And 2FA strengths the link.
--
Cheers, Carlos.