Forest Global Training Partners

Cyber Risks · Krebs on Security

T-Mobile Employee Made Unauthorized ‘SIM Swap’ to Steal Instagram Account

Summary: A T-Mobile retail employee allegedly made an unauthorized SIM swap on customer Paul Rosenzweig's account, moving his number to a new SIM so the attacker could intercept his calls and texts and take over his three-letter Instagram username 'par'. Rosenzweig had already followed T-Mobile's advice to add a port-out PIN, but T-Mobile acknowledged it sends SIM-swap alerts only by text to the new SIM and not by email, and it is investigating a current or former employee as the likely culprit.

Why it matters: The attacker needed no password and no phishing kit - only an insider willing to swap a SIM - and the port-out PIN T-Mobile recommends did nothing to stop it; a separate SIM lock that can only be removed in person with ID is the control the carrier says customers must request by phone.

Read the original at Krebs on Security ↗

Topics
Identity & Access Management
Related