Forest Global Training Partners

Cyber Risks · Krebs on Security

Hanging Up on Mobile in the Name of Security

Summary: Investor Michael Terpin is suing AT&T for $224 million, alleging the carrier was negligent when thieves executed an unauthorized SIM swap on his account on January 7, 2018 and stole nearly $24 million in cryptocurrency after resetting his account credentials. Terpin claims AT&T's own investigation found a store employee in Norwich, Conn. performed the swap without entering his six-digit 'extra security' PIN, and that this was the second hijack of his AT&T number in six months.

What you should know: The attack worked because banks and social platforms treat a phone number as an identity document, and the control meant to protect it - a customer PIN - can be bypassed by a single store employee; police have since charged Joel Ortiz with using SIM swaps to steal more than $5 million from 40 victims.

Read the original at Krebs on Security ↗

Topics
Fraud & Scams
Related