Is Your Mobile Carrier Your Weakest Link?
Summary: Krebs on Security notes that SMS one-time codes, the most common second factor, are also the least secure, because attackers can call a mobile carrier posing as the account holder to activate a new SIM card or forward calls and texts to a number they control. The post cites a 2013 incident in which the author's own calls and texts were forwarded, a New York Times story on SIM-swap attacks against Bitcoin holders, and new proposed NIST guidelines urging organizations to favor app-generated one-time passwords over text messaging.
Key Takeaway: A single customer support representative at your mobile carrier can be talked into moving your second factor to an attacker's device, which means the control protecting your email - and through password resets, the accounts tied to it - depends on a phone company's verification process rather than your own.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026