Maryland woman loses $17K in SIM card swap scam despite 2FA

https://wjla.com/features/i-team/scams-verizon-bank-of-america-two-factor-step-authentication-cell-phone-sim-card-swap-criminals-crime-hackers-money-iphone-5g-service

by mooreds • 2 years ago

14 19 2 years ago

wjla.com

gumby3• 2 years ago

“Despite 2FA” is the wrong way for the article to describe it. The sim swap was specifically done to get around text-message-based 2FA.

Everybody should lock their SIMs. But the real problem is the reliance on SMS “authentication”

mooreds5• 2 years ago

Well, she thought she'd set up 2FA and she was told she'd set up 2FA.

gumby3• 2 years ago

Yes, I didn't mean to criticize the victim so thank you for pointing that out!

She did everything she was told to do and so unsurprising is shocked at what happened.

The tragedy is that nobody is calling out the vacuity of using a text message as an authenticator. Hell, even the MIT alumni association does this and they should definitely know better!

It's going to take someone serious, like the FTC, to force a change in this lazy and dangerously ineffective approach. But TBH I fear that the alternatives that might work for the bulk of the population (who, after all, have other things to do with their lives than become computer security experts) will just move do a different, and equally dangerous point in the option space. Its not like most people can manage a password manager, much less its dynamic key features.

For example choosing a very large third party (like "log in with google"/Apple/Facebook and so on) just allows a different kind of attack to lock you out of everything, likely with no recourse.

rvz• 2 years ago

2FA authentication via SMS is the most insecure option to ever exist. It is 2024 and it is still unbelievable that this dreadful option is still used waiting for users to lose their money.

Who still thinks continuing to use SMS 2FA in a banking website / app is a good idea? (Hint: It isn't)

phyphy2• 2 years ago

Can anyone explain why SIM swapping works? Do telecom companies in US allow you to buy a new SIM without a government issued ID?

FireBeyond• 2 years ago

A lot of times, there's suspected, or known, inside actors who enable the process.

valdiorn• 2 years ago

You pay one of the minimum wage support staff working for the telephone company a hundred bucks to do it.

That's literally it. Inside man.

travisporter• 2 years ago

"Here are some tips to help you avoid being a victim of a sim card swap: Use authenticator apps, hardware tokens, or your fingerprint or face scans"

I'm sorry but which bank uses non-SMS 2FA in the US?? I've been waiting for nearly a decade

therealcamino• 2 years ago

One possibility: with an ETrade account you can get a Morgan Stanley checking account, and ETrade lets you use the Symantec VIP app as an authenticator.

jwsteigerwalt• 2 years ago

Use hardware tokens!!!!

Maryland woman loses $17K in SIM card swap scam despite 2FA

Related Stories