These SIM Swap scams....how worried should we be??

eskbanker

where_are_we wrote: »

I am mystified why they don`t text to inform a sim-swap has been applied, for but was told that this wasn`t necessary.

Surely any such messages would only be seen by the fraudsters anyway?

Sea_Shell

where_are_we wrote: »

As a victim of this current sim-swap/TSB fraud my advice is beware of losing your mobile network. I contacted them asap and they put a stop on the new sim but it was too late. I am mystified why they don`t text to inform a sim-swap has been applied, for but was told that this wasn`t necessary. "Don't open attachments in emails. In fact, have your emails in plain text only - it's obvious then if it is a phishing attempt.

Have robust passwords that are unique for each account

Use 2 factor authentication as much as you can"
I rigidly adhere to all of this but TSB don`t "do" 2 factor authentication.
I am changing all my security answers eg place of birth, first school, mothers maiden name to something ficticious because all of this stuff is available on the "wonderful" internet.

Sorry to here that you've been a victim of this. Do you have any idea how/why they targeted you?
Did you notice anything else fishy going on?

masonic

eskbanker wrote: »

Surely any such messages would only be seen by the fraudsters anyway?

Presumably they could send a text before the SIM swap is actioned and wait a reasonable time - say an hour - before making the swap. It probably wouldn't help much, but at least the victim would have something to go on when they wonder why they've lost service.

Robisere

" I rigidly adhere to all of this but TSB don`t "do" 2 factor authentication. "


Then I misunderstand the two factor principle. TSB ask for a username, a secret question (eg mother's maiden name, whether true or made up) and a password. That's three steps. If I'm wrong, I will be happy to be corrected.

masonic

Robisere wrote: »

" I rigidly adhere to all of this but TSB don`t "do" 2 factor authentication. "


Then I misunderstand the two factor principle. TSB ask for a username, a secret question (eg mother's maiden name, whether true or made up) and a password. That's three steps. If I'm wrong, I will be happy to be corrected.

Two factor would require something else, like 'something you have' (dongle, app on phone) or 'something you are' (fingerprint)

Username, secret question and password are all one factor (something you know)

TSB actually do 2 factor authentication, but they are using a mobile phone as 'something you have' and failing to account for the fact that a mobile phone number isn't permanently bound to a phone or SIM card.

System

masonic wrote: »

Presumably they could send a text before the SIM swap is actioned and wait a reasonable time - say an hour - before making the swap. It probably wouldn't help much, but at least the victim would have something to go on when they wonder why they've lost service.

Let's get real here, the mobile network is only concerned with fraud directly affecting them. It's not their problem if banks are using it's text service for two factor identification.

masonic

Heng_Leng wrote: »

Let's get real here, the mobile network is only concerned with fraud directly affecting them. It's not their problem if banks are using it's text service for two factor identification.

I completely agree with you. Banks should not be using it this way.

Yorkshire_Pud

eskbanker wrote: »

Surely any such messages would only be seen by the fraudsters anyway?

The fraudsters need to know they are ready to roll too you know

A SIM swop should involve physically swopping the old SIM in the store together with ID. If not then much greater checks need to take place.

Writing that I realise there is no answer whilst banks rely on mobile phone Internet banking. Mobiles are the established 'anonymous' false identity choice of crooks, terrorists and other ne'er do wells around the world.

masonic

Yorkshire_Pud wrote: »

A SIM swop should involve physically swopping the old SIM in the store together with ID. If not then much greater checks need to take place.

My mobile network provider doesn't have any stores anywhere near where I live. But I'd be happy to set up 2FA with them (not using SMS).

robatwork

masonic wrote: »

Yes, not to mention that some companies hand out SIM cards left right and centre, distributing them as widely as possible in the hope of attracting new customers.

I was given a phone and didn't know if it was unlocked. So I ordered a couple of free sims from differing networks.

One of them - could have been vodafone - wanted to send out 3 "for friends and family just in case". So yes, they can't issue them fast enough!