Lebara sim swap fraud

thewizardofoz87

Hello all

I’ve had sim swap fraud occur on my Lebara phone number which I’m not longer able to access.

I spent 4 hours with 3 different people this evening trying to get Lebara to do something about it. The first two brushed it off as an issue with my phone and nothing to do with them. Then I asked the third what SIM card number my phone number was linked to which proved there was a breach their end. But they still didn’t offer any solution or seem concerned at all. I’m dumbfounded - my number’s been stolen, I’m paying for a service I can’t use and their reaction is to just ignore me?!

What should Lebara be doing at this point? It’s a serious breach, they’ve refused to intervene in any way which means I’m still at risk and can’t update a lot of my online passwords because this hacker will just deny me access. They didn’t even send a text to warn me my number was going to be ported and refused to tell me when it was requested.

What do I do now?! Is there a body I can report this to that will make them do something about it?

Thanks for any help anyone’s able to offer.

PHK

It’s unfortunate that these budget providers don’t provide the level of customer service you’d expect when something goes wrong. 

Whilst Ofcom don’t investigate individual complaints, you should report this to them either by filling in the monitoring form on the Ofcom website or calling them. 

You should also contact the ICO about the data breach and they might take action. 

Make sure you’ve followed Lebara’s complaint process, complaint to the email address given at https://www.lebara.co.uk/en/terms-and-conditions.html and if you don’t get a response then contact the ombudsman on the link given. 

reddwarf2002

I always thought Lebara's lack of sms to notify you that your number was about to be ported was a red flag. It's a disaster waiting to happen. Hopefully they will change it.

savergrant

If the phone number is still registered to a lebara sim it isn't actually a porting fraud. What seems likely us that someone has requested a replacement sim fraudulently, claiming the original sim has been lost, stolen, or damaged. I would guess that if the sim was reported stolen to the provider it wouldn't make much sense to ring the purported thief to double-check. Rather it would be better to have strong processes to check the identity of the person requesting the replacement sim.

kt01

PHK said:

It’s unfortunate that these budget providers don’t provide the level of customer service you’d expect when something goes wrong. 

A budget provider has nothing to do with customer service level.

MoneySavingExpert's last poll (that I can find an article about, anyway) put Vodafone as the worst with Giffgaff, Tesco Mobile, Sky and Plusnet as the top 4 best.

Which's much more recent mobile satisfaction survey put Lebara's customer service at 3 stars, ahead of Three (2 stars) and on the same level as O2, Vodafone and EE. All the top rated networks were budget networks, Tesco and Smarty with 5 stars, and Giffgaff and 1p Mobile were the only ones to get 4 stars.

thewizardofoz87 said:

I’ve had sim swap fraud occur on my Lebara phone number which I’m not longer able to access.

I have gone to test the SIM swap feature on Lebara's website to see what security measures are in place with my own number - the security step appears to be that the registered account email is sent a one time PIN code. This would suggest your email address could be compromised.

Do you get the OTP to your when you go through the SIM swap? If you do, you should be able to force a SIM swap back to a new SIM you can pick up free online or in a shop for £1.

PHK

kt01 said:

PHK said:

It’s unfortunate that these budget providers don’t provide the level of customer service you’d expect when something goes wrong. 

A budget provider has nothing to do with customer service level.

MoneySavingExpert's last poll (that I can find an article about, anyway) put Vodafone as the worst with Giffgaff, Tesco Mobile, Sky and Plusnet as the top 4 best.

Which's much more recent mobile satisfaction survey put Lebara's customer service at 3 stars, ahead of Three (2 stars) and on the same level as O2, Vodafone and EE. All the top rated networks were budget networks, Tesco and Smarty with 5 stars, and Giffgaff and 1p Mobile were the only ones to get 4 stars.

thewizardofoz87 said:

I’ve had sim swap fraud occur on my Lebara phone number which I’m not longer able to access.

I have gone to test the SIM swap feature on Lebara's website to see what security measures are in place with my own number - the security step appears to be that the registered account email is sent a one time PIN code. This would suggest your email address could be compromised.

Do you get the OTP to your when you go through the SIM swap? If you do, you should be able to force a SIM swap back to a new SIM you can pick up free online or in a shop for £1.

That is out of sync with the experience of everyone else who has posted here and with Ofcom figures. 

kt01

PHK said:

That is out of sync with the experience of everyone else who has posted here and with Ofcom figures. 

Would you like to quote those Ofcom figures you mention?

The latest ones I can see from April 2024 are that Sky and Tesco have the lowest level of complaints, whilst O2 have the most. Lebara doesn't even feature in the data.

Rawhide_2

thewizardofoz87 said:

Hello all

I’ve had sim swap fraud occur on my Lebara phone number which I’m not longer able to access.

I spent 4 hours with 3 different people this evening trying to get Lebara to do something about it. The first two brushed it off as an issue with my phone and nothing to do with them. Then I asked the third what SIM card number my phone number was linked to which proved there was a breach their end. But they still didn’t offer any solution or seem concerned at all. I’m dumbfounded - my number’s been stolen, I’m paying for a service I can’t use and their reaction is to just ignore me?!

What should Lebara be doing at this point? It’s a serious breach, they’ve refused to intervene in any way which means I’m still at risk and can’t update a lot of my online passwords because this hacker will just deny me access. They didn’t even send a text to warn me my number was going to be ported and refused to tell me when it was requested.

What do I do now?! Is there a body I can report this to that will make them do something about it?

Thanks for any help anyone’s able to offer.

Hi Wizard

My Lebara number was ported to Vodaphone by a scammer around the same date. I did get a SMS indicating that a PAC code was issued, unfortunately it was on a busy day I was going in and out hospital so wasnt glued to reading SMS messages. The PAC code was preceded by SMS message " Your request has been rejected due to business rules" and then the PAC code was followed by 2 SMS's with my outstanding balance. I saw only the last (very long ) one  and none of the earlier txts. Ignored it thinking it was a routine message, at my peril.

Only realised the predicament the following day 5th June when no phone signal.

Lebara were pretty useless and initially informed me incorrectly that as the number was already ported it was down to me to contact Vodaphone to try and get it back. I have now raised a complaint with Lebara and will escalate to the Ombudsman if no satisfactory response. So far I have had 2 accounts given of how this occurred. First I was told that I called, gave my DOB, address and email address and a password and from that the scammer passed security and requested PAC code. I am dubious about whether that is true or not. Later I received an update that the PAC had been requested from my mobile phone - untrue. The scammer subsequently used OTP to request reset and change the password of my BB service provider. Luckily spotted almost immediately and called BB provider.   Seems like some form of data breach is in play, I have now changed Lebara profile e-mail to a unique one expressly for that purpose.

Lebara got my number back from Vodaphone after 10 days, I would give them 0 out of 10 for their understanding of their responsibility under UK mobile network regulations, and how reported fraud should be handled

Clearly the scammers are up to no good / identity fraud / serious financial fraud intent - luckily no financial institutions were hacked. Hope you were similarly relatively unscathed

Will post an update as an when Lebara internal investigation yields anything I believe.

Will also follow PHK's suggestion to contact Ofcom and ICO