The Phone Number Takeover Scam Banks Can’t Stop

TLDR;

This video discusses the increasing threat of phone number theft and its implications for identity and financial security. It details a real-life case where an elderly woman lost $25,000 due to a stolen landline number and outdated bank account information. The video explains how criminals exploit phone number porting to gain access to personal accounts and bypass security measures like SMS-based two-factor authentication. It provides actionable steps to protect oneself from such scams, including adding port-out PINs, freezing credit, updating banking information, and using stronger authentication methods. The video also touches on the related issue of SIM swapping and offers advice on what to do if you become a victim of these crimes.

• Criminals are increasingly targeting phone numbers to access personal and financial accounts.
• Outdated account information and weak authentication methods are major vulnerabilities.
• Proactive measures like port-out PINs, credit freezes, and authenticator apps are crucial for protection.

Intro [0:00]

The video starts by highlighting the vulnerability of debit card and phone number holders to scams. It presents a case where a woman lost tens of thousands of dollars due to a hijacked phone number. Experts claim that such incidents are hard to prevent. The story of 86-year-old Joanne, whose landline number was stolen, leading to $25,000 being wired out of her account, is presented. The stolen phone number was used with her deceased husband's identity to access her Wells Fargo account. The bank eventually refunded the money after intervention from a consumer advocacy group.

What Actually Happened [4:12]

When a criminal ports your number out, they aim to intercept text messages, two-factor authentication codes, banking alerts, and password reset links. The key is converting the number to a cell phone, enabling the hacker to request resets to accounts tied to that number. In Joanne's case, the hacker used her late husband's information paired with the stolen phone number to access the online account and wire out $25,000. The scam succeeded due to outdated account information and AT&T allowing the fraudulent port out.

Why Is This So Hard to Catch [5:28]

It's difficult to completely prevent phone carriers from porting out your number if a criminal has enough information to impersonate you and request a transfer. Carriers are supposed to verify these requests, but their verification processes are not always effective. Banks often rely on SMS verification, which is a weak form of authentication. Hackers exploit phone-based identity verification, as banks often assume the criminal is the account holder once they have control of the phone number.

A Reality Check [6:14]

The video emphasizes that this type of fraud is not a typical scam call where victims are tricked into giving away information. Instead, it involves identity and phone number takeover, often targeting older individuals who may not be digitally savvy and have outdated information on file. Seniors are particularly vulnerable, with the FBI reporting that they lost over $4.8 billion to scams.

What You Can Do to Avoid This [6:57]

To protect yourself, the video recommends several steps:

1. Add a port-out PIN to your phone number, including an account PIN, a port-out PIN, and a note requiring in-store verification.
2. Lock your credit with all three credit bureaus to prevent unauthorized account openings.
3. Update all banking information to reflect the correct names, phone numbers, and email addresses.
4. Stop using text messages as your only security and switch to authenticator apps, hardware keys, or email-based authentication.
5. Set up transaction alerts for transfers, withdrawals, and login attempts.
6. Educate parents and grandparents about these security measures, focusing on phone security, bank alerts, credit freezes, and account updates.

What to Do If This Happens to You [10:05]

If you become a victim of phone number theft, follow these steps:

1. Call your phone carrier immediately to report the unauthorized port out, shut down the number, reassign it to your SIM card, and request a fraud port-out letter.
2. Log into your online banking to change passwords, two-factor authentication methods, and contact information, and remove any unknown devices.
3. Call your bank's fraud department to report the port out, the potential unauthorized access, and request an immediate freeze on outgoing transfers, obtaining a case number and escalation.
4. Freeze your credit reports to prevent additional accounts from being opened.
5. File an FTC identity theft report, a police report, and reports with your state and attorney general.
6. Document everything, including times, dates, names, and screenshots, to increase the chances of getting your money back.

Watch Out for Phone SIM Swapping [11:51]

The video explains that SIM swapping is a modern version of the scam that happened to Joanne. Hackers steal cell phone numbers to access text messages, login codes, and app authentications, draining accounts in the same way. The video shares a story of Jeff Droman, who lost $21,000 due to SIM swapping. Cybersecurity experts blame mobile carriers for lacking security and recommend setting up carrier passwords and port-out protection. They also advise against using text-back codes for two-factor authentication and suggest using authenticator apps instead. The video concludes by emphasizing that phone numbers are like the new social security numbers and provides tips to protect yourself, such as never posting your phone number online and avoiding answering unknown calls pretending to be your carrier.