Unauthorized SIM Card Swapping

[PeoriaJean]

This evening's news featured a warning about thieves who request that a user's phone number be transferred to their phones. This gives them access to financial and other data, and the ability to switch the user's passwords. One man lost $1 million dollars to this fraud.

What is Verizon doing to verify that those requesting a phone number swap are the authorized users? And what can users do to prevent this from happening to them?

https://securelist.com/large-scale-sim-swap-fraud/90353/

[glitchedpixel]

When devices are changed, Verizon prevents certain actions to be done for a period of time as a security measure.

Let's say you forgot your PIN when you called into customer service. Under normal circumstances, a rep can send a temporary code to verify. Now take the same scenario, but you upgraded your phone. Your line will become ineligible for that same secure code.

When a device is lost / stolen, the best thing to do is the report it so both the device and sim card become blacklisted until the owner confirms they recovered the device. It's actually really hard to casually gain access to someone else's Verizon account.

[DDN11]

Where can I find this specific policy from Verizon?

[deloused]

You can find the policy by applying for a job at Verizon, completing the interviewing process, being hired, starting work, and going through training. 

[RobertLauriston]

https://www.vice.com/en_us/article/kz438w/verizon-makes-sim-swapping-hard-why-doesnt-atandt-sprint-a...

[vzw_customer_support]

We know the importance of having all the information you need about our policy. You will be able to find the answer to most of your questions in the link below. Let us know if you need additional assistance. 

https://www.verizonwireless.com/support/4g-sim-card-faqs/

MariaV_VZW

[Dumbledoor]

No it is not. To think this way and spread this misinformation is pointless.

[William_Croft]

There are multiple news stories online, that Verizon has a new option: "Number Lock". This switch can be turned on from the "My Verizon" phone app. HOWEVER, just checking now, I do not see that switch under any category.

https://www.google.com/search?q=verizon+%22number+lock%22

What the heck is going on? I need to turn this on ASAP.

William Croft

[William_Croft]

Hi @vzw_customer_support , @PeoriaJean , @glitchedpixel , @deloused , @DDN11 , @RobertLauriston , @Dumbledoor 

Thanks for your kind replies. HOWEVER, I was informed yesterday by one of your agents, that the "Number Lock" feature is ONLY available to postpaid customers. I am a prepaid customer, so I cannot use the feature.  Apparently Verizon is ignoring the many many reports online of SIM Swap attacks, port out attacks. 

I highly suggest your mid and upper level management, read this research paper. It shows how easy it is to subvert the Verizon store employee's, who check for 'valid' ID before doing a SIM swap. The paper shows that 10 out of 10 Verizon illegal SIM swap hacks, SUCCEEDED.

https://www.issms2fasecure.com/

Which means that Verizon enables easy identity theft. I would appreciate a response on behalf of Verizon, that they are actively working to eliminate such thefts.

Regards,

[William_Croft]

Many MORE news articles from October / November 2022, showing prepaid customers destroyed by SIM SWAPS. And as of January 2023, the NUMBER LOCK feature is STILL not available for prepaid. It only works for postpaid. When is Verizon management going to see how much bad publicity this is causing, and huge pain for customers??

https://www.theregister.com/2022/10/19/verizon_breach_sim_swap/

Initial paragraphs quoted from that article:

----

Verizon prepaid accounts hijacked by SIM swap crooks

Jessica Lyons Hardcastle

Wed 19 Oct 2022 // 22:04 UTC

Verizon has notified some prepaid customers that their accounts were compromised and their phone numbers potentially hijacked by crooks via SIM swaps.

We're told that fraudsters somehow got hold of the last four digits of those people's credit card numbers – perhaps by exploiting some part of Verizon's online services – and used that information to gain control of their accounts.

From there, the crooks could access the personal info in an account and perform a SIM swap. That effectively transfers the victim's phone number to another person's device, allowing that stranger to use the number and any one-time security codes sent to it to hijack the victim's other online accounts.

"Between October 6 and October 10, 2022, a third party actor accessed the last four digits of the credit card used to make automatic payments on your account," the mobile network operator said in a letter [PDF] sent to prepaid customers. 

...