Scams & Phishing News Bank of America customer out $38K after falling victim to SIM swapping

[HarborFront]

Content source

https://www.10news.com/news/team-10/bank-of-america-customer-out-38k-after-falling-victim-to-sim-swapping

Watch the video



You can still activate a SIM card lock if you have an eSIM. Even if you have a SIM card lock on a physical SIM, anyone can remove it and work on unlocking the SIM on another device. An eSIM is more secure because it can't be removed from your phone, so it's harder to unlock it without the SIM PIN. The above security works if the scammer is targeting the user phone directly.

In this case the scammer go through the provider who overrides the phone's security settings by providing the necessary info to the scammer to unlock the phone

 

[TairikuOkami]

People fail to realize the main problem here, SMS! I have accounts in 4 banks and not a single one uses SMS for verifications or notifications.
Still, if you use online banking, you should use at least 2 devices for banking. It is no different from a backup. No backup = 100% your fault!

 

[Chigwells]

Hey @TairikuOkami can you explain your comment please:

if you use online banking, you should use at least 2 devices for banking.

What do you mean by 'use at least two devices?

Could you elaborate thanks!

 

[TairikuOkami]

What do you mean by 'use at least two devices?

Usually you need to confirm login from a new device using an already verified device, just like 2FA on google. Some banks allow to disable SMS for verification and use the app instead. If you loose access to your phone, you can not login, you are locked out and you need to contact the bank. Thus it is required to have another verified device, like an old phone or a desktop.

People backup their pictures of cats, but not their banking credentials. In case of a scam, you can restore access to your account in a few days, after it has been zeroed.

 

[Chigwells]

Usually you need to confirm login from a new device using an already verified device, just like 2FA on google. Some banks allow to disable SMS for verification and use the app instead. If you loose access to your phone, you can not login, you are locked out and you need to contact the bank. Thus it is required to have another verified device, like an old phone or a desktop.

People backup their pictures of cats, but not their banking credentials. In case of a scam, you can restore access to your account in a few days, after it has been zeroed.

Great, I see now. That's like when you use a hardware authentication such as YubiKeys, you are advised to buy them in pairs, keep one somewhere safe in case you lose one. Makes sense, thanks for the pointer