My wife had her mobile number stolen. Someone called EE and with data they had discovered, they managed to pass the security. They then moved my wife’s number to a pay as you go number and changed the address. We spoke to EE and this is their process.
I suggest that EE change the process to require a call to the phone number being transferred.
From control of the phone number, they then accessed a credit card which required two factor authentication to steal some money.
