I've recently been the victim of professional fraudsters who requested transfer of my number from my SIM to one under their control. They managed to navigate through all of this process without me every authorising the transfer. When I first got an SMS from EE saying my account was being closed and transferred to another provider, I contacted EE immediately and explained that I had NOT requested this transfer. Sadly, they were too slow and/or disorganised to prevent the transfer occurring despite reassurances on the phone that they would fix everything. To add insult to injury, my UK Bank then accepted a subsequent request to reset my online Banking account from the same fraudsters without my authority. Their process included an SMS for 2FA to my now hijacked phone number!... Thankfully the Bank's fraud detection systems and refunds system have not left me out of pocket BUT EE has leaked all the information visible in my online account with them to fraudsters and transferred my number without proper process being followed. My Bank has pretty much done the same as online banking shows enough personal data for fraudsters to have a fild day with online ordering at Currys and Argos in my case.
Over a month later EE have not been able to supply me a proper account of what happened and which parts of my data have been leaked. I suspect they've transferred the SIM somehow without properly checking my password. I prefer to think this is the case rather than EE have had a data breach involving my password.
I'll continue the conversation with my Bank too.
I'm roughly £250 out of pocket for a flight that I missed while trying to get to the vbottom of this on the day my number moved and all my Bank cards stopped working when on the way to the aiport.
Beware - EE security is not up to a good standard for number transfer. Combine this with poor practice of UK Banks when people transfer phone providers and say they've forgotten all their phone banking details (in this case Ll#yds Bank). Completely inadequate security and quite possibly GDPR, PCI DSS and other data breaches included!
