malicious sim swapping

[Elvira77]

What measures EE takes to prevent malicious sim swapping when hackers pretend to be customers aiming to breach the 2FA mechanism?

I tried to ask the company directly, but there is no suitable category to ask in writing, only to call or send a letter. I find it strange that you cannot chat with or email a representative. I am a new customer to EE. 

[Chris_B]

@Elvira77  there is no email option that you can use as emails are too slow to deal with customer issues.   Your account should be password protected and you’ll be asked certain letters of your password when you call customer services you can also be asked a few other questions like how much was your last phone bill? What phone are you currently using? How many lines are your account to name a few.      Fail one question and the account is locked.   That’s when you will need to go to a store with in date photo ID.     I also requested that only numbers on my account can actually be used when calling customer services.   So if a different number is used customer services should also not deal with that caller.     

Not to mention that you should also receive a text if this was to happen. Thats when you call customer services ASAP as number ports take up to 24 hours to complete so you do have time to call.   Any text about a a potential number port. i.e. it will probably start with sorry to see you’re leaving”  should be a call to customer services ASAP. 

[bristolian]

Can you expand on what you mean by malicious SIM-swapping?

In order to receive SMS sent to a mobile number, you need access to either the physical SIM, or the phone that has the eSIM within it.

Some requests such as attempts to request a replacement SIM, will trigger a text message to the existing line. That text message should - as already mentioned - trigger an immediate call to CS if the request is not genuine.

[Elvira77]

That answered my question, thanks both. 

Just getting a bit agitated when I learn about all those novel scams and hacks that are taking place, so I wanted to know I was in safe hands. 

Just an additional one that stems from learning the detail: super secure passwords are complicated and I guess nobody remembers them all unless being somewhere far on the autism spectrum. If I cannot provide the details of my password, without having access to them at that moment, can I still get in touch with the customer services about individual matters? I could do it with my previous one, answering their other questions, but they ceased to provide mobile services, hence I found myself in your club. 

Cheers! 

[Chris_B]

@Elvira77   The chances are when you call customer services you’ll be doing this from a smart phone and there are many ways to have password saved on your device that are saved very securely this could even be via an app that requires a password to access it.   You don’t need to have it written down at home kept in a safe place.    
 

[bristolian]

CS need to verify the identify of a caller before discussing account-specific information. The password is the usual means, but other questions are available.

[NW69]

so - exactly this happened to me - and EE CS staff could not/would not step in and stop the port happening.  I called as soon as the hack became clear to me (via a text message saying "sorry to see you go") - and EE staff told me they would not be able to stop it.  By now, there really ought to be a way of the mobile service providers being able to talk to each other quickly to block unwanted porting activity.  Sure enough, around 24 hours later, I lost access to my phone and the hackers (stupidly) tried to buy loads of Apple gear on my account.  Stupidly because it was such a high value basket then my credit card couldn't handle it and my payment method on my Amazon account was declined.  I remain extremely disappointed that EE still haven't done anything pro-active to stop SIM swap fraud.  Their behaviour is (at best) 100% negligent.

[Christopher_G]

Hi @NW69 

Welcome to the community.

I'm really sorry to hear of your experience. When you report something like this to our Mobile Care team, an investigation should be opened with our Number Porting team, so that it can be investigated and blocked, if possible.

What happened after this? Was the number transferred back? Is everything sorted now?

Chris

[NW69]

Hello @Christopher_G - I have no idea if an investigation was opened up but I definitely reported it to the call centre as soon as I became aware - and unfortunately the staff were really not that clued up as to what to do.  If an investigation has been opened, EE are not being transparent about the process and have failed to report back on what exactly and how it happened and share information with me (the victim of the fraud.)   I've asked how exactly someone was able to undertake a SIM swap hack on my account but EE clearly don't want to share what to me would clearly be quite useful information at least in terms of understanding what happened.  My only assumption at this point is the lack of information or reticence/unwillingness to share is because EE knows that its systems are open to fraudulent activity, potentially perpetrated by its own staff even (what else can I assume at this stage?) and doesn't wish to publish or share that fact openly any further.  I'm slightly astounded by the number of topics covering SIM swap hack or SIM swap fraud in this EE Community forum alone.

All I do know is that my Amazon account was hacked for starters (as mentioned above) and I had to change all my online identities for fear of other breaches elsewhere.  I had no compensation given by EE for what happened.  I do now have my EE number back and on an EE sim card.  I don't mean to sound impolite, but I wonder if you're not the best informed about what EE can and will do when an unsolicited number port takes place. 

You may detect a hint of bitterness in my note here - and you'd be very right.  The incident upset my (digital) life for a couple of weeks and caused huge amounts of stress - which was only exacerbated by EE's behaviour.  It was only by virtue of me having a work phone on a different network and number, that I was able to take action in the first place.

regards

@NW69 

[James_B]

Hi @NW69,

I absolutely understand how you are feeling about this incident - having your identity stolen is and incredibly stressful experience.

The fact that the number transfer has been reversed indicates that the agent you spoke to took the correct action and raised this off to our fraud team to resolve.

As a next step, I'd recommend speaking to the team again on 150 who can complete a security review on your account and add in extra security measures to prevent anyone who knows your personal details/security information from trying to takeover your account again.

James