O2 SCAM ALERT Bank Accounts could be emptied

[TallTrees]

Hi ~

I am very concerned having read an article that O2 EE and Vodafone mobile phone customers are vulnerable to a growing scam which allows fraudsters access to their bank accounts.

An investigation by BBC 1's Watchdog Live has discovered the phone giants are handing out replacement SIM cards to people without running proper ID checks.

This allows criminals to pose as customers, get a SIM card for a phone that isn't theirs, and gain access to someone's phone number.

Once they have access to the phone number not only can they hijack calls and texts, but they can use it to access a person's mobile banking, and potentially clear out their accounts.

Cases of so-called SIM-swap fraud have krocketed 60 per cent since 2016

A case was presented that £2000 was removed from a persons bank and the bank initially refused to refund the money, blaming the person for not keeping details safe.  This was a replacement SIM card by EE

Watchdog finds O2 and Vodaphone worst offenders.

Five of the six O2 stores visited allowed a TV person to walk out with a SIM card for a phone number that wasn't his.  

O2 has told the programme it currently only asks for photo ID when replacing sims on a monthly contract PAYGo would receive an authorisation code alerting them that someone is trying to access their number.

However, when tested by Watchdog TV that didn't happen with any of the numbers being used by the Watchdog Live Team.

Very Very worrying ~ 

[Anonymous]

Some financial institutions seem to view SMS verification as secure when delivery isn't even guaranteed by any of the networks.

In these cases it relies on an individual carrying out security protocols correctly but in the case of a phone shop they probably prefer to be selling.

[TallTrees]

Hi @Anonymous

Thank you for your thoughts ~ 

SMS ~ that is right ~ and it is being used by the banks in particular as a back up verification

     I certainly hadn't considered it "not secure" 

O2 shops ~ it will be the case, of course, that protocols have not been followed.

I am wondering whether further safeguards could be put in place so that "shops" could not, issue a SIM without the correct procedures being followed don't suppose it would be beyond the "wit of man".

I have been a victim of a data breach ~  it has dominated my life and has far reaching affects.

[Anonymous]

@TallTrees

Can imagine, fortunately I haven't up to now but I tend to be cautious security wise anyway as I work within IT.

It should be enforced that store and indeed call centre staff have to fill in random letters of a password the customer sets up when taking the contract before it will allow them to process an order for a replacement SIM.

The initial password should be randomly generated and sent by post and the customer forced to engage to change it.

[TallTrees]

Hi @Anonymous  Yes, it should be enforced by the mobile companies ~ taking responsibility for it too.

If it could be proved that it was the O2 Vodaphone EE etc. shops that enabled this scam ~ mobile providers should refund the customer the money lost, not the banks. 

~  hopefully with this kind of "exposure" by the BBC Watchdog programme about this type of scam, it will encourage the mobile Companies to put into place some better safe-guards for their customers details

.  

This particular kind of scam as well as a data breach cannot be controlled by the unwitting customers. There really is no need for it security of  customers details etc., should be priority.

[Anonymous]

Thank you very much @TallTrees & @Anonymous

Virtual kudos to you both 

[cece5]

Thank for this feed @TallTrees & Info @Anonymous
Just seen Watchdog on BBC One.
And I am very, very, very, very concerned that O2 “one of four top phone companies can allow O2 customers details to walk out of door so easily.?!?!?!
You would think being in the 21st-century there first priority would be safeguarding customer details.!!!!
All staff (management too) should be better trained on Securing customers details. However desperately a customer needs a slim card, if they can’t answer the proper security questions.... even the secret password. Don’t give out..!!! If you can’t get into a night club without ID, i can’t see why all O2 staff can’t do the same...!!! No ID..! no password..! Don’t give it out!!!
Unless some of O2 shops management and staff are in scam too..!!!!
I am considering very carefully if I should renew my contract with O2.
Not happy!!!! Sort it out!!!!

These explanation mark is me swearing. Sorry, I’m not happy..!

[Cleoriff]

They should adopt the Spanish way of buying a sim.

I had to jump through hoops and provide all sorts of info ie address, passport etc. Security was very tight there.

It was pretty much the same for the locals when purchasing a phone.

Even when I topped up my mobile dongle sim in Spain, I couldn't do it online, I had to go to Orange ES with passport and purchase the top up there. It was activated only when the CS in the shop phoned through to Orange and gave my details and the number of the sim.

Obviously this was a real palaver as I used to travel there every 6 weeks or so.

Eventually I invested in Wifi in my apartment.

Much better as I could then use my phone, computer and access UK TV channels through a WiFi box  .

[TallTrees]

Hi @Cleoriff

Thanks for sharing the Spanish Sim purchase.  Very interesting.  It must have been very difficult but

now we can see the wisdom

[Anonymous]

It's not a new scam, but it is concerning that some networks aren't doing enough to protect their own customers, particularly when they already have the necessary security processes in place to prevent that kind of fraud. But it's worth remembering, that gaining access to a mobile account is probably the final piece in that jigsaw, and if someone is trying to steal your identity they will have already farmed a lot of information from your online activities. We spend a lot of time shopping online, or engaging in social media, but sometimes we drop our guard and reveal too much about ourselves.

It's easy to become paranoid about identity theft, but a lot of victims have left themselves vulnerable in the first place. There's some good advice in this article by Martin Lewis, particularly the section where it explains how to find out if hackers have stolen your data. Having been a victim of a data breach, I was particularly interested in the following website (as linked in the aforementioned article):

https://haveibeenpwned.com/