As a former AT&T call center worker, this is typical. It also shows how SMS 2FA is flawed.
Someone socially engineered AT&T to get a new SIM for my phone, signed into my Paypal (using 2FA) and withdrew a bunch of money. I am livid
-
-
- 7 weitere Antworten
Neue Unterhaltung -
-
-
Everybody read https://www.forbes.com/sites/laurashin/2016/12/20/hackers-have-stolen-millions-of-dollars-in-bitcoin-using-only-phone-numbers/#5768c11438ba … Never use SMS-based 2FA, nor SMS-based account recovery.
-
Then what should be used? password alone is not really secure. Password managers perhaps?
-
Password managers, yes, and TOTP-based (not SMS-based) 2FA. But, I don't really advise people to do the latter, because I think it is too…
-
…hard to set that up without accidentally turning on SMS-based account recovery.
Ende der Unterhaltung
Neue Unterhaltung -
-
-
Hi Justin - we just sent you a DM so we can assist. Please respond when you can. Thank you.
- 2 weitere Antworten
Neue Unterhaltung -
-
-
Socially engineered? AT&T didn't ask for an account PIN or other verification?
-
AT&T especially is amazingly permissive. When I had them, they would never challenge me and would read PII to me unprompted over the phone.
- 2 weitere Antworten
Neue Unterhaltung -
-
-
jesus christ. I guess this is why SMS based 2FA is useless :/
Danke! Twitter wird dies nutzen, um deine Timeline zu verbessern. Rückgängig machenRückgängig machen
-
Das Laden scheint etwas zu dauern.
Twitter ist möglicherweise überlastet oder hat einen vorübergehenden Schluckauf. Probiere es erneut oder besuche Twitter Status für weitere Informationen.