Can you impersonate someone on a cell phone network if you can get them to enter a magic code?

Question

I just got weird warning on a social network about a scam that is supposedly making the rounds. However the claims were quite outlandish and I'm skeptical if it's even technically possible.

If the post is to be believed, apparently there are some scammers calling people and pretending to be cell phone network technicians. They then ask people to enter some sort of code in their phone, like #09 or something, just probably much longer (sounds like a USSD code). If the victim complies they then can reportedly make calls as if from the victim's phone/sim card, and even access their phone banking.

Now, I know that phone number spoofing is a simple and common thing, but that wouldn't allow them to do the above things. I also have never used phone banking, but I would imagine that it still requires people to authenticate themselves with a password of some kind. Well, I suppose it's possible that a bank has set up some more direct link with the major phone operators (we only have 3) which allows them to have a more substantial caller ID than just the phone number... But that would still mean that the attacker has to do some serious spoofing which goes beyond anything I've ever heard about.

So - is there a grain of truth in this tale? Is it possible to somehow grant another person the capability to impersonate you on a low level in a cell phone network? Or is this just another urban legend making its rounds on the interwebs?

Answer 1

The first thing that comes to mind is that the scammers are tricking people into enabling call forwarding/diverting. You already mentioned caller id spoofing, which allows the scammers to appear as if they are making the call from the victims phone. If the scammers also manage to turn on call forwarding on the victim's number (perhaps only selectively forwarding calls from the victim's bank, so that the victim doesn't immediately catch on), they can also receive calls that made to the victim.

Whether or not this will grant access to the victim's bank depends upon the bank. It's possible that the bank requires some sort of password as well, but the scammer can always call in claiming they have forgotten the password and want to reset it. Depending on how the bank handles this, they might call the person back on the number they have in their records to make sure they are in contact with the right person. If call forwarding is enabled, the scammer will receive the bank's call and gain access to the victim's bank account.