This interesting article in the NYT discusses how attackers are stealing phone numbers of their intended victims by phoning up Verizon, AT&T, etc., giving them a sob story about an emergency and convincing the phone company to transfer the target phone number to the attacker's own device. Once the transfer of the phone number is complete, they are then using the 'forgot password' functions of digital currency websites to gain control.

My questions are:

  1. The attackers focused on specific people associated with digital currency. What ways are they likely to have used to get the phone numbers of their targets in the first place?

  2. Was the root problem that these digital currency accounts all had SMS password/account recovery options, such that once the attacker had control of the phone number a simple account reset via SMS allowed them complete control?

  3. Assuming SMS account recovery/reset was the vulnerability here, how widespread is this practice amongst websites? What else can an attacker do with a captured phone number?

  4. Are there reasonable steps people can take to protect against this scenario?

closed as too broad by a CVn, Xander, TheJulyPlot, Stephane, Steve Aug 23 '17 at 13:34

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    Well I have read the article, and still cannot understand how on earth a serious phone company could tranfer a phone number without a true user validation... And I can even less understand how the company that commited the fault could not be made responsable for the consequences of its fault. I would have imagined legal actions in that case... – Serge Ballesta Aug 22 '17 at 15:11

There's a number of ways that someones number can be acquired by attackers. Perhaps the victim has it, and their email address exposed publically on Facebook, or Skype, or LinkedIn. Or perhaps that data has been leaked in a data breach and then sold and shared by Criminals.

In my opinion, the root problem is that the phone companies employee(s) broke procedure and transfered someones number to another sim without proper authentication. Those procedures are in place for a reason, but the attackers socially engineered the operators into breaking them.

I can't say exactly how widespread the practice of sms recovery is, I believe its fairly widespread, as its nice and easy for an average user. The article mentions Facebook, Twitter, and Google, and I know LastPass does it too. The first three are very big players on the internet, so that suggests it would be a widespread practice as others follow their example.

To avoid it, we can either hope that phone companies change how they work so this becomes impossible (or at least a lot less likely). You can also limit the exposure of your phone number, or have a specific phone number on a pay as you go sim in a 'dumb' phone (an old one like the classic Nokia 3310) that you only use for account recovery. Finally, while this won't be applicable for every website, you could also try enabling alternative methods of account recovery.


NIST's Digital Identity Guidelines recognise the risk of loss of mobile phone number through social engineering, and their recommended mitigation strategy is "Avoid use of authenticators that present a risk of social engineering of third parties such as customer service agents", i.e. don't use SMS for authentication.

Not the answer you're looking for? Browse other questions tagged or ask your own question.