This interesting article in the NYT discusses how attackers are stealing phone numbers of their intended victims by phoning up Verizon, AT&T, etc., giving them a sob story about an emergency and convincing the phone company to transfer the target phone number to the attacker's own device. Once the transfer of the phone number is complete, they are then using the 'forgot password' functions of digital currency websites to gain control.
My questions are:
The attackers focused on specific people associated with digital currency. What ways are they likely to have used to get the phone numbers of their targets in the first place?
Was the root problem that these digital currency accounts all had SMS password/account recovery options, such that once the attacker had control of the phone number a simple account reset via SMS allowed them complete control?
Assuming SMS account recovery/reset was the vulnerability here, how widespread is this practice amongst websites? What else can an attacker do with a captured phone number?
Are there reasonable steps people can take to protect against this scenario?