I got a call from a US phone number from a guy claiming he was from a dark web website (something .onion, I can't remember) and he was calling regarding my "fake passport application". I hung up (call duration: 20s), he called back and I told him I hadn't applied for any such thing and hung up again (call duration: 40s)
A minute later, my phone is flooding with SMS's regarding One Time Passwords from about 20+ different websites. 20+ SMSs within the 10 seconds. (These were all genuine companies, like Amazon and stuff)
My question is, Am I being attacked?
Is my identity being used to sign up on different websites or this is just spam? Can an attacker gain access to these OTPs? How do I know my calls/texts/location/network usage isn't being monitored? Is my sensitive information at risk?
I use an iPhone (iOS 12 Beta). My outlook account was compromised one day before this happened. (easy password). I've changed the password now.
Paranoia: The person on call knew my name. The sources of the OTPs are genuine. I don't see the motive behind sending OTPs from tons of different websites unless they can access the OTPs. (possible iOS vulnerability that isn't documented yet?) I see 4 possible intentions:
- Using my identity as part of a fake passport/profile on the dark web.
- Using my identity on regular websites (Amazon, etc)
- Gaining sensitive information from my device.
- Elaborate Spam/prank