> Making matters worse, if you then pay the bill on someone else's account, the system prompts you to add yourself as an authorized user and requests the callers phone number, potentially granting them full access to your account.

Uhm yeah sure boring stuff. Can I have your phone number?

There was a thread here recently about how it costs 10 bucks to rent out a cellular tower in Malaysia and co-opt a cell phone number as roaming, in order to defeat SMS security 2FA. Experts on HN were saying that the trunk level protocols for cell phone numbers are pretty much worthless when it comes to security. Their conclusion was that: security in this world is so poor that you might as well live with the assumption that there is no real security for public services.

It's ludicrous to me that many services, especially financial, go through the trouble of setting up SMS 2 factor, but not TOTP.

I have a friend that was at the beach with her husband, and she had taken her phone with her, but her husband left his in the car.

Thieves had used a jammer/replay device to unlock their car, remove her husband's phone from his Otterbox case, take his SIM card, reassemble the phone, and steal several credit cards from his wallet (also in the car).

Within the hour, my friend began receiving fraud alerts. If she had not taken her phone with her, they would not have known for quite a few hours, at least.

Do you have happen to have a link?

I think this was it:

https://news.ycombinator.com/item?id=16771649

> Comcast will let anyone get your home address, name, last 4 digits of SSN with just your IP address!

IP address? Really?

Yes, really. Of course they are nice enough to support multiple methods of searching for accounts, so you aren’t restricted to just looking up by IP addresses.

That's not amenable to bulk, automated harvesting however, unless you've compromised their internal network.