Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t... by mushishi on Friday August 20, 2021 @03:59PM (#28250709)

How is it possible that some kind of imaginative script can be enough to get SMS sim swapped? Why aren't the operators requiring a strong identification via a passport or something like that? Maybe I'm really dumb but that just boggles my mind, whether or not there exist other types of alternatives to 2FA.

[ Parent | on HN ]

Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t... by Destitute on Friday August 20, 2021 @04:10PM (#28250840)

There's not much you can confirm over the phone, except the account PIN and sometimes security hint. But an attacker can pretend to have forgotten it and press that the matter is urgent. If the attacker knows enough about the person, they might be able to convince an agent to make the swap so the agent can:

1) Get on with their day to maybe hit a support request quota 2) Make sure this person doesn't give them a bad customer satisfaction score

[ Parent | on HN ]

Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t... by cinntaile on Friday August 20, 2021 @04:14PM (#28250879)

You could require verifying your identity using your electronic ID if you want to simswap by calling the helpdesk.

[ Parent | on HN ]

Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t... by jdavis703 on Friday August 20, 2021 @07:00PM (#28252352)

They could require this. Most of the big operators have physical stores where they could do an ID check. There should be an advanced protection mode where SIM swaps and other sensitive operations require physical authentication.

[ Parent | on HN ]

Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t... by mushishi on Saturday August 28, 2021 @11:33AM (#28338838)

Yes this, please!

[ Parent | on HN ]