>Cell provider then ports the phone identity over to a new number

Do you mean port the phone number to a new SIM? Because the SMS 2FA will go to the old number. Porting it to a new number won't do anything.

I did, thank you. Correcting the original post now.

Doesn't that mean they also need access to your email account?

What good is a SIM-swap to defeat 2FA if you don't have the password in the first place?

I just checked Snapchat's "I forgot my password" and there were two options -> Phone Number or Email Address. So there you go.

At least with some companies, they use the phone number to let you reset the password.

Ok sure, but how do you get the person's phone number in the first place?

There are hundreds of data brokers selling this type of info. An attacker who has a few minutes and a few dollars to spare will be able to acquire the average person's phone number. The underlying sources vary a lot.

Look up your own name or your friends on a site that is owned by or uses Intelius data, e.g. https://www.addresses.com/ - For many people (not all), their phone numbers come up right away.

Maybe I just have better data hygiene than average, but I found that site to be absolutely hilarious. I was able to find myself, but my address was several years and several moves out of date. My phone number was decades out of date and not even really my phone number. (It was a landline phone at my mom's house, with an old pre-area code split area code.)

Now try familytreenow.com for free or spokeo.com if you want to waste a dollar on a trial.

Pretty sure they won't be wrong or out of date.

The first one is indeed much closer for me. Still doesn't have my current phone number and while the broad strokes are there the dates are wildly inaccurate. Looking at my immediate family though, I actually seem to have the worst hygiene! It's 0/5 in providing an accurate phone number for any of us.

It's cause this info is consolidated from so many different databases, but it's out there. Some of the paid ones are scarily accurate.

One of those data breaches we hear about all the time

If you can do that with social media accounts then I am sure private corporate logins must have also been breached hand over fist.

This is why everyone keeps saying SMS 2FA is bad.

Yes and Yes, if corporate logins are using SMS based 2FA, which they absolutely shouldn't be.

You normally do password reset over email, not SMS right?

Is this how new brands get usernames that would otherwise seem to be claimed long ago?

So, "Zo" for Lonzo Ball (NBA) has a user ID number of 243,382,891 (profilePage_243382891).

"OBJ" for Odell Beckham Junior (NFL) has a user ID number of 309,853 (profilePage_309853).

"Abby" for Abby Pollock (influecner) has a user ID number of 239,219,491 (profilePage_239219491).

"Kevin" for Kevin Systrom (IG founder) has a user ID number of 3 (profilePage_3).

Pretty sure FB/Meta will set you up in some capacity. Two of these are far too large to not have been squatted.

> https://www.codeofaninja.com/tools/find-instagram-user-id/

There are a couple [1][2] of good Darknet Diaries episodes on this topic as well:

[1] https://darknetdiaries.com/episode/97/

[2] https://darknetdiaries.com/episode/106/

Love how using a VoIP number would totally cancel out that attack, but so many websites require you to have a 'real' phone number. I assume its mostly to weed out scammers.

Yes and no. No, you can't buy a VoIP number and use it as your contact immediately and indefinitely. You would be amazed at how few companies update their list of VoIP vs POTS/Carrier numbers though. Hypothetically, one could transfer their carrier number to a VoIP provider, and use it for damn near everything. There would be trade-offs [0], of course, but I can attest to its effectiveness as a workaround.

[0] Trade-offs include a glitchy MMS experience, easy, automatic, and built-in call-recording, IVR capabilities to screen unknown callers, voicemail transcription, and the ability/requirement to use an email client as your SMS client. Though you then get to treat SMS and calls as device agnostic - desktop, laptop, tablet, and phone all send & recieve SMS and voice calls