article thumbnail

Two Charged in SIM Swapping, Vishing Scams

Krebs on Security

Two young men from the eastern United States have been hit with identity theft and conspiracy charges for allegedly stealing bitcoin and social media accounts by tricking employees at wireless phone companies into giving away credentials needed to remotely access and modify customer account information. Prosecutors say Jordan K.

Scams 354
article thumbnail

Recycle Your Phone, Sure, But Maybe Not Your Number

Krebs on Security

New research shows how fraudsters can abuse wireless provider websites to identify available, recycled mobile numbers that allow password resets at a range of email providers and financial services online.

Mobile 360
Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Why Your VPN May Not Be As Secure As It Claims

Krebs on Security

.” The researchers say their methods could be used by an attacker who compromises a DHCP server or wireless access point, or by a rogue network administrator who owns the infrastructure themselves and maliciously configures it. ANALYSIS Bill Woodcock is executive director at Packet Clearing House , a nonprofit based in San Francisco.

VPN 330
article thumbnail

How 1-Time Passcodes Became a Corporate Liability

Krebs on Security

This phishing gang apparently had great success targeting employees of all the major mobile wireless providers, but most especially T-Mobile. Between July 10 and July 16, dozens of T-Mobile employees fell for the phishing messages and provided their remote access credentials.

Mobile 339
article thumbnail

The Life Cycle of a Breached Database

Krebs on Security

Nixon said she and her colleagues noticed in the preceding months a huge uptick in SIM-swapping attacks , a scheme in which fraudsters trick or bribe employees at wireless phone companies into redirecting the target’s text messages and phone calls to a device they control.

Passwords 363
article thumbnail

The Rise of One-Time Password Interception Bots

Krebs on Security

A simple slash command allows a user to enable various ‘modes’ — scripts aimed as various services — that can target specific banks, as well as PayPal, Apple Pay, Google Pay, or a wireless carrier.

Passwords 342
article thumbnail

How to Shop Online Like a Security Pro

Krebs on Security

This might involve making sure that new or old PC has up-to-date security software and the requisite software patches, or locking down their wireless router by enabling security features and disabling risky ones. Postal Service , or their wireless phone provider and/or Internet Service Provider (ISP).

Scams 279