PSA: All T-Mobile Users

EDIT: I am not the primary account holder for T-Mobile, although I am the only other Android phone on our account. I did not have 2FA set up on my Google Account at the time of the attack, and my gmail was not compromised in any way much less probed for a password. I do not know what the end goal of the hack was, especially since the main account number has their own google account, which 2FA on my phone would not have helped compromise.

I want to end the confusion around this fact. That being said, the conversation about Google 2FA is very important, and I'm glad it is taking place. But my Google Account (Or any other phone) on the T-Mobile plan was not endangered.

T-Mobile has still not fixed the major flaw in their security. Changing your account over the phone.

How I found out:

I received a text last night that my SIM card had been changed. As soon as I saw I didn’t have a data connection and couldn’t call anyone, I knew that the social engineering hack from at least six months ago had not been fixed. I called T-Mobile and talked to them, and the primary account holder and I went through and changed all of the passwords and fixed the weak point ourselves. We found a cheap LG phone connected to our account (With a local number), with a small amount of calling and texting on the phone. We removed the hacked phone from our account within the half hour.

How the Hack Works:

All you need to change your T-Mobile account over the phone is the Account Name, and the primary holder’s last four digits of their social security number. Then, all they have to do is call T-Mobile and say a phone was lost and that they need the SIM card activated in another phone. It’s scarily easy to accomplish.

From there, if they have your Gmail address, they can access your Google Account (And all the information within) if you have two factor identification on mobile turned on, because all texts will go to that new number.

How We Fixed It:

We updated our passwords to T-Mobile, and we added a password that is required before we make any changes over the phone. The password is stored on T-Mobile’s side of the account, so there is an extra step required for anyone to access our account.

If the attacker had used either of my younger siblings’ phones, we wouldn’t have been aware of the attack until today, when we would have been unable to do anything at that moment. I caught this and called within five minutes – the fastest customer support has heard of this being caught.

This social engineering trick has been around for at least six months to a year, and it has not been fixed by T-Mobile. This can be used to access your Google Account as well. I ask T-Mobile to fix this issue for good, and implement better security protocols over the phone. There needs to be a mandatory password for any changes made over the phone. The last four digits of your social security number is not private enough information.

I got lucky with the fact that my Google Account was not probed, and I forgot to turn on 2FA in the first place. Please update your security to prevent this attack in the future, especially when Google saves all your information to make it convenient for you to access.