Account Takeover via Carrier Chat

Mobile carrier customer-service representatives have the ability to make significant changes to customer accounts: swapping SIM cards, updating account details, resetting PINs, enabling call forwarding, and adding or removing services. Fraudsters exploit this by contacting customer service posing as the account holder, armed with personal data gathered from data breaches, social media, or prior reconnaissance.

Carriers have tightened verification processes after high-profile SIM swap cases, but social engineering remains effective against staff who accept easily obtainable information such as date of birth and billing address. Some attackers make multiple attempts across different channels — phone, chat, retail store — until they find a representative who accepts their credentials. Weekend and overnight shifts are specifically targeted when supervision is lower.

Consumers should set a strong, non-obvious SIM PIN or account passcode with their carrier, ask their carrier to add a 'port freeze' or extra-verification flag to their account, and never publicise their carrier, phone model, or account details on social media. If you receive an unexpected account-change notification, call back on the number on your bill immediately.