AT&T rolls out Wireless Account Lock protection to curb the Sim-swap scourge
- Thread starter JournalBot
- Start date
These criminals are really clever. One wonders what they could accomplish if they devoted their minds to constructive things.
Upvote
38
(39
/
-1)
RickRoyLeonPrisZhoraRacha
Ars Scholae Palatinae
AT&T or the sim swappers? Because ATT got breached (again) and now you better have your credit freeze on.
Upvote
77
(79
/
-2)
Given their proclivities, I'd guess chaos and disorder. Those who don't play by the rules are breaking them, after all.
Psychopaths be that way.
Upvote
19
(20
/
-1)
Someone successfully SIM swapped my T-Mobile iPad line a few years ago, to what end I have no idea. I couldn't have told you the phone number if you put a gun to my head.
It seemed like a wild shot in the dark that they were targeting a bitcoin high roller and not a child's Apple Watch or a MDM modem that reports the level of the toilet tank on a train.
It seemed like a wild shot in the dark that they were targeting a bitcoin high roller and not a child's Apple Watch or a MDM modem that reports the level of the toilet tank on a train.
Upvote
38
(38
/
0)
ColdWetDog
Ars Legatus Legionis
Huh. Don't see it in the app. Maybe they'll update it later. Or, given it's AT&T, maybe not.
Upvote
18
(18
/
0)
If it's irrevocably locked unless using the app on the device, how do they handle lost / stolen devices? The AT&T site didn't say.
Upvote
82
(82
/
0)
So if someone hacks into your at&t app, then it's useless (if I understand correctly)? There probably should be some other form of protection in addition considering how frequently account credentials wind up on the dark web.
Upvote
12
(12
/
0)
Genuine question: is there any way to avoid it as an end user? I have been under the impression that the other party (the account provider) needs to implement an alternative, more secure scheme, and that's only gonna be a handful of nerd-friendly services.
Upvote
57
(57
/
0)
Right, it's up to the service/account provider. I once had an account compromised because my bank turned on SMS "MFA", didn't tell me, and did it in such a way that you could get access to the account purely through SMS (you could reset both the password and pin using just a code sent through SMS). I think there wasn't any way to disable it either. So if anybody was able to gain access to my texts, they could get into my bank account, and there was nothing I could do about it except switch banks (which I did).
It's frustrating, for sure.
Upvote
61
(61
/
0)
There's no way to avoid it without the providers implementing it. That said, Apple and Google both provide authentication services that are worlds-better than SMS (by using their own encrypted IM solution or using account-based 2FA or by using Passkeys). They provide APIs that are freely available for providers to implement. But as long as SMS exists, providers already using it for 2FA will continue to do so.
Upvote
27
(29
/
-2)
Once again they only offer this to post-paid subscribers. Prepaid folks are left behind again. 
Upvote
17
(22
/
-5)
How does this work when you get a new phone? Or if your old one breaks or is stolen/lost? How do you turn this off, in order to move to a new device, and then turn it back on, if you don't have access to a device?
Upvote
32
(32
/
0)
My question exactly. At a minimum it seems like you'd want to be able to approve from multiple devices before enabling it. Unless there's a backdoor that employees can use to override...which seems like it would sort of defeat the purpose?
Upvote
25
(25
/
0)
SMS is not a good MFA. These wouldn’t be targets if dumb ass companies weren’t using texts as 2FA. (Unless you’re a celebrity/royal the paparazzi are trying to get dirt on.)
I don’t have a single bank or investment account that offers anything useful. I think Fidelity has a weird hardware token that is only from one company and it sucks. I keep asking them to let me use Yubikey type devices and TOTP but it’s like pissing into the wind.
I don’t have a single bank or investment account that offers anything useful. I think Fidelity has a weird hardware token that is only from one company and it sucks. I keep asking them to let me use Yubikey type devices and TOTP but it’s like pissing into the wind.
Upvote
29
(29
/
0)
There is a “show your government issued ID in store” recovery process. (This was mentioned during the in-app activation, it doesn’t seem to be in the help documentation.)
It’s unclear whether that process involves additional verification steps with a small set of authorized employees that can deactivate it.
Last edited:
Upvote
37
(37
/
0)
Just to be clearer than the article, at the moment, you HAVE to have the AT&T app on your phone to turn this on. You can NOT do it from their website and, well, I'm not installing their app.
Upvote
34
(34
/
0)
AT&T Prepaid accounts can use Wireless Account Lock. The instructions are on a separate tab of the same help page: https://www.att.com/support/article/wireless/000102016/Once again they only offer this to post-paid subscribers. Prepaid folks are left behind again.
Upvote
25
(25
/
0)
It's on your account, not your device. Granted, not having your device makes it harder to access the app, but that's not the only way to access the app. Any other android/iOS device would be able to access it.
I would hope you could access it via their website as well, but it only mentions the app here.
Upvote
7
(8
/
-1)
It's there. On the mattress app (not active armor). At the bottom of the home page.
Upvote
6
(6
/
0)
Upvote
-4
(10
/
-14)
I'm curious if this will actually work. Consumer-facing logins often have pretty weak recovery mechanisms because people lose their credentials all the time and it's bad for business, outside of niche paranoid markets, to just tell people too bad, so sad, we weren't joking when we said only you had the decryption key.
If your fundamental problem is that you basically don't verify your customers to any acceptable level; it seems like a real possibility that they are just turning this into a "pretend to be a confused user until they give you access to the lock/unlock switch; then SIM swap" process.
If your fundamental problem is that you basically don't verify your customers to any acceptable level; it seems like a real possibility that they are just turning this into a "pretend to be a confused user until they give you access to the lock/unlock switch; then SIM swap" process.
Upvote
15
(15
/
0)
Looking at link provided in another post:
https://www.att.com/support/article/wireless/000102016/
"You can only turn Wireless Account Lock on or off using the myAT&T app. The app needs to be installed on a device that is active on your Wireless account. Download the myAT&T app now"
It has to be on the app, of another wireless device already connected to that wireless account. IOW you need multiple devices on that account.
So it kind of sucks for people that only have one wireless device (like me).
So it's right back to convincing people you are who you say you are, to get things straightened out if the phone is lost/stolen.
Upvote
7
(7
/
0)
Perhaps those of us with only a single line aren't really the types of customers that AT&T wants.
(In fairness, I'm on a family plan, so I assume I could probably have one or more other family members install the app to approve changes, assuming they had the appropriate permissions.)
Upvote
3
(3
/
0)
USAA is the only bank I have that doesn't exclusively use SMS 2FA. But they have other issues. My "password" is a 4 digit number plus the 6 digit token I get from an app on my phone. If I disable 2FA, my password is a 4 digit number.
This covers 1 for-profit bank, 2 credit unions, 1 brokerage, 4 retirement accounts, and 1 college 529 account.
Upvote
21
(21
/
0)
I don't know if it was this exact circumstance, but Jack Rhysider had a guest on his podcast that explained, in detail, how this would be carried out - by one of the perpetrators. I think the episode of Darknet Diaries was called "Hot Swaps" or something similar.
It is a vile, but equally impressive operation. And this is just my memory (so, hazy) and very high level:
The guest said this only worked at T-Mobile when they were doing it. You had a driver, another guy in a remote location with as many browser tabs open as possible to bank / crypto sites with the user's name and password ready (oh yeah, you already had to know their login credentials), a person being a "reader", and a fourth person as the "runner".
The "Runner" would go into a t-mobile store and talk with the sales guy until they saw them open up an "admin" area or something on the device (basically allowing the employee to port a number to a new device). He would then grab it and run to the car, and the "Driver" speeds off. The clock is ticking.
They have about 10 minutes before t-mobile IT will block out the employee's now stolen pad from their network and undo everything that follows. The "runner" will port the intended victim's number to a device they have in the car (the SIM swap is now done).
The "hacker" (the remote guy with the tabs open) will now start logging into as many sites as possible and the MFA is allowed (SMS only of course, relayed by the "reader") using the swapped phone. Once in, the account password is changed and the hacker moves on to the next site. Rinse, repeat. Again, they would have only around 10 minutes in total.
I highly recommend listening to the podcast episode if you haven't already.
Last edited:
Upvote
22
(22
/
0)
Hey, I know you’ve only been here 23 years, but did you know Ars articles are typically condensed versions of information, and they almost always provide links to the source material for further reading?
Upvote
6
(13
/
-7)
Once again they only offer this to post-paid subscribers. Prepaid folks are left behind again.
Or if, like me, you have an ancient prepaid plan from the candy-bar phone era,[1] the app is useless to you. Do this instead:
- Sign in at https://paygonline.com (yes, there's an "o" missing
). - Click on Profile & Settings.
- Click on Account Info & Preferences.
- Scroll down to Wireless Account Lock.
- Click Turn On.
They'll send a six-digit PIN to your phone (yes, by SMS
). Enter this into the web site, and you're locked.The app is clearly not required here, so the security seems to rely on (1) my paygonline.com login and (2) the PIN. Whether this is protecting me from social engineering attacks on AT&T support reps, I have no idea.
[1] You can use it with a smartphone for voice; you just need a separate data plan.
Upvote
7
(7
/
0)
That's probably as good as they can do; but forging govt ID is possible (and almost certainly at a better quality level than a fake ID to get booze), and to pwn a crypto whales account definitely worth doing.
The real problem is that SMS 2FA should not be enabled for crypto (or really anything financial). The bare minimum should be an authenticator app; and for people with large accounts a dedicated stand alone key device.
Edit: On second thought, a fakeID probably doesn't even need to be as good as the ones used to buy booze. Penalties in the US for selling to kids are business ending high; almost all bars/etc take them very seriously. Short of regulations that make the phone company liable for megabuck losses suffered due to sim swapping attacks I doubt the average phone sales clerk is going to be nearly as diligent.
Last edited:
Upvote
12
(12
/
0)
Our govt issued ID has biometric authentication built in when used for these types of transactions. Is the US that far behind?
Upvote
1
(2
/
-1)
Because of the dual "conservative" pillars of wanna-be Libertarians and premillennialist Religious Zealots, Republicans hate and I mean loathe the idea of any kind of "National ID" right up until you mention the word "immigrants." So we've never had truly national IDs.
Upvote
12
(14
/
-2)
Except in cases where it might aid in voter suppression
Upvote
8
(9
/
-1)
Fidelity enabled support for Google Authenticator/etc MFA last year. Still no Yubikey, tho. I worked with a bank that used RSA keys some years ago - but they phased them out for SMS. Sigh.
Upvote
6
(6
/
0)
Fidelity doesn't support just any TOTP but they do support Symantec VIP. I've been using it on my Fidelity account for more than a year.
Upvote
5
(5
/
0)
AT&T Prepaid users have the toggle in the paygonline.com’s Account Settings. Just flipped it on.
Upvote
-1
(0
/
-1)
I'm still surprised and a bit depressed by how few providers support anything other than SMS.
Here in the UK, PayPal, Amex, the UK government tax service, and a few financial providers I use let you use a proper MFA authenticator app but so many still just send text messages. Own the phone number, own the account.
Here in the UK, PayPal, Amex, the UK government tax service, and a few financial providers I use let you use a proper MFA authenticator app but so many still just send text messages. Own the phone number, own the account.
Upvote
3
(3
/
0)