So to make a long-story short, I'm looking for another wireless carrier, but I'm concerned about SIM-swapping attacks (I know, I shouldn't be using SMS-based 2FA, but many services fallback to it and don't allow this to be disabled).
So, which carriers offer some kind of protection against SIM swapping, ideally something more than a 4-digit PIN that's texted to you (looking at you Mint)? During my research, I found https://www.efani.com/, but this seems like overkill for a non-high profile person.
I'm based in the US.
Thanks in advance.
https://www.t-mobile.com/support/plans-features/account-take...
The document reveals that SIM card changes will now require either SMS verification from the customer or the credentials of two employees.
Unfortunately, most SIM swapping gangs these days are using stolen carrier credentials.
Store employees do not ask for the security pin or password on the account, even if it's notated that they should be asked for every time. Pretty much any account security notes like "Please email this address to request authorization for any account changes" get ignored by store reps.
T-Mobile's fraud team will tell you to file a police report about the incident, then they will ghost the police department and provide no details about what occurred, who was involved, where it happened and such. Without a subpoena you are SOL, about the only action you can take is filing a small claims court case against them and subpoenaing T-Mobile in the process. They do freak out when you send a friend to show up in Bellevue to serve the notice of said court case and the subpoena, but it's the only way to get them to acknowledge what happened and provide details so you can mitigate the compromise that occurred.
In fact I replace it every 90 days with a new one bought for cash (Mint prepaid) with a new number.
For example, I cannot simply switch to a new water utility provider without moving out of the region. Someone’s mortgage could get sold to another bank with terrible security.
This is wholly impractical advice.
If they literally cannot function without a number, why do they need the phone number of the SIM you carry?
I have a phone with a SIM and cheap plan just for accounts associated with the building I sleep in. (Doordash et al would never get my address and any of my normal identifiers (email, phone, payment cards, etc) on the same records.) I call it the “house phone”.
Good for you but that is not practical advice.
Every carrier ultimately delegates access to store and call center staff that can remove any PIN, witches curse, or anything else they offer to add to your account. MVNOs are effectively riding on the same networks and if you phish a high enough level support person at the parent carrier they can be swapped as well.
https://9to5google.com/2023/01/31/google-fi-customer-hack-st...
T-Mobile is still the weakest link here. Google Fi appears to be just as vulnerable to a SIM swap attack as seen in that article.
My reasoning is that it would not be trivial to guess the phone number from my account/name, and to guess my name from phone number (unless someone hacks into the bank's db, in which I'm in troubles anyways). Furthermore if someone was able to figure out that link, it would not be trivial to do SIM swap on Google Voice, it would not be trivial to attack the Google Voice app. Two or three stars have to line up for someone to sim-swap that GV number.
But some stupid bank go further to ban GV numbers. In which case I just don't bank with them.
Zelle, ACH, international wires, credit products like credit cards, home loans, personal loans, auto loans and such are all available through many credit unions, and they also reimburse ATM fees, often offer higher savings and checking account interest rates, and if your credit is poor or downright awful, they will often lend to you at a low interest rate when no bank or credit card provider would do so.
By the way, for anyone in my situation who wants to stay with Fi but not be signed in to a Google Account on their device, https://www.reddit.com/r/GoogleFi/comments/xzqd6v/what_does_... may be interesting.
One issue I see is getting deprioritized by not being a direct Verizon customer. I’ve had issues in small towns before due to this.
Second, high speed data is free globally roaming but is texting also? It says texting to 200 countries free but it implies from North America.
Safety Procedures Our security protocols use an 11-layer proprietary verification process, and no hacking attempt has ever passed beyond the third step: Any major change must be approved by multiple staff members and run through a rigorous manual process, including a notarized statement. A SIM swap can only go ahead after a 14-day cooling off period.
Meanwhile, Verizon has only kind of figured out VoLTE (and still has inbound call delivery issues) and is the most heavily loaded, slowest network in the US.
Most of these issues are area dependent, but there is a reason why AT&T held off for so long when offering their new internet air product for 5G home internet, and why Verizon is so hesitant to add network load with their home internet product, hence both of them being very selective of what address is qualify for this service.
So if you could find one that offered that, your best bet would be a landline + PIC freeze.
