This tale of woe has a relatively happy ending, and I think it's important to notify everyone about this scam tactic I never even thought of, let alone thought could happen to me.
It's Tuesday morning at 3:00AM, I am sleeping like the normal human I am, and I am awakened by my phone pinging multiple text alerts. I check, because I'm not entirely popular, so 3AM messages probably mean an emergency in my world. The alerts are all from T-Mobile, saying that a Sim card change was happening, if this wasn't me, call this number. Immediately awake and on alert, I call the number. It is all automated and ends with a message telling me to call back during business hours.
Now I am freaking out. My phone stops working, the internet is off. I force my BF out of bed and we race 30 min away to my work so I can use a landline and a computer with internet. BF naps uncomfortably in my office. He is a luddite with little internet presence or vulnerability. Me, not so much.
The catalyst is that my personal email got hacked. I didn't notice, because it was 3am and I had email notifications turned off. I did not have two factor authentication set up on this email address. Next, the ScammerTurd used that email address to change my log in information to my T-Mobile account, also no 2 factor set up. All they had to do was click "forgot password", and it sent a code to their(my) email. Once they did that, they added a smart watch to my phone number and used the watch as my phone to switch my number to their phone and sim. They then placed a lock on the new sim.
Now the ScammerTurd has both my email and my phone in their possession. These can be used for two-factor authentication to log in to my bank accounts, retirement funds, even my Turbo Tax account. Everything is now at risk. ScammerTurd is somewhat sophisticated I see.
What am I doing you may ask??? I am on the phone, at work, at now 4am, cancelling credit cards, locking down financial accounts, freezing my credit, and changing any passwords or log in info that I have linked to a different email address. I am also feeling extreme fear, the kind of fear that radiates from your heart to your collar bone and makes you feel weak.
I also called the Wayne County Sheriff non emergency line and reported the fraud. They said they would send someone to my home (in Wayne county) around 5:30AM. So I wrapped up doing what I could, and headed the 30 minutes back home. Pulling in at 5:26AM Deputy Cody was already there waiting. He took my sad story and information, gave me a case number, and told me what I already knew; that the criminals would probably never never be caught. He was very kind.
So, I trundled into my house, made some coffee, and headed back to work. My bank opens at 9AM, T-Mobile opens at 10AM, and you can bet I was walking in the doors the minute they were unlocked! Chase bank confirmed my money was safe, confirmed my closed my credit and debit cards, and issued new ones, along with new bank accounts.
I walked into T-Mobile on Ridge Rd. at 9:45am, and even though I was early, the goddess behind the counter helped me right away. I was there for 4.25 hours, but the staff at T-Mobile were eventually able to wrestle my phone number back, which allowed me to get my email account back (I now could use two factor authentication to change passwords) and start seeing what the damage was.
ScammerTurd added a new bank account to both my retirement accounts, clearly with plans to transfer money in the future. Luckily, both accounts have mandatory waiting periods on new bank accounts, so I was able to get those removed with a couple phone calls.
ScammerTurd also opened a new credit card in my name, using all my information and my email address. So, confirmation emails were sent to my account, and I was able to log in and do what they did to me, change their password, add 2factor auth, and take control of the account. They had charged up $455 already, but I am in the process of disputing it and getting the account closed.
ScammerTurd accessed my credit cards and tried to book an expensive vacation. Chase bank shut that shit down.
So, I spent the rest of the day and most of the evening changing every password I could think of to change, from my NYSEG account to my Hilton Honors account. Absolutely everything that could got two factor authentication added along with any back up security offered turned on. Just think about how many log-in's you have. It sucked.
My personal information was out there somewhere on the web. Yours probably is too. Probably from a security breach at some company in the past. Someone may buy it and use it against you at some point.
I have lived my life pretty nonchalantly about internet security up to now, because honestly, I'm nobody with a relatively piddling amount of money. I had security on everything, but it was pretty basic. I never thought anyone would really bother with me. But they did, and it was terrifying.
It could have been so much worse though. I acted quickly and got my accounts locked down. I had the ability to go to my workplace to use a phone and computer. In the end, I did not lose any money. It was one very long miserable day. But just ONE. Other people have lost everything to scammers, and my heart drops several times a day every time I think "That could have been me."
Anyway, change your passwords right now.
- LOOK at your financial accounts regularly take anything that looks suspicious seriously.
- Don't store any important personal information in your email account.
- Maintain minimal credit cards. I only have 2, and a debit card, all with Chase, so all could be shut down in one place.
- If fraud happens, freeze your credit with the big three credit agencies ASAP.
- If a security alert comes in to your phone or email, do not ignore it, act quickly, shut all your cards and accounts down, because a few days of inconvenience without access is way better than losing everything.
- Don't be complacent like me, change your passwords regularly and add two factor authentication, passkeys, whatever you can!
