(credit: GotCredit)
In a scenario that's growing increasingly common, the chief technologist of the US Federal Trade Commission recently lost control of her smartphone after someone posing as her walked into a mobile phone store and hijacked her number.
Details of the incident were provided by the FTC's Lorrie Cranor in a blog post published Tuesday morning with the headline "Your mobile phone account could be hijacked by an identity thief." In it, Cranor wrote:
A few weeks ago an unknown person walked into a mobile phone store, claimed to be me, asked to upgrade my mobile phones, and walked out with two brand new iPhones assigned to my telephone numbers. My phones immediately stopped receiving calls, and I was left with a large bill and the anxiety and fear of financial injury that spring from identity theft. This post describes my experiences as a victim of ID theft, explains the growing problem of phone account hijacking, and suggests ways consumers and mobile phone carriers can help combat these scams.
My Experiences as a Victim of ID Theft
One evening my mobile phone stopped working mid call. After discovering that another phone on my account also had no signal, I called my mobile carrier on a landline phone. The customer service representative explained that my account had been updated to include new iPhones, and in the process the SIM cards in my Android phones had been deactivated. She assumed it was a mistake, and told me to take my phones to one of my mobile carrier’s retail stores.
The store replaced my SIM cards and got my phones working again. A store employee explained that a thief claiming to be me had gone into a phone store and “upgraded” my two phones to the most expensive iPhone models available and transferred my phone numbers to the new iPhones.
I called my mobile carrier’s fraud department and reported what happened. The representative agreed to remove the charges, but blamed the theft on me. When I asked how the store authenticated the thief, he told me that employees of stores owned by the mobile carrier would have asked for the account holder’s photo ID and the last four digits of their social security number, but if the theft occurred at another retailer, that might not have happened.
I logged in to my online account, changed the password, and added an extra security PIN recommended by the fraud department. I then logged on to the Federal Trade Commission’s identitytheft.gov website to report the theft and learn how to protect myself. Identitytheft.gov is a one-stop resource for identity theft victims. It includes step-by-step instructions and sample letters to guide victims through the recovery process. Following the Identitytheft.gov checklist, I placed a fraud alert and obtained a free credit report. I also prepared an identity theft complaint affidavit, which I later printed and took with me to my local police station when I filed a police report.
The FTC chief technologist went on to invoke federal law to force the unnamed carrier to provide the paperwork filed by the identity thief who hijacked her account. Cranor discovered that the thief used a fake ID that showed Cranor's name and the thief's photo. The thief acquired the iPhones at a retail store in Ohio hundreds of miles from Cranor's home and charged them to Cranor's account on an installment plan.