Slashdot Mirror

← Back to Stories (view on slashdot.org)

Cops Accuse 20-Year-Old College Student of Stealing More Than $5 Million in Bitcoin by Hijacking Phone Numbers (vice.com)

Posted by msmash on from the security-woes dept.

California authorities say a 20-year-old college student hijacked more than 40 phone numbers to steal $5 million in Bitcoin, including some from cryptocurrency investors at a blockchain conference Consensus. Motherboard, which broke the story citing court documents: This is the first reported case of an alleged hacker who was using SIM swapping (also known as SIM hijacking or Port Out Scam) specifically to target people in the blockchain and cryptocurrency worlds.

Joel Ortiz was arrested at the Los Angeles International Airport on his way to Europe, according to sources close to the investigation, who said Ortiz was flashing a Gucci bag as part of a recent spending spree they believe was financed by the alleged crimes. He is facing 28 charges: 13 counts of identity theft, 13 counts of hacking, and two counts of grand theft, according to the complaint filed against him on the day before his arrest.

71 comments

  1. Phone company liability... by jholder · · Score: 2

    No doubt the phone companies whose processes were criminally negligent in allowing a person like this to engineer transfer of the number will also be brought to trial and punished.

    Ha ha ha. I crack myself up!

    --
    -- John
    1. Re:Phone company liability... by dissy · · Score: 5, Insightful

      No doubt the phone companies whose processes were criminally negligent in allowing a person like this to engineer transfer of the number will also be brought to trial and punished.

      Ha ha ha. I crack myself up!

      Something you may find even more hilarious, or sadly hilarious perhaps.

      When the company I work for was sold, our new parent company wanted to bring our phone system into their fold, and into their main account.
      At the very end of the transition we had a big conference call with everyone involved with the cut-over, myself as the POC here, the technical POC at HQ, one of the HQ phone company reps, and a couple people who specialize in Cisco VoIP in case anything went wrong.

      They asked me if I was ready for them to pull the trigger on porting our 100 DIDs (aka our outside phone numbers) over to their phone co, so I replied by asking if I should conference in our own phone company rep to authorize the port.

      Their reply: That won't be necessary, we will initiate it on our end.

      Over the next 10 minutes each number was moved (I assume they were doing each one by hand instead of scripted/automated) and said I should start verifying the ones on our critical list as still functional.
      From a technical stand point, all went well and worked.
      From a procedural stand point, what the fucking hell?!?

      No authorization, no informing our phone co this was happening, nothing in place to prevent it, and most disturbing, nothing from the phone co to me to even say it happened.

      I called them up after the conference call anyway to ensure service was terminated. I was told *that* part was automated!
      Once the numbers are ported off-network the current bill will be prorated for the rest of the month, the account closed at the end of the month, and that I'd be contacted within 30 days after termination to arrange for returning their CPE to them...

      This is all just SOP when it comes to porting numbers around.
      The only response they seem to have if done by mistake is to port the numbers back, after the fact, and presumably after any damage is done.

    2. Re:Phone company liability... by Yalius · · Score: 4, Informative

      Want to know what's worse?

      Per FCC regulations, your phone company can NOT initiate a confirmation contact once a port-out has been initiated. If the account #'s, names, and security information are correct in the port-out request initiated by the new phone company, the old provider has no legal authority to question or verify the legitimacy of the port-out request and must complete the port-out within 24 hours or show good reason it could not technically be completed. And they are not allowed to contact you for any reason regarding the number port.

    3. Re:Phone company liability... by bws111 · · Score: 3, Insightful

      That is the process that the FCC says must be followed. Customer contacts new carrier, new carrier contacts old carrier, old carrier may not refuse request, transfer must be completed by midnight the same day. If the old carrier required authorization from you that could result in them either refusing the transfer (not allowed) or failing to meet the transfer deadline.

      The idea is to make it easy for customers to switch carriers without being given the run-around, having to jump through hoops, or being given the hard sell from the old carrier. Of course, where there is convenience there is always the possibility of fraud.

    4. Re:Phone company liability... by Anonymous Coward · · Score: 0

      Some carriers will say the number has a "PIN" attached to it. Only the carrier knows the PIN, and they will fight tooth and nail to not tell you what it is.

    5. Re:Phone company liability... by JackieBrown · · Score: 2

      You know what's worse? We were cheering this portability change because we didn't want to be owned by our phone overlords.

      That said, I prefer this and the possibility of fraud. Honestly, let's say the old company had to confirm the phone number change. How well do you think that line would be staffed? How much money and resources do you really expect a company to provide to say farewell to business.

      Whenever I cancel a subscription, I usually get sent to a queue that feels like it must be manned by 3 people to cover the entire country. The goal - I'm sure - is to hope I get frustrated, hang up, and continue my subscription.

    6. Re:Phone company liability... by mjwx · · Score: 1

      No doubt the phone companies whose processes were criminally negligent in allowing a person like this to engineer transfer of the number will also be brought to trial and punished.

      Ha ha ha. I crack myself up!

      Good one... The next thing you'll be expecting is for phone companies to put in methods to prevent this kind of thing from happening in the future like an ID requirement for picking up SIM cards, a callback to the previous number to confirm or a MFA system.

      Erm... like they use in the ROTW.

      --
      Calling someone a "hater" only means you can not rationally rebut their argument.
    7. Re:Phone company liability... by Anonymous Coward · · Score: 0

      No doubt the phone companies whose processes were criminally negligent in allowing a person like this to engineer transfer of the number will also be brought to trial and punished.

      No. Phone companies never claimed a phone number should be used for security. I always refuse to link my account to a phone number, but some companies force me to. Phone numbers have never been secure. Companies using them for security are the ones who should be held responsible.

  2. I could use some filling-in by Kulahan · · Score: 1

    Is there even a point to stealing that much money? Like, a quarter bitcoin or whatever might be too small-time to be investigated, but stealing $5M? Wouldn't it be trackable to him pretty much the moment he purchased something with that money? (or, at the very least, after the purchase of anything that would need to be shipped to him?) I've never looked at cryptos, so I might be off in my understanding here.

    1. Re:I could use some filling-in by fadethepolice · · Score: 3, Interesting

      It's pretty easy to wash bitcoins. I'm thinking this person did not do that. Since they did not actually purchase the bitcoins, there is no tie to them on the blockchain. Send the bitcoins anonymous online converter and convert the bitcions to ethereum, I ran through the process once just to see how it worked, but can't remember the name of the service at the moment. They are out there though. They generate a temporary wallet then send the coins back to you on a wallet you provide, which you then never have to use again. Then convert the ethereum (or litecoin, whatever) to Monero. After that use a separate online converter to convert your Monero back to bitcoin. Transfer the bitcoins to a hardware wallet. At that point you have generally removed all blockchain connections. You want to do all of this on new virgin equipment and networks not connected to you in any way. I'm way more interested in how the bitcoins were obtained in the first place. How can you access a coinbase or similar account with someone's phone number?

    2. Re:I could use some filling-in by Anonymous Coward · · Score: 0

      Some 2FA is simply an SMS code to the phone to reset the pw.

    3. Re:I could use some filling-in by parkinglot777 · · Score: 2

      I'm way more interested in how the bitcoins were obtained in the first place. How can you access a coinbase or similar account with someone's phone number?

      Do you really want to know? You may read this blog about how he lost the control of his coinbase account due to the people in telecom company. 2FA doesn't help if the registered phone number to the account is changed.

  3. Wrong approach... by b0s0z0ku · · Score: 3, Interesting

    He should have run the scam from abroad and used the money to buy residence in a non-extradition country... In all seriousness: he used his own phone and expected not to be caught?

    Two more points:
    (1) $1 million bail is more than many murderers get. This shows the priorities of the state -- fortunes of tech squillionaires are worth more than human lives.
    (2) The phone companies that apparently make SIMs stupidly easy to port-out should share the blame.

    1. Re:Wrong approach... by Anonymous Coward · · Score: 0

      (3) The idiots that have cell phones that use SIMs should share the blame.
      (4) Dipshits that have krypto kurrency deserve what they get.

    2. Re:Wrong approach... by b0s0z0ku · · Score: 1

      Even non-SIM phones can be ported out. Instead of activating a new SIM on the account and putting it in a phone, a "social engineering" hacker can get an entirely new phone with IMEI activated on the account. Same result.

      Then again, non-SIM phones are a dying breed in the US. Even "CDMA" carriers like Verizon have moved to SIMs on 4G devices.

    3. Re:Wrong approach... by Anonymous Coward · · Score: 0

      (1) $1 million bail is more than many murderers get. This shows the priorities of the state --

      No, it doesn't.

      The high bail is due to the extreme flight risk posed.

      Next time, try keeping your hands away from your keyboard when the subject is something you know nothing about.

    4. Re:Wrong approach... by b0s0z0ku · · Score: 1

      Yes it does -- rich techbros get the best "justice" money can buy.

      Murderers can face a death sentence in California, so don't argue about flight risk.

    5. Re:Wrong approach... by JackieBrown · · Score: 1

      No, the person you responded to is correct. Bail cost is set based on flight risk and severity of crime. This person was caught while attempting to leave the country. He also has disposable IDs.

      The death sentence in California is not a real concern. The last person the state of California officially put to death was over 10 years ago.

      https://deathpenaltyinfo.org/n...

    6. Re:Wrong approach... by Chryana · · Score: 1

      I think this type of crime will become much more difficult very soon. I mean, at least 40 phone numbers were bound to the same IMEI! To me, this is clearly a sign of criminal activity. The phone company should have tipped the cops way before that. Anybody considering this type of theft will eventually have no choice but to get a new phone for every 4 or 5 numbers stolen.

    7. Re:Wrong approach... by b0s0z0ku · · Score: 1

      If they can port the numbers out, can't they port them to some cut-rate VoIP provider that supports SMS/texts?

    8. Re:Wrong approach... by piers_downunder · · Score: 1

      Why should the bail limit always be correlated to the severity of the crime? It's meant to be a financial disincentive for skipping out on the trial. Ideally it should be a significant portion of the proceeds of the crime, especially if it's possible he'd done this more times than authorities know about.

    9. Re:Wrong approach... by The+Grassy+Knoll · · Score: 1

      The last person the state of California officially put to death was over 10 years ago.

      Over 10 years ago? How civilized!

      --
      They will never know the simple pleasure of a monkey knife fight
    10. Re:Wrong approach... by JackieBrown · · Score: 1

      I think you missed the point of the post I was replying to

    11. Re:Wrong approach... by mjwx · · Score: 1

      He should have run the scam from abroad and used the money to buy residence in a non-extradition country... In all seriousness: he used his own phone and expected not to be caught?

      Two more points:
      (1) $1 million bail is more than many murderers get. This shows the priorities of the state -- fortunes of tech squillionaires are worth more than human lives.
      (2) The phone companies that apparently make SIMs stupidly easy to port-out should share the blame.

      As to #1, firstly, bail is mostly based on flight risk, so someone who is not likely to flee or does not have the means to flee is given a lower bail. Secondly, any murderer who is believed likely to re-offend is not granted bail. So for a million bucks bond, the state doesn't have to pay to feed and house this miscreant, seems smart to me.

      --
      Calling someone a "hater" only means you can not rationally rebut their argument.
  4. SIM Lock by nuckfuts · · Score: 2

    After domain names started to be worth big money, registrars came up with an added protection against people stealing your domain registration. IIRC they call this "Domain Lock, or "Registrar Lock" or something like that. So perhaps cellular service providers need to implement some form of "SIM Lock".

    1. Re:SIM Lock by b0s0z0ku · · Score: 3, Insightful

      No. It should be implemented by default. Having people pay for security that should always be present is essentially extortion.

    2. Re:SIM Lock by Megol · · Score: 1

      And with the same quality reasoning: forcing everyone to pay for security most don't need - isn't that filthy socialism?

    3. Re:SIM Lock by Anonymous Coward · · Score: 0

      And with the same quality reasoning: forcing everyone to pay for security most don't need - isn't that filthy socialism?

      No, that's Capitalism ... or extortion. It's a fine line.

    4. Re:SIM Lock by Srin+Tuar · · Score: 1

      > Having people pay for security that should always be present is essentially extortion.

      Why? That doesnt do much in the big picture.

      How about: never treat control of a phone number as a security factor?

      There are so many good ways to do second factor auth; a legacy phone line account should never be a part of the mix.

  5. he was clever enough to do this by cats-paw · · Score: 1

    but not clever enough to avoid getting caught.

    wouldn't you just be paranoid as all hell if you had done something like this ?

    flashing a gucci bag ? wtf ?

    --
    Absolute statements are never true
    1. Re:he was clever enough to do this by bobbied · · Score: 1

      You got to admit it's the dumb criminals that get caught. My brother in law, who is a local cop, can tell you a lot of stories about how stupid they usually are. Like stealing a pile of stuff from somebody's garage then heading to the local pawn broker, using their real names and ID's to sell it, the same day and standing there while the broker calls the police...

      But this guy was smart enough to steal it, You'd think that after amassing all this currency he would have laundered it though a couple of crypto currencies using multiple exchanges or something to hide the facts and make it untraceable...

      --
      "File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
    2. Re:he was clever enough to do this by Anonymous Coward · · Score: 0

      He probably imagined that he was a genius, and that normal people could not catch him.

    3. Re:he was clever enough to do this by Nidi62 · · Score: 1

      But this guy was smart enough to steal it, You'd think that after amassing all this currency he would have laundered it though a couple of crypto currencies using multiple exchanges or something to hide the facts and make it untraceable...

      He knows better than anyone how unsafe it is to keep your money in cryptocurrencies. The last thing you want is for someone to steal your hard earned stolen money.

      --
      The only thing necessary for evil to triumph is for it to be pitted against a slightly greater evil
    4. Re:he was clever enough to do this by Anonymous Coward · · Score: 0

      I think that he was clever enough for the scheme; but was hit by the sudden wealth syndrome.

      There is a reason college kids or people from the sticks that suddenly turned pro football players are partnered with some manager/accountant who makes sure their new star starts spending his million-dollar signing bonus wisely -- instead of blowing it all on hookers and a Ferrari on his first night out.

      This guy had no such income before and decided to treat himself to one thing that was impossible for his previous self to buy -- which could have been the third thing he saw behind a glass window. For the meantime, he was that millionaire playboy-gangsta that he had only read about till then.

    5. Re:he was clever enough to do this by Anonymous Coward · · Score: 0

      Laundering crypto wouldn't have done him any good. The cops identified him using by his phone's IMEI number, which was logged by the phone company the instant he hijacked the victim's number. The IMEI number was used to find his personal GMail account.

    6. Re: he was clever enough to do this by Anonymous Coward · · Score: 0

      Since when there is any tie between a gmail account and the imei of a phone?!?

    7. Re:he was clever enough to do this by Anonymous Coward · · Score: 0

      D&D was onto something when they made intelligence and wisdom two separate stats. Prime example right here.

    8. Re:he was clever enough to do this by datavirtue · · Score: 1

      The check cashing companies are starting to buy stuff from people straight up...this will eliminate the pawn vector so that dumb criminals stop getting caught.

      --
      I object to power without constructive purpose. --Spock
    9. Re: he was clever enough to do this by datavirtue · · Score: 1

      Bend over peasant...they have all of your account numbers and Google is a real bitch who hops up and down like a puppy as they hand over your info to law enforcement.

      --
      I object to power without constructive purpose. --Spock
    10. Re:he was clever enough to do this by bobbied · · Score: 1

      I have a friend who owns a check cashing business that I do IT work for pro-bono.. I can assure you that he's very careful about what checks he is cashing and for whom he's cashing them. He has a number of fake checks in his hands that the person trying to cash it left when they figured out that they where not getting it back w/o having a conversation with the police. It's kind of obvious too, when they bail like that.

      Also, he doesn't buy stuff or deal with crypto currencies at all. He's more concerned about getting the checks to clear and getting his money and too busy to try and get rid of a bunch of goods on E-Bay or something..

      However.... He does do a lot of money orders and western union transfers.... I wonder if there is a market for doing crypto currency conversions.. Customer pays cash for crypto, you provide the customer a printed version of a Bitcoin wallet and they can do what they will with it... I'll have to look into this.

      --
      "File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
    11. Re:he was clever enough to do this by HornWumpus · · Score: 1

      What kind of moron does free work for someone running that kind of scammy, high profit, 'cheat the idiots', RTO type business?

      Next you'll tell me you volunteer for the Democrats...just fuck.

      --
      John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
    12. Re:he was clever enough to do this by bobbied · · Score: 1

      LOL.. I do pro-bono work for him because he cannot really afford to pay me and I cannot afford to get paid due to the paperwork my employer would require and the tax implications of having a side job. Besides, he is my friend.

      Also, he's actually providing a community service cashing checks and only collects 1-3% depending on the risk. If you cash checks there often from the same source with similar values, you get the preferred rate. If you show up the first time with a huge check you may walk away disappointed. He also has to eat bad checks that he cannot collect on, which costs time and money, so the risk he's taking and the costs he's paying justify what he charges.

      Finally, he doesn't really make a lot of money on this check cashing business. In reality he makes more selling money orders, lottery tickets, chips and beer...

      --
      "File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
    13. Re: he was clever enough to do this by Anonymous Coward · · Score: 0

      every android phone provides imei to google play services for "security" . not like that company make money by targeting ads or anything. (ironically, google play services is the component that serve ads for apps using google ads sdk)

  6. There's something ironic by rsilvergun · · Score: 1

    about getting in trouble with the law for stealing a currency used to buy drugs and launder money...

    --
    Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
    1. Re:There's something ironic by Anonymous Coward · · Score: 0

      There's something ironic about getting in trouble with the law for stealing a currency used to buy drugs and launder money...

      I too am surprised those are not among the list of charges, just to ensure a longer sentence. Or any sentence.

      He is facing 28 charges: 13 counts of identity theft, 13 counts of hacking, and two counts of grand theft, according to the complaint filed against him on the day before his arrest.

      So going by the results of the Equifax case, his punishment is a parting bonus and a new job, yes?

    2. Re:There's something ironic by Joe_Dragon · · Score: 1

      it's FPMIA prison for your unless you make a deal now!

    3. Re:There's something ironic by ArchieBunker · · Score: 1

      Nobody does those things with Bitcoin. That is why Monero was invented.

      --
      Only the State obtains its revenue by coercion. - Murray Rothbard
  7. and that is why the bitcoin exchanges banking laws by Joe_Dragon · · Score: 1

    and that is why the bitcoin exchanges need to be covered by banking laws. Now much info will they giveup? or will they hide over seas?

  8. ATT sim lock = free limited unlock $5-10/mo full $ by Joe_Dragon · · Score: 1

    ATT sim lock = free limited unlock $5-10/mo full unlock $20/mo

    limited unlock is needed to use a non ATT phone. Full unlock needed to use let you use 2th sim in phone or be able to unlock your att phone for other sims.

  9. Two factor authentication by jetkust · · Score: 1

    So basically this two factor authentication all these companies are trying to force on you is pretty much just a scam to get your phone number.

    1. Re:Two factor authentication by Anonymous Coward · · Score: 0

      Pretty much. It's bullshit.
      Why is it even possible to transfer your phone number to someone else just by calling those assholes up?

    2. Re:Two factor authentication by The+MAZZTer · · Score: 1

      Real 2FA does not require your phone number. SMS-based 2FA is known to be flawed and vulnerable to attacks like this. Real 2FA just needs ANY device, a mobile phone is just a good one since you'll usually have it with you and if your PC is infected your phone won't be. As long as this device has an accurate clock and has a way to do an initial sync with the server (usually by scanning a QR code and inputting a test 2FA code to ensure sync was successful), you're good.

  10. Re:and that is why the bitcoin exchanges banking l by bobbied · · Score: 2

    and that is why the bitcoin exchanges need to be covered by banking laws. Now much info will they giveup? or will they hide over seas?

    Sure they should... None... Yes.

    The issue with any of the crypto is also their strength, they are not centralized and are uncontrollable by law.

    So, if you dabble in crypto, it's like trading gold bullion in the wild west. Yea, you can buy *anything* you like with it, but if it gets stolen, it's gone. Smart money doesn't hold crypto online very long or use exchanges except when necessary, but you offline it ASAP. Just like you don't carry more bullion than you need for your trip and hide the rest.

    --
    "File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
  11. Re:and that is why the bitcoin exchanges banking l by Joe_Dragon · · Score: 1

    but when it's being used to buy drugs / hitmen the "banks" can be seen as accessory to crime

  12. Re:and that is why the bitcoin exchanges banking l by bobbied · · Score: 1

    The whole thing breaks down into a question of legal jurisdiction fairly quick. The uncentralized nature of crypto means that you can use a "bank" for the transaction that isn't legally part of the jurisdiction of where the crime is committed. So you can get accessary charges or conspiracy charges filed on entities which cannot be forced to appear and stand trial or pay fines. (Just ask Robert Mueller about how this works, most of the charges from that investigation are like this so far.)

    --
    "File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
  13. Phone Company "security"... LOL! by Locke2005 · · Score: 5, Interesting

    My housemate, who had land line phone service in his name, moved out. I called up the phone company, and told them I needed to put the phone in my name. They told me that for security reasons my ex housemate had to do that himself. So I asked them, "So, if I hang up and call you right back claiming to be him, you'll put the phone in my name?" There reply was, "Yes." I did, and they did.

    --
    I've abandoned my search for truth; now I'm just looking for some useful delusions.
    1. Re:Phone Company "security"... LOL! by Registered+Coward+v2 · · Score: 1

      My housemate, who had land line phone service in his name, moved out. I called up the phone company, and told them I needed to put the phone in my name. They told me that for security reasons my ex housemate had to do that himself. So I asked them, "So, if I hang up and call you right back claiming to be him, you'll put the phone in my name?" There reply was, "Yes." I did, and they did.

      Years ago when I worked for a large corporation I added my phone to their account. All it took was a call to say I work for X please put me on the corporate account and it was done. When I left and called to transfer it back I was told the "person in charge of phones at X" needs to call and do that. I asked who that was and they didn't know, and when I asked what happens if I just stop paying they said , no problem, X just pays. Since I wanted my number back I had a friend call and say they were the person in charge of phones and to transfer my account, which I was then able to do with no problems.

      A friend, who tried to cancel his dad's cable after he died, called the cable company. After the rep expressed condolences at his loss, took the account info, and then as the last step said they needed to talk to his dad to get his OK.

      --
      I'm a consultant - I convert gibberish into cash-flow.
  14. No phone hijacking with APKoin by Anonymous Coward · · Score: 0

    See Subject: APKoin is better than all other cyypto coin guarantee to not loose value

    Get APKoin by spreading the word of "LORD of HOSTS" to all conrners of teh internet

    Get APKoin by "Kick stomping heart" FAKE name slashdot l[users] who dare defy brilliant APK

    Redeemable for ultra premium moose dik you can suck or take in ass

    Premium rewards like suk my MEGA MAN PENIS or lick my gaint ballz

    APK

    P.S.=> The Soros and ROTHSCHILD backed jew bankers want to destroy CRYPTO COIN because it can derail their plans to enslave great american worker. Trump was the first major disruption to they plans APKoins is the next... apk

  15. As a Victim of This by Anonymous Coward · · Score: 0

    My case is a little different because it wasn't crypto that they stole/tried to steal. It was actual money, but let me tell you how mine went.

    One Saturday, approximately a year ago, I got a text from my carrier (T-Mobile, not that it matters for the purposes of the scam) stating that they were sorry to see me go and that my transaction would be processed on the next business day. Since I was at a BBQ at the time and had no idea what they were talking about, I called them. The customer service rep put me on hold and after a few minute came back and said that they had sent the text to the wrong person and that no changes had been made to my account and everything was ok. So I went about my business for the day, but kept this in the back of my head a something weird.

    Fast forward to the following Monday when my cell phone service suddenly cut off "for no apparent reason", so I called T-Mobile, and fired up my personal webmail from here at work in case they needed to send me anything. While I was on the phone with the T-Mobile customer service rep trying to get he mess sorted out, they told me that I requested to have my phone number ported to Verizon Wireless and I told them about my call to them on Sat, which had not been documented, I started getting e-mails that my bank account username had been requested, then the password. I used 2FA for my bank account, but it was only SMS based. I immediately hung up on T-Mobile and called my bank. While I was being transferred to the customer fraud department, I started seeing device changes for the BofA app, which I don't use, and money transfer request e-mails start coming through. Before we could get them "cut off", they managed to transfer out $2,000 from my checking account with another $2,000 in "pending transactions". BofA immediately cancelled the pendings, but it took ten days to get my other $2k back.

    After that was taken care of, I called T-Mobile back and explained what had happened. They gave me the number of the Verizon Wireless fraud department because VZW is the carrier that had initiated the port request. I called VZW and found out from them that if you purchase a pre-paid cell pone from them they DO NOT perform any due diligence to make sure that you own the phone number that you are requesting to be ported; they only do that if you are buying a phone on a payment plan. The phone that my number was ported to had been purchased pre-paid. I also found out that the carriers do not do any "due diligence" during a port request from one carrier to another because they are ASSUMING that the carrier that is requesting the port has done so.

    I filed reports with both my local police (who could do nothing obviously since the person that committed the crime was in FL) and with the feds. Nothing was ever done about it for whatever reason, although I ended up getting all of my money back, which was good.

    1. Re:As a Victim of This by Anonymous Coward · · Score: 0

      Wow. That is pretty crazy. But I'm skeptical that they were able to get into your bank account with just a phone number. I'm guessing they also had your login/password.

  16. Social engineering by Anonymous Coward · · Score: 0

    The only thing being exploited here are idiot customer service reps at telcos.

  17. Re:and that is why the bitcoin exchanges banking l by Joe_Dragon · · Score: 1

    but if they use the mail or an wire to send funds to you then that is where they come in.

  18. The WAvE by sdinfoserv · · Score: 1

    Let's see another round of "the wave" in a stadium filled with blockchain fanboyz continually screaming it's a technology going to change the world and every bank needs to jump there now!
    Oops.....

  19. That's how much I would steal by raymorris · · Score: 1

    > Is there even a point to stealing that much money?

    I've been working in security and paying attention to the justice system for a long time. I've learned that crooks don't normally get caught the first time; they keep doing it until they get caught.

    Stealing $100 or $1,000 or 10,000 isn't enough to change your life, just enough to risk going to jail or prison. To materially change your life, you'd have to steal $1,000 over and over again, until you got caught.

    If someone steals $5 million in one weekend and stops, they can retire very comfortably, while having a good chance of not getting caught.

    If someone steals $150 million, they can still retire comfortably, except they'll have the FBI and others seriously on their ass, putting significant resources into catching them.

    Whether you have $5 million or $150 million you have more than enough money. You never have to work again. The big difference is whether you're one of the smaller cases the FBI has on file or one of the larger cases. I'd rather be at the bottom of the FBI's priority list.

    So, if I were a thief, I'd steal about $5 million, quickly, then stop.

    1. Re:That's how much I would steal by datavirtue · · Score: 1

      The guy in charge of security for the company that contracted with McDonalds to generate the monopoly pieces made a second career of stealing winning labels and giving them to people etc...went on for years. He could have done it once and got away with it easily...netting $1MM or so. However, the guy went crazy involving all kinds of people creating million dollar winners in a web extending from his lavish home in Georgia. Long story short, instead of the FBI tracking terrorists they were running all over the country trying to recover McDonalds money and help them preserve their reputation (a minuscule amount to McDonalds). McDonalds got really lucky on 9/11 because the whole ordeal fell out of the news forever the second the planes hit--saving them from a PR nightmare that would have ended the most successful marketing campaign they ever ran. All those years no one won the instant prizes by chance...the guy in charge of protecting them was stealing every single one.

      --
      I object to power without constructive purpose. --Spock
    2. Re:That's how much I would steal by Anonymous Coward · · Score: 0

      All those years no one won the instant prizes by chance...the guy in charge of protecting them was stealing every single one.

      Odd. I won lots of free food. I never expected to win a cash prize as those were pretty darn rare anyway.

  20. "flashing a Gucci bag" by mveloso · · Score: 1

    What a lamer. Gucci? For real? He should have just gotten a Tumi bag.

  21. Re:and that is why the bitcoin exchanges banking l by rtb61 · · Score: 1

    That's not even the worst bit, once you get known for a bigger account, well, all they need is you and they have the username and password. Crypto is rapidly becoming the wild wild west, neck deep in crime and becoming quite dangerous. Like who did this idiot steal 5 million dollars from, can they even claim it back from the police because dirty money. The safest place for this idiot is probably prison but their chances of survival after that pretty slim.

    --
    Chaos - everything, everywhere, everywhen
  22. Second phone under assumed name? by knorthern+knight · · Score: 1

    Let's say that your real name is "John Smith", with a cellphone listed in that name.

    Get a burner phone, under the name of "Jane Doe". Use that number for your bitcoin stuff. That's your "bitcoin phone number"

    Identity thief knows that John Smith is into bitcoin. So he hijacks the "John Smith" phone number, which is useless for his purposes. Or is there some way for the actual "bitcoin phone number" to leak out to him?

    --

    I'm not repeating myself
    I'm an X window user; I'm an ex-Windows user
  23. Government workers can't afford Gucci bags? by Anonymous Coward · · Score: 0

    This guy was "flashing" his Gucci bag. And the government guys can't afford Gucci bags so they arrested him.