In less than 15 minutes, my dad had his cell phone number stolen from him and had his bank account hacked into, all while he watched as his email alert him every step of the way.
It appears that his T-Mobile cell phone number was used against him, ported to an account with Metro PCS, and then used to allow a thief to gain access to his online bank account.
"I was on the phone with Wells Fargo as the money was being transferred," my dad Mike Zelinger said. "As I was waiting, I was receiving emails from Wells Fargo saying that this has been completed, and your transfer has been completed."
What my dad is going through does not appear to be isolated. Customers have complained on Twitter and Reddit about their phone number being ported elsewhere and then used to gain access to bank accounts.
"When I called Wells Fargo and I described what happened, they asked me if I was a T-Mobile customer," said Afonso Salcedo, a T-Mobile customer who complained on Twitter and spoke with Next from San Francisco.
"I had two-step verification on my accounts," said Salcedo. "They actually had to send a text message with security codes to change your password, so I wasn't getting any of those messages, I only got an email alert that my password had already been changed."
That's what my dad went through on Wednesday:
- 10:11 a.m.: He got an email telling him that his Wells Fargo password had been changed.
- 10:12 a.m.: An email notified him that he was enrolled in Zelle, the service that allows you to transfer money with a phone number.
- 10:17 a.m.: Confirmation of a $2,500 transfer using Zelle to a person named "simon vargas."
- 10:36 a.m.: An email from Wells Fargo saying the company has tried to reach him by cell phone about potential fraud, but has been unable to get through.
"'We have attempted to reach you by phone, but our attempts have been unsuccessful.' That's because they had already ported my number," said Zelinger.
Funny thing, though, as soon as my dad received the 10:11 a.m. email about his password being changed, he picked up the phone and called Wells Fargo.
"While I was waiting for people to get on, and was on hold listening to their music, I noticed I was continually getting alerts from Wells Fargo," said Zelinger.
The money was transferred before he spoke with a live person.
While this was going on, he was getting calls at his work from customers asking why his cell phone number wasn't working. He also called T-Mobile to find out why.
"You had given your permission for us to port your number over to Metro PCS," a customer service representative told him. "It means that we closed out your phone number and sent it over to Metro PCS and it became your phone number at Metro PCS."
He called Metro PCS.
"Metro PCS says, 'well yeah, we ported your number to something else,' Well, who did you port it to? 'We can't tell you that,'" they said to him. "Whenever I access something, the next thing that comes up is 'please answer these security questions: What was your mother's maiden name? Who was your best friend in first grade?'"
T-Mobile and Metro PCS never gave him or Next an answer as to how a thief was able to transfer someone else's phone number to a different carrier.
"They managed to hack the system so that the SIM card gets rerouted to a different device," said Salcedo. "I lose my phone number and somebody gets access to my phone number, so they start getting my text messages."
There are tech websites that reference a hack from October, but a T-Mobile spokesperson told Next, "this incident was resolved months ago, so not related to this case."
Just after this story aired on Next on Thursday night, my dad was told his phone number was his again.
"The only reason I might want my old phone number back is cause that's the phone number that all my friends have, that all my contacts have, that's the cell phone number that I have for my business," said Zelinger. "I would say (I've spent) at least 10 hours for something that took less than five minutes."
How do you put a price on time spent?
"I am looking at some serious compensation coming from T-Mobile. For the trouble that they put me through, not only for the aggravation, but the fact that they took an entire day's work away from me," said Zelinger. "I'm not just looking at, 'We're sorry Mr. Zelinger, we have a promotion going now that says you can have Netflix for six months, we're going to give you Netflix for a year.' No, that's not the kind of compensation that I'm looking for."
T-Mobile provided this link for ways to customers can protect their accounts. It includes a port validation feature, that appears to try to prevent exactly what my dad and other have experienced.
