Hacker News Reader

Comment by devuo | Hacker News Reader

Last year when I upgraded my phone I was amused — but mostly horrified — by how easily one could get a SIM card for my own phone number with less than a modicum of information on me.

As I required to upgrade my Micro SIM to a Nano SIM, I went to one of my provider's shops and asked for a Nano SIM for phone number X. I was then asked to verbally confirm my name and address — and that's it. No ID card confirmation, no nothing. "Here you go sir, your new SIM card will be active within a few minutes. Can I help you with anything else?". What. the.

View on HN

Last week I walked into a T-Mobile store and asked for a new SIM card to replace one I lost. I gave them the phone number and apparently an invalid pin (the sales rep verified that I gave him the wrong PIN). I asked if I should do something else to verify it was my account and nothing. They didn't ask for name, ID, or anything else, and they didn't charge me for the SIM card. I went home and popped it in and my account had clearly been transferred -- I didn't have to do any other activation steps or anything.

Great customer service experience, but horrible security.

Your story reminds me of when I ordered a $200 video card from Staples ship to store. I went to the cashier and told them they should have a video card I ordered. They asked for my name and gave it to me (inside the shipping box so they didn't even know the contents). It's not as bad as getting your phone number stolen but it opened my eyes how easy it would be to "steal" a package.

The problem with all these stories is that there is a physical interaction. Maybe there is a video or whatever, but for some reason people easily let their guard down when transaction is conducted in person.

That physical interaction is important. It means there's a human being in your country committing a crime on video. That same person could just pick up a product off the shelf and walk out with it too. Either way, they're putting themselves at risk of arrest.

When it's online, there's almost no risk because they're probably in Russia and leave no physical evidence.

Never mind the video, you know for a fact they are carrying a tracking device.

Recently my dad entered his SIM PIN incorrectly three times and it locked him out. Turns out his mobile operator has an IVR service which hands out the PUK to any phone number you enter! No authentication whatsoever, just the phone number. How common is this?

Exact same thing happened to me. Upgraded my phone, needed to switch over to nano sim, walked into T-Mobile and chatted up the sales clerk and then walked out with my new nano sim without showing ID. I was dumb founded that it was so easy.

Reply on news.ycombinator.com