T-mobile is horrible with security. They have this service called Digits, which lets users access their phone number from other devices. The problem is, this subverts the security model a lot of the American internet ecosystem is built on, i.e. your phone number will be secure online. Someone got into my t-mobile account and enabled Digits, then had free-reign on my gmail, texts, paypal, etc (I don't use the strongest passwords, but always keep 2-factor authentication on important services like these). Every time I got hacked I'd spend a couple hours of trying to figure out how, and the T-mobile agents would always claim no one accessed my number. Finally, the third time, I escalated up the security chain within T-mobile and they figured out the issue.