Ask HN: Carrier “lost” my number in a port request | Hacker News Reader

Ask HN: Carrier “lost” my number in a port request

271 pointsbojangleslover151 comments

I tried switching from T-Mobile to US Mobile after parking it on a VoIP service for a year (was abroad). They botched the port request completely. Ended up gaslighted by both companies, both claimed they "don't have the number".

Need my number for 2FA—literally can't move forward with a background check for my new job, can't send money to my family with my bank, etc. I'm sure I could theoretically get a new number but it seems the admin cost of this would possibly be in the hundreds of hours.

Do I have any recourse?

View on HN

First I would use unlec.com to determine where it is currently allocated. The SPID/OCN tells you who has it. SPID = Service Provider ID; OCN = Operating Company Name.

Then look at the LNP history, which is the history of who and when the number was assigned/re-assigned over the years.

Tell both companies that you will be involving the FCC and try to reach the "porting group" who will be able to fix this. Porting problems happen all the time, even with 99% of ports (that might be an optimistic number) happening in a nearly-automatic fashion. (EDIT: I mean the porting group at each company, not the FCC).

Looks like it got the HN hug of death.

"site reached maximum daily limit, contact admin" upon searching.

Since you can't call it the slashdot effect, obviously...

Is there an equivalent site for the UK?

I don't have such a rich source as OP, but Ofcom have some information

https://www.ofcom.org.uk/phones-telecoms-and-internet/inform...

The only thing I know of for the UK that's sort of similar (but not really), is this one:

https://www.telecom-tariffs.co.uk/codelook.htm

If you put in a landline or mobile telephone prefix, it can tell you which network the number was originally allocated to, but it can't tell you if the number has been ported.

Aren't all UK numbers owned by BT?

what is a good source for this data? their terms stipulate against scraping, but I'm curious if there is an authentic "open" source for the raw data?

The authoritative database is owned by Neustar[1] and is non-public.

There are entities that subscribe to the service and fulfill those queries (such as unlec.com or whatever reseller they're getting the information via).

But the Neustar revenue model is to charge per query which is why that site limits the number of queries one can perform.

Every time you place a phone call in US or Canada, the originating carrier does a lookup against the Neustar-NPAC database (also called a "dip") to determine the routing destination for your call.

Only after that response (called a "LRN" or location routing number) is received does call routing truly begin.

1: https://www.npac.com/canadian-number-portability/the-npac-ne...

> Every time you place a phone call in US or Canada, the originating carrier does a lookup against the Neustar-NPAC database (also called a "dip") to determine the routing destination for your call.

Is this able to determine if the phone is connected through wifi calling? (There was a discussion yesterday where some one suggested SMS may not be sent to a phone connected to wifi only if the sender did not wish to but I could not see a mechanism that would allow that determination.)

There is a separate field called OLI, originating line indicator, that indicates whether landline, cellular or other. From memory, it's 0 for landline and 62 or 63 for cellular.

I doubt you can reliably determine if on Wifi or not, although of course the carrier handling that phone would know.

They're likely referring to the data that comes out of LIDB[1] which is not a real-time indicator. Instead, it's what the carrier has stored against that phone number.

The LIDB data will consist of a field that marks that phone number as a landline, broadband (aka VoIP), cellular, etc.

There are some 2FA implementations you come across will look up whether a number you're trying to enroll is classified as anything other than cellular, and if so, it gets rejected.

1: https://en.wikipedia.org/wiki/Line_information_database

Thanks for the clarification. That is what I thought as well. I've heard of people being able to use Google Voice or other VoIP from 2FA even when it would normally be rejected by using a cellular number that they then port to Google Voice.

Based on what I've read, some video games are able to determine if you're using a prepaid plan or post paid. I suppose they might just look up the carrier to determine that since it doesn't seem like that level of granularity is available. And the port trick may work there as well.

My work number is a Google voice number, but was my 'real' number before segmentation in hopes of gaining sanity with my phone (sidenote, if anyone is self employed and busy enough to be debating such a plan, do it, no regrets), and I've had zero issues with 2FA coming through to my once a cell number now a voice number.

Mostly, but not every time.

I also have a Google Voice-backed number (since before Google acquisition, when it was Grand Central), and every now and then I find a site that doesn't accept GV numbers for 2FA. A recent example was Simplisafe.

Does anyone know where "Fraud Risk" and "Textable" come from in unlec's database? My number has fraud risk = high, and textable = No -- even though text works just fine via GV, and it's a personal number with minimal use, so no reason for flag (other than some companies not liking virtual carriers).

Not exactly the raw data, but Twilio has a cheap and easy-to-use API for this: https://www.twilio.com/docs/lookup.

https://developers.telnyx.com/docs/api/v2/number-lookup/Numb... Not open but this is a decent option for bulk. I believe it runs $0.0015 per number. I don't believe it does the port history though

what a fascinating site! interesting that it has a fraud risk level for phone numbers, among other interesting info.

Do we know where this site is getting its data? Given the site is down, maybe there's an option to pay for a lookup from some authoritative source.

Site is not working

Wow TIL.

I operate a telephony service (perhaps similar to the one you parked your number at) and we do thousands of ports a year from our service to major carriers. Porting is such a backwards pre-internet system and things go wrong all the time unfortunately.

My guess is that the port went through but US Mobile has lost it in their system.

One of the biggest issues I see is when porting from a VoIP service to a carrier. The carrier doesn't always know what to do since it is slightly outside normal; the majority of their customers are moving between major carriers. But now your number has been classified as a "wireline" (VoIP) number and US Mobile is probably confused.

Honestly, I bet it magically arrives at US Mobile after a bit of time. But if you can't wait, I'd engage the VoIP service again. They likely operate downstream from a provider such as Bandwidth, Twilio, or similar. Their team can ask their upstream provider for a "snapback" of the number - essentially they can go take it back. That will leave you with your number back at the VoIP service to try again when you're ready :)

With all that said, I do have access to these upstream systems and some more advanced lookup tools. Shoot me an email (in bio) with your number and I can do some research for you if you want. Good luck!

Can't help you sorry, but this also is such a massive downside to 2FA. It's totally possible to get locked out of your services semi-permanently due to really simple or likely mishaps.

I've encountered a similar but less problematic version of this simply by being abroad somewhere my provider didn't cover.

Its also a big problem for me because I want a super cheap phone plan, I dont need a good or fast service, I dont really need a phone number, but I need reliable and secure account for stuff like this. Can't wait for SMS 2FA to disappear.

The problem with ALL MFA factors including SMS is that they can disappear. One of the reasons we like SMS in my company is because in our experience the support costs of MFA are astronomical for other factors because the rate at which users seem to lose them.

In practice, a lot of the non-sms factors end up requiring reset every couple of years on average. It means our support orgs end up treating MFA resets as routine and that in itself can lead to situations where you open your customers up to social engineering attacks on support and support tooling.

There's really no easy answer here, my only hope is that eventually we move to government issued, strong, digital identities as second factors.

TOTP with proper diligence (backing up your codes) is just about the best of everything. You aren't dependent on any third parties for an MFA factor; your email and phone providers may disappear, but your TOTP code is as secure as you've made it.

We're literally talking about people losing their codes. What makes you think most people even have a system to securely archive TOTP codes long term, much less actually think to do it?

What if an iPhone user uses Apple Notes to store their TOTP keys (probably one of the most reasonable ways accessible to a non-technical user), but then 5 years down the line switches to Android, 5 more years pass and they've entirely forgotten that they even used to put TOTP codes in Apple Notes 10 years ago, and then they need their TOTP codes?

Securely archiving things which are rarely if ever needed across many decades is an incredibly hard problem, and I would trust approximately 0% of users to do it correctly.

Is Apple Notes a TOTP program? At least where I do my thing, on AndOTP, there's a plainly obvious backup and restore function that saves or reads from a file. Doesn't get much simpler than that.

Apple Notes is a note taking program, it would be a place to store backup codes. You can't store your backup codes in your OTP app, that would defeat the purpose.

Hence the file. Backup to a file, copy it somewhere else. Heck, print it out on paper if you want to.

That's not really true. It would be if it was done right, but most companies have some way of getting around it.

I lost my yubikey I used for my AWS account (I know, I should have two but I really did not have anything worthwhile on this account). I also changed phone numbers in the meantime as well as email. And then proceeded to forget my root password. I have not used the account for a number of years and it really did not sink in until I needed it.

See? You would think I was totally and utterly fucked.

Well, not. I called them and with a procedure that took some 3 days and numerous phone calls, id photos, etc. But I finally got the access to my account back.

> a procedure that took some 3 days and numerous phone calls, id photos, etc. But...

We're disagreeing over semantics then. I'd call this "being locked out of my account semi-permanently".

I have to say I don't fully understand your perspective. In a sibling comment you admit that free customers ought to be subject to this misery because they are using the service for free, and here you suggest that requiring numerous phone calls and numerous days of non-access to services is not an inconvenience. I suspect we simply have different life priorities. For me, those three days could be critical in my relationships with customers, clients, employers, etc.

It is inconvenience, but necessary one.

Would you like your bank to make it convenient for you to get your money if you forgot your ID? It is double edged sword -- convenient for you is also convenient for somebody who might want to steal your money.

So no, I do not object to AWS doing due diligence when I recover my password because I know this hopefully makes me a bit more secure from somebody else doing the same.

You can't have multiple yubikeys associated with your AWS account! And you can't have a yubikey as primary and a software authenticator as a backup, for example. It's a huge hole in their operation imo. Even comparatively unimportant apps such as Facebook allow you to associate as many hardware tokens as you like, fallback to authenticator or SMS, etc.

Yeah the whole setup is completely broken, which forces them to build backdoors for when it breaks which completely defeats the purpose of 2FA to begin with.

No, it is not broken.

You just make cloned yubikeys. You can't read data from the key, but you can initialise it with your own data and you can initialise more than one with the same payload.

And how do you do that with U2F?

You can. You make clones.

This is my biggest fear. Even if I use 2FA completely safely, using a physical chip, for 10/10 sites I care about, someone could spoof my phone number, call tech support with the right attitude, and remove my 2FA.

I'm so over the phone system and the credit card system. We have superiors but we are stuck in the past culturally.

Good providers have a deliberately slow and onerous process in place - send proof of identity, multiple notices to the account owner, sometimes even documents mailed to a physical address. It needs to be possible to recover high value accounts - what else would you propose as a better solution?

Yeah, that's exactly the point.

If the process takes couple of days and they do a lot of communication, there is a good chance the real owner of the account will get notified and have time to react before the attacker gets access to the account.

Also, the commenters are completely wrong on that it is enough to have the email or ID to get through the process. The AWS people who contacted me required a lot more information that only the owner of the account would know.

> Well, not. I called them and with a procedure that took some 3 days and numerous phone calls, id photos, etc. But I finally got the access to my account back.

And the point of 2FA in the first place is thought by many to prevent social engineering.

All you needed was an id photo and be able to talk on the phone?

That and account history etc. will probably be in many peoples email. Thus access to the email only would allow you to get access to 2FA services too.

For me that was a reason to 'only' use a static 50 char password on my yubikey thats combined with a short password I can remember as a kind of simple 2FA.

Just feels safer to me to have a printed backup of both stored away in case the tech breaks or gets lost.

> I called them and with a procedure that took some 3 days and numerous phone calls, id photos, etc. But I finally got the access to my account back

One could argue that your accounts were never secured to begin with.

On the other hand, a family member set up facebook with 2FA, but using a TOTP built into facebook (is this really a thing? It seems to be) -- such that when he switched computers and facebook decided he needed to re-auth, he couldn't get to the TOTP anymore.

If this doesn't make any sense, it probably is because I have the details quite right, but the end result is I was unable to help him make any more sense of this, and there appears to be literally no way to regain access to his facebook account.

>and there appears to be literally no way to regain access to his facebook account.

a blessing in disguise perhaps?

This is why you always (always) have backup codes. If a site doesn't provide them (and only allows 2FA via SMS rather than also via Time-based one-time password), that's a huge red flag to me (and yes, I'm aware some very large sites fall into that bucket).

So U2F is a red flag?

Maybe 2FA should be considered a red flag at this point.

2FA by itself isn't a flag to me, only offering 2FA via SMS is. It means to me they did the bare minimum in order to say they offer 2FA.

I am currently in the process of switching banks because the old one makes it difficult for me to change the number (and device) associated with my account (to the point where I have to send in a signed letter, which they then refuse because my signature 20 years ago does not match my signature today).

Security is important. Security that is implemented badly costs you business.

I wouldn't say it's badly implemented, I would say that the implementation clearly errs on the side of preventing social engineering than giving customers who can't match their signature a good experience.

I've been a part of designing these types of processes and this is all argued about forever. The alternative is the e*trade approach where I can call in, give my DOB, Address and last 4 digits of my social social and I get a new MFA token immediately. No PIN, no signature nothing.

So your model is dictated by the potential behavior of criminals rather than the actual needs of customers... and you don't consider this to be "badly implemented."

What company did you say you were designing security policies/processes for...?

The processes are dictated by what legal, compliance and the business at large are willing to let you use to recover MFA and that doesn't always match with UX. If the legal/compliance team says signatures have to match, what are you, as an engineer supposed to do?

The process we use now is automated but customers don't like having to find recovery pins, billing information so a lot of them still call if they get a new phone and their TOTP isn't there. It will also fail for various other reasons related to browser fingerprinting and reputation that I won't go into details about.

MFA recovery is very tricky, most websites don't even let you do it in an automated way for security reasons. If it goes wrong, you've basically broken MFA for your whole site. Banks are the types of places that are going to err way on the side of caution.

Print backup codes for each service

A lot of services use SMS as a second factor and offer no backup codes.

In those cases I opt to have no 2FA at all.

Only culprit that's really enforced it is the Canada Revenue Agency

Some services force you to use SMS 2FA.

My bank recently made a 'security' updates and now my Google Voice number no longer works with their text or call 2FA. They provide no other alternatives and I must have it. I have to now call their customer service, wait a half hour to speak to someone, verify my identity, and have them reset in order for me to login.

Thankfully I rarely login to that bank as it's not used for much, but if it goes on for more than 2 months or so - I'll probably switch.

I honestly find 2fa enforcement detremential and it should be entirely possible to opt out - case in point my current bank (not by choice, ridiculous country that can't manage to join the euro) are disabling SMS 2fa for online banking and suggest using their app, except the app doesn't work (they'll still send 3ds via SMS though!!) and they've basically stopped bothering to reply - anyway the point really is that people who are not morons should be able to opt out, because the onus and damage on the end user often outweighs any possible risk of stealing funds etc (there's literally nothing in the account, standing order sends all of my income to a useful bank abroad the day after it arrives).

As an aside, open banking is also a joke as it doesn't allow the end user access to their own account, only 3rd parties - simple API access would make this problem moot, as where I hold my funds grants me API access and I can do things like trigger transfers on webhooks etc, very simple and infinitely useful.

I bank with a local credit union, and their online banking originally only supported SMS. I wrote to them about the many security issues with that, and an executive responded and acknowledged my concerns.

A few months later they added TOTP support. Not sure if I influenced that at all, but it's just another reason why I will only ever use a credit union as my main bank.

As per your last comment, I would likely be changing banks in that scenario, and letting them know exactly why they are losing a customer. Even if it doesn't seem like any one individual making sure that reason is documented, I do think in aggregate eventually it could be enough to make a difference with stuff like this.

Amazon KDP forces to use SMS. And I never received SMS when I tried it. Just removed my short story (nobody was reading it anyway) instead of asking support...

I have this issue with Google and no way to get any support or help to get this resolved. I just have to accept i’ve lost access forever…

Free account?

When you are paying customer you are also getting the privilege of contacting the support.

I think it is fair that Google does not want to directly talk to billions of people using their services and not paying a cent for it. You get it for free? It is up to you to make sure you don't loose access.

>It is up to you to make sure you don't loose access.

The problem in my case was that Google changed the rules halfway through. I kept my username and password perfectly secure in my password manager. But one day they suddenly decided that I can't log in until I respond to an SMS code they sent to a phone number they somehow got from me 12 years ago that I no longer have access to. It would be fair for them to not suddenly force SMS MFA without the user's consent.

Yes, free account. And having lost the ability to do 2FA I probably won’t be able to upgrade it. I’m fine paying for support, but that is not even provided as far as I know (for free accounts).

It is a bit as with insurance. You pay insurance in case something happens. The insurance model is based on the assumption that a lot of people will be paying for it without getting the insurance back, otherwise it does not make financial sense.

The cheapest paid workspace account is cheap enough that it probably costs less than processing a single support ticket. Remember, when you loose access you are probably looking at multiple touch points and multiple people on their side to get you back. You wouldn't want any single person to be able to just change whatever they want?

So if they allowed it, people would just pay for the privilege once to get the problem resolved and then downgrade themselves back after one month.

The issue here is that the ratio of free accounts to paid accounts is so high that if any support was allowed for unpaid accounts it would absolutely deluge the system and paid accounts would have to pay a lot more to cover the cost of support for unpaid accounts.

But I do think they could provide a paid support ticket where you can pay an amount that would cover their costs (and of course then some) for a single support request.

The issue with this is that somebody could do this to "recover" account that does not belong to them. Paradoxically, there is some extra security in not allowing any social hacking by just not allowing any manual work on the account.

>The issue with this is that somebody could do this to "recover" account that does not belong to them. Paradoxically, there is some extra security in not allowing any social hacking by just not allowing any manual work on the account.

That's the problem. The more flexible you are with helping a customer, especially just over a phone or computer, the more open you are to social engineering attacks. At least in the US, there are various processes involving notarized/Medallion signatures and the like. But at that point some not insignificant number of people will complain the processes are too onerous, they don't have a local bank, etc.

I wouldn’t mind paying a premium instead of a monthly insurance fee to get this resolved. And I have time, it doesn’t need to get resolved today.

Can you provide some additional details on the VoIP service? When you say "parking it on a VoIP service" do you mean that you ported from T-Mobile to the VoIP service or do you mean you forwarded your calls to a VoIP line and continued to pay for T-Mobile?

Who botched the port request? You would have initiated the port request via US Mobile when you signed up for service. They wouldn't depend on T-Mobile "having the number", they would have looked up who had the number and initiated the porting process.

You can see which carrier "owns" your number by going to https://freecarrierlookup.com/.

Now, if you cancelled your service BEFORE you ported the number, then you may be SOL as the number would have been released. Even if not reassigned you may not be able to get the provider/carrier to release it since it is no longer in your name.

I ported from VoIP to T-Mobile successfully, then tried to port from T-Mobile to US Mobile because US Mobile is $15/month. I did not cancel before I had the number.

Not 100% sure but think that link only provides the original carrier, not necessarily the current.

Something similar happened to me: my phone number of 15 years was active on the Sprint cell network via an MVNO. Evidently, when the network was decommissioned, the phone number "disappeared" with it. According to the carrier, it was my responsibility to switch to a new SIM card. The company never notified me of that responsibility, or the deadline. In July, the number stopped working, and I spent maybe 20 fruitless hours on phone support with my carrier, with T-Mobile (since they are the operator of the Sprint network), and with Sprint (which I guess sort of still exists despite being acquired by T-Mobile). The MVNO subreddit had several agents handling this exact problem, claiming they could fix it, but they could not.

I ended up getting one piece of potentially useful advice: after a while, the phone number will possibly get recycled into a generally available pool. IF that happens, and IF I check at the right time, I MAY be able to purchase the number at https://www.numberbarn.com/.

After all that, I just ended up getting a new number. It has now been four months. I check that site a few times a week, no luck yet. I also call the number occasionally, I have a script prepared to try to convince whoever answers to listen to my stupid plea. It's still disconnected.

As for moving forward: just get a new number. You may get the old one back eventually, but don't count on it happening at all, especially not quickly. I had no trouble updating my number for bank accounts. I don't understand why you would be stuck with your old number for a background check service, seems like you should just be able to provide them with a new number.

Once unlec.com is back up (see other comment) - I'm very curious where the number currently is at?

Here are the most obviously meaningful fields in the result:

    port date 2022-10-20 15:46:07
    spid name Sprint PCS-10X/2
    ocn name OMNIPOINT COMMUNICATIONS MIDWEST OPERATIONS LLC
    nn description T-Mobile

lnp history is blank or not working.

Hmm, according to https://www.crunchbase.com/organization/omnipoint-communicat... Omnipoint was bought (for $4.5b? no lol) in 1999 by https://www.crunchbase.com/organization/omnipoint-voicestrea... (VoiceStream), which of course became T-Mobile once they were bought by Deutsche Telekom. Interesting. (The phone number (!) in the first link is the T-Mobile Corporate Offices number.)

Maybe that explains why everyone looking at is going "nnnoooope" because the number's owned by someone 3 times removed from existence and those are probably really hard to fix.

I'm curious who the MVNO was, given it clearly wasn't OmniPoint?

The only idea I can think of is to go as far down the *enterprise* rabbithole as possible, if you didn't already try that ( :/ ? ) - in my own experience (with comparatively tiny issues) I've found far less gatekeeping and "wrong number" than the (Interesting™ O.o) phone menus would suggest. Also, one day I also found the enterprise number I'd squirreled away randomly turned into a totally different department (whole new phone menu + tree) but apparently went to the same phones, so don't just try random/wrong phone options, but wrong/unlikely-looking departments' phone numbers too, they might be hubs not spokes. Oh - and calling somewhere Important™ (eg, network operations) at 11:30PM-12AM-1AM might net you a bored, idly curious night person with a bunch of lateral capacity who might not mind the opportunity to do something interesting during their shift lol

https://www.fcc.gov/consumers/guides/porting-keeping-your-ph...

There's a complaint link on that page

We recently "lost" a business number during porting. We had a consecutive block of 400 numbers, but a single number was mysteriously ported to a company called "Neutral Tandem" instead of to our new carrier. Baffling. Nobody from our new or old carrier has any relationship with them, nor could they do figure out how that happened. Nobody from either carrier could get the number back after several weeks of effort.

When contacting Neutral Tandem we got a "You're not our customer, and we have no records of you owning that number. So we can't tell you what happened or how to fix it, sorry."

So the number is effectively gone, and I am experiencing neat-nick anguish from having a single hole in our beautiful list of 400 consecutive numbers (which have been used at our company for more than 40 years).

Anyone from Neutral Tandem (now called Inteliquent I think) here on HN and willing to help?

I'm willing to bet the following has happened:

- You are customer ID 150 in your new carrier's DB

- When porting, a manual fat finger linked that number to customer 151

- Customer 151 is a reseller and has Neutral Tandem as a customer

- The new carrier's customer service UI only shows ownership based on the first number of the block

I run a telco and have seen similar issues happen many times. Have the tech team trace and see if a test call you make to the number routes via them. If so, it's their issue.

What happens if you call the number?

We get a "not in service" message, same as we did since the day of the mis-port (which is several months ago at this point).

Complain to the FCC for one. This process is highly regulated.

Yes. I can’t speak for all countries but even if you fail to pay for your plan and get it cancelled you might have a chance to re-claim it within a few months.

Numbers have generally started being recycled after a shorter rest (only a few months).

When I worked with a system handling portings it should have been possible to find where your number went.

Do you still have the physical card or the papers that came with it originally?

Try to get the carrier to file a real bug report, something that reaches the developers, with your ICCID, found on the physical card or the documentation that came with it.

That goes for both carriers. Either one has an error receiving or the other has an error porting. Communication between the carriers could be near nonexistant though. I hope there is a way =\

Genuinely curious why you're using the words "bug report" and "developers" here - would this actually be an implementation-specific software issue? All this squishiness sounds like a manual process simply didn't get followed correctly or something.

We had to manually investigate and handle individual screwed up number portings _all the time_. And we did so every single time we (the developers/maintainers) got a report about something having gone wrong.

The sending carrier has that number port logged, and the receiving carrier will if they received the request.

Ooooh, I see. TIL, thanks!

So, what kinds of things would actually go wrong? "Bits of proprietary software yelling at each other in non-standard-ese"? Crazy scripting fixing frequent human mistakes? Or...?

I'm very fascinated with this sort of thing given it's treated like such an impermeable brick wall.

>you might have a chance to re-claim it within a few months

Which is probably utterly useless to the OP. At this point, they probably have no real choice but to go through whatever paperwork is required to recover access to their accounts without having the phone number.

Here’s the link: https://consumercomplaints.fcc.gov/hc/en-us/requests/new?tic...

No it’s not. The only thing regulated is that phone companies have to make the numbers portable so they can’t hold them hostage. But you don’t own any right to your number, if there is a renumbering you are SOL.

The number can’t be gone of course, it belongs to a range operated by a provider (where it originally came from) who can see who it is being forwarded to. But no one is under any obligation to help you with that setup. All they have to do is make a credible offer to port the number if you move to another provider.

Not sure what you’re on about, but every provider is going to offer new customers a porting service to encourage you to switch. And with a few exceptions (moving from wired to wired in a new geographic area, or moving certain small rural providers), your old carrier must let the new carrier port the number.

That is the same thing. Practically the original provider has to offer a service where they forward your number to a new carrier. But that doesn’t mean the customer has some kind of ownership like claim to the number.

Not practically, legally. Not sure what the significance of metaphysical ownership or the lack thereof is. The FCC enforces these rules.

The significance is that even though you can port a number from provider 1 to provider 2 and then port it again from provider 2 to provider 3, practically the number remains at provider 1 who forwards it first to provider 2 and later to provider 3. But the number remains with provider 1 because it is part of a range serviced by that provider. That is the only ownership like claim there is.

The fact the providers provide this forwarding service doesn’t mean the costumer gets a claim to the number, which is what this article is all about. A customer angry the number was ‘taken’ from him. It was never his. The providers are required to provide the porting service but if something goes wrong and a number is somehow lost, the costumer doesn’t have a right to go and demand it back from someone. Just like when the providers renumber an area, people come and complain they have to redo their preprinted letters and the lettering on their cars. Too bad, the number is not yours.

He can go and ask to get his number back, or he can make demands and then try complaining to the FCC. But I don’t think they’ll do anything.

Good points, thanks.

>This process is highly regulated.

https://www.fcc.gov/general/wireless-local-number-portabilit...

Looks like the only time they are legally required to, ATM, is if you switch from one wireless provider to another. Introducing a VoIP providers probably means this dude isn't getting his number..

You found the wireless page so that’s all it discusses, but that’s not true. What is true is that for wired providers, you are geographically bound. But you can still take your wired number and port it to your wireless plan and then move wherever.

https://www.fcc.gov/consumers/guides/porting-keeping-your-ph...

Solution - need some big pull to get this done.

The number needs to be recreated at the original provider (assuming no one else has picked it up), activated, ported multiple times (if you have ported earlier) and then brought to the current final provider.

Source - lost a 20+ year old number during a port activity the same way. Fortunately the provider was a client, and got a circle head involved to recover the number in the way it is mentioned above. Took a week.

"circle head"?

Some higher up executive. Geographical Circle Operations Head maybe.

Not to pile on but this is just one of the many reasons why SMS is bad for 2FA.

https://sec.okta.com/articles/2020/05/sms-two-factor-authent...

Why would T-mobile have your number if you ported it out to the VOIP service a year ago?

Did you ever confirm it arrived at the VOIP service? The last place you can confirm you had access to the number is where you should be looking.

I think the OP meant the VoIP service was provided by T-Mobile.

T-Mobile and US Mobile are the two companies at fault. The VoIP service is a third party (NB the use of the indefinite article).

Yeah they will do that when they're being idiots, which is quite often. There should be a hold on it being reassigned, if the porting request is recent, keep on hounding them until they get it worked out, if it's been awhile, you're probably hosed.

This brings back memories. I was working for Cingular when WLNP was first introduced. People were constantly trying to swap and chase after the deals, because every carrier was trying to outdo the next with a better deal.

At the time, Verizon system, apparently just didn’t work. We were seeing greater than 90% failures porting from Verizon to Cingular. The Verizon system would release the number, but then never send us the request to transfer. We would call Verizon’s WLNP support and they would just shrug and say there was nothing they could do. There were so many irate people that had lost their numbers.

We found sprint to be the most reliable

It was a long couple of months while the bugs were worked out.

When this happened to me I called the investor relations number and the next day a VP called me and said it was sorted out.

I doubt it being hundreds of hours.

Most will require two government IDs to be sent in to remove 2FA and 1-2 week process to review & confirm.

Moving forward you should look at Yubikey where you can with the backup being your phone via Authenticator app.

You can already do backups with Authy but I think OP's issue is for SMS-based 2FA which is still very common.

> SMS-based 2FA which is still very common

It's not like it's showing any signs of going away either, financial institutions even are newly implementing it.

SMS is not suitable for 2FA. It has a massive "help desk" hole that is obnoxiously easy to exploit. SMS is only useful as a proof of stake, IE something you do to initially set up a second factor to prove that you have some skin in the game, but not as the second factor itself. Honestly, even that proof of stake stuff is separate from setting up 2FA, it's mostly about slowing down botnet signups.

There are times where SMS 2 factor is worse than no 2 factor at all. Common number porting attacks allow an attacker to be far more convincing to the support staff when they call to say that they forgot the password but still have access to the second factor.

Don’t you need your phone number to authenticate with Authy to get into the backups?

No. That might be a possible backup, but the usual way is any current logged-in device + password.

Uhh, if you need a currently logged in device to bypass the phone number login, then I wouldn’t say it’s a “possible backup”. Phone number is the primary authentication mechanism for Authy.

Huh? I use Authy because it allows me to use TOTP codes, from multiple devices, including devices without cell service. I switched to it from Google Authenticator specifically for that reason.

Okay, so how do you sign in to Authy if you don’t have another signed in device handy? I believe the only options are phone call or sms.

If you have “Allow Multi-Device” enabled, your keys are stored on Authy’s servers. You simply download Authy on a new device, sign into your account and you are done.

How do you sign into your Authy account? For me, it asks to send an SMS to my phone.

>Most will require two government IDs to be sent in to remove 2FA and 1-2 week process to review & confirm.

I've never heard of this. If I lose my number, can I still regain Google account access by mailing my info in?

No. Google will lock you out forever.

I just had a similar experience. I cancelled my landline phone service, and was told that I cannot port the number anywhere, or even forward it to another number. The only way I can retain access to it is to retain my phone service with Western New Mexico Telephone. I thought there were phone number portability laws. Do they exist? Are they full of loopholes? Are they being flouted?

https://www.fcc.gov/consumers/guides/porting-keeping-your-ph...

The rules appear to apply to "wireline" as well as "wireless" providers. I don't know if the FCC uses the term "wireline" to refer to something unexpected, but my best guess is that your experience breached the FCC rules.

There is a complaint link on that FCC page.

The actual rules are at https://www.ecfr.gov/current/title-47/chapter-I/subchapter-B...

In particular, https://www.ecfr.gov/current/title-47/chapter-I/subchapter-B... has what seems to me like pretty strong language:

> 47 CFR 52.34(c) Telecommunications carriers must facilitate an end-user customer's valid number portability request either to or from an interconnected VoIP or VRS or IP Relay provider. “Facilitate” is defined as the telecommunication carrier's affirmative legal obligation to take all steps necessary to initiate or allow a port-in or port-out itself, subject to a valid port request, without unreasonable delay or unreasonable procedures that have the effect of delaying or denying porting of the NANP-based telephone number.

> I thought there were phone number portability laws.

For wireless carriers, yes. I'm not familiar with any for landlines.

Edit: https://www.fcc.gov/consumers/guides/porting-keeping-your-ph...

Looks like small providers don't have to do any porting, plus as a sibling comment pointed out, you can't port a number after you cancel service.

At least historically, the area code and exchange was determined by your physical location. So if you moved to a different exchange you couldn’t keep your number.

In fact I had a case where I switched from Verizon without moving. But Comcast’s switching gear was in a different exchange so they had to change my number.

This was a while back. There may be more flexibility today.

Yeah, I figured this out as a kid. I could tell which neighborhood people lived or a business was located solely based on phone number.

You can't port it if the number is cancelled. You have to sign up for the new provider and have them take the number. Every provider can just take any number they want. I used to work at a small Telco/CLEC and occasionally I would have to fill in on the phone switch to do things like this. It was very nerve wracking. Kind of like editing BGP, knowing that a typo could effect a ton of people.

So just don't tell your current provider, the new one should be able to handle it.

Wireline porting requirements are limited; the original carrier only has to port to carriers in tge same wire center (also known as central office). If there's no other carriers, you can't port.

If your wireline carrier hasn't been (re)absorbed into ATT, Verizon, or Frontier, it might be small enough that there's no competitive carriers in their central offices.

I think maybe you need to initiate the port to a new carrier and then cancel existing service? Otherwise they may just release the number to the available pool as soon as you cancel, and then the answer really would be that they can't port it anywhere, since they don't control it.

Same thing happened to me about 5 months ago. I ended up email the CEO. Had an executive relations staffer email me back within minutes, and I had my number back within about a day. YMMV.

That’s not what gaslighting means. I really want to punch whoever entered this phrase into the popular lexicon because it’s used incorrectly at least 99% of the time.

Hey this is Doug from T-Mobile. I'm just calling to let you know that we've sold your phone number and you'll be getting a new one.

If it were me, I'd already have started moving on. Any legal recourse is going to take a rather long time. And you've already tried to get each service to grab the number. So if anything is time sensitive, I'd choose to do what I could. Possibly with a different company than either of those 2.

This is one reason why I have a Google Voice number. If my underlying. number is "lost" I can just reconfigure GV. But there is some (increasingly rare) 2FA that does not work with numbers other than telco numbers. When you sign up an SMS vendor for 2FA, make sure it works with VoIP services.

This is even worse. You’re boned when Google bans your account and refuses to tell you why.

You can still port your number away from Google even if they ban you.

How? Don't you have to unlock your number first somehow?

> But there is some (increasingly rare) 2FA that does not work with numbers other than telco numbers.

My experience is that this is not "increasingly rare" but "almost universal" at this point. VoIP numbers are useless for SMS account verification. People who thought they could bypass phone company price gouging found themselves out in the cold when signing up for email accounts, social media accounts, or even their own bank.

You mean increasingly common?

I have found that my GV number has become useless for most TOTP services, and for a lot of services that want a number to send a text.

Both based on my experiences and having worked on mobile infrastructure (though not messaging), I am puzzled why this would trend in the wrong direction. Messaging is all IP since LTE. I can imagine poor integration/operations in parts of networks still using an SMSC and IP/SM gateway. But why would there be a general trend against interoperation?

I think because 100% of Google Voice numbers are forwarding numbers, and 2fa folks feel like that is a risk factor.

I really don’t know, but I do know it’s trending that way for GV, specifically.

Have you tried the folks at the USMobile subreddit... https://www.reddit.com/r/USMobile/ ...There are employees over there. Also, hopefully your previous service hasn't been cancelled.

Looks like you haven't got past 1st level support to have someone technical to look at this. Maybe their CRM "lost your number". Anyways, there are good suggestions on this thread. And telling you are going to involve some 3rd party like FCC should get you past 1st level support, I hope.

In the old days we'd have hundreds of DID numbers, and we'd port service from whatever provider was the best deal at the time...we ALWAYS lost a number or two.

At some point I think AT&T or McLeod even said "What number do you want to lose when you port this?"

I feel for the OP. I would just like to plug a good porting experience I had with Twilio recently. I ported a phone number from Vonage to Twilio. They did an excellent job keeping me up to date.

I totally expected something to screw up, especially on the Vonage side.

Recently I switched to Verizon from a pre-paid service subsidiary of T-Mobile and had some porting issues myself. I totally commiserate with you, but there is hope.

I left the store at end-of-business before the porting was totally complete and the in-store rep couldn't contact the porting team because they'd already gone home. I had data and could receive incoming messages but couldn't make outgoing calls or texts. The in-store rep assured me I could handle this myself the following day. He didn't mention the hours of bullshit I'd endure. I persevered for the same reasons as our Bojangles Aficionado above, but, honestly, I don't know that I saved myself the time that would otherwise have been spent re-authorizing myself on my 2FA accounts.

The gist of the story is that the junky prepaid service didn't give me the right account info from the start, so when it came time to port, Verizon couldn't help me unless I produced account numbers, PINs, and zip-codes. The zip-code was from an address I haven't lived at for 10+ years. (That remains a mystery and is somewhat concerning.) At some point, I was trying to socially engineer the zip-code out of the T-mobile subsidiary rep, which eventually just turned into a plea.

I don't have a magic solution for you, but here are some thoughts about how I'd approach your situation:

* I would recommend continuing to call and escalating as high as you can go. My principle with customer service of major corporations is that if I don't like the response I get, I call back a maximum number of three times. If I get the same response 3x in a row, then that's a hard policy that I'm not going to bypass. Chances are though, whether by human error or a policy designed to be flexible, I will get some leeway.

* Related to the above, in calling back a few times, you might find that the technician you talk to in subsequent attempts is more qualified, experienced, or simply desires to handle your problem efficiently. Essentially, play the game more to win.

* I would also recommend getting T-Mobile and US Mobile on the phone with one another. They have the capacity to do this, and they might discover the problem together as opposed to being able to punt to the other side. Make yourself a nuisance. At the end of the day, you're in the right here.

* Last bit of advice I can impart is make sure you are absolutely speaking to the right team. Most customer service lines are structured in such a way that the first line (FLS) filters out people who don't need specialized help. The problem I faced with Verizon was being asked repeatedly by FLS who staffed the Porting hotline number to do the same troubleshooting steps (e.g. reset network settings on my phone) before speaking to the actual team who handled porting. Verizon might not be structured like T-Mobile or US Mobile, but at some point I was getting detailed information about the status of the Port from a Tech Support rep who ultimately had to hand me off to the Porting team to finalize it.

Good luck!

This is one of the reasons I don't trust 2FA. Too easy to lost access to online accounts.

I've had that happen, i tweeted to verizon and they fixed it.

If you parked it at a VOIP how were you able to use the 2fa?

My VoIP had an SMS feature that I used from their web UI

Ask your U.S. Senator's office for help.

Call a lawyer.

Reply on news.ycombinator.com