SEC X Account Hacker Hijacked Staffer Phone Number, Agency Says

The "staffer" (a.k.a. intern) was apparently compromised via the SIM swap, but multi-factor authentication was not enabled and they just happened to know THE email address to reset the password? So someone was able to reset the password and post an innocuous announcement, which was basically what was posted for real the following day, and yet the SEC was able to recover control of the account within minutes to post a rebuttal?

Let's just state the obvious - the intern (or possibly an automated system created by the intern) accidentally posted the legitimate announcement a day early which was embarrassing to the SEC. They are doubling down on the "hack" theory for CYA reasons.

I'm fed up with it. My _bank_ forced me into sms authentication. How on... earth?

And the burden is on us, the consumer, to show our innocence, when in reality, we're the victim. The thief defrauded the bank, and it had nothing to do with us. In fact, a huge majority of the time, the information used to defraud the bank came from another corporate security failure.

But companies have, through legislation, contracts, or simple might-is-right, set a standard where they have to do nothing and it's all on us.

I had to go through a whole host of BS with Verizon to show that even though I've lived in Washington for over a decade, and been with AT&T that entire time, that I somehow decided to head down to the outskirts of El Paso to open a Verizon account at a Walmart, and then run it up with international calls to Mexico and Eastern Europe until they cut it off three months later with $1,200 outstanding.

VZW demanded police report (fine, sure), copies of my ID, wanted utility bills to show my residence in Washington, even asked for (and I refused) copies of "several recent AT&T bills to show I had an account in good standing with them".

Their "preliminary review" said that they were "satisfied that I was the account holder and was liable for the debt". So I asked to see the account information, you know, being the owner of the account and having verified my identity to them...

for absolute hilarity, they refused, citing "account holder privacy".

So... it's my account when they want their money. And not my account when they are, all of a sudden, concerned about privacy.