Fraudulent Sim Swap led to stolen crypto

[#1]

@padduan

"Thanks and fair points, but again, how did giffgaff allow them to initiate a sim swap without my permission? 

When you have given fraudsters yur username & password they can do ANYTHING they like in your account - & giffgaff will not be aware that it was not you that did t.

[#2]

@padduan

"But the sim swap was initiated before i gave my details away.... "

This is not what your original post post says.

[#3]

"But the sim swap was initiated before i gave my details away.... "

That was the scammer's bait! It was a spoofed text message, and not from Giffgaff.

It is a method of social-engineering that is almost guarenteed to get the victim to log-in to their account. No one wants their number being transferred away unintentionally, so they know people will try and cancel the process.

[#4]

@padduan @report_phishing

Change your giffgaff password - https://giffgaff.com/profile/details#passwd
Change your email associated to your giffgaff account - https://giffgaff.com/profile/details#email

If you've used the same password/email on other sites change those too.

Alert your bank for possible unauthorised account debits/activity if your number is linked to the verification process ask the bank to remove it.

Please read these threads for HOW your account(s) were compromised

https://community.giffgaff.com/t5/Announcements/Security-Update-Phishing-smishing-and-SIM-swaps/td-p...

https://community.giffgaff.com/t5/Announcements/Security-update-and-keeping-your-accounts-safe-onlin...

Have you ever used your phone number as  a contact number elsewhere online ?

Unfortunately it appears you've logged into a fake giffgaff site, thus giving them your password and log in details, they've swapped your sim and received the text for 2FA

Are the agents sending you a replacement sim to your address registered with giffgaff?

If not

If you can access your giffgaff account you can regain control of your sim by completing a sim swap if you have a spare unactivated sim to hand
Or many local shops such as Tesco, Sainsbury's, Poundland and many more smaller shops and newsagents sell giffgaff sims for about £1 if you don't have one to hand

Once you have an un-activated sim

Log into your my giffgaff page
Http://giffgaff.com/dashboard
Check you're in the correct account
(important if you have several accounts or manage accounts for others)

Then click here
http://giffgaff.com/activate

Input the 6 digit activation code from the new sim in the box provided and
click the yellow activate your sim button

On the next page headed "SIM replacement "
click the yellow button
"yes I want to replace my sim"

On the next page headed "SIM replace"
click the yellow button
"yes I'm sure"

Your new sim will usually start working within 30 minutes
(switch your phone off and on every 10 minutes or so)

You'll receive a message from an educator here https://community.giffgaff.com/t5/notes/privatenotespage/tab/inbox

[#5]

@padduan wrote:

But the sim swap was initiated before i gave my details away....

Incorrect.

The text message saying a SIM swap underway was from the fraudsters posing as giffgaff, not from giffgaff themselves.   You fell for the scam by clicking on the link to "stop the SIM swap" and entered your member name and password.   Armed with those credentials, the fraudsters logged into your account, then proceeded with a SIM swap.

[#6]

@padduan wrote:

But the sim swap was initiated before i gave my details away....

You fell foul of a smishing text that directed you  to a site that looked like a giffgaff log in page, you then entered your username and password, they were then able to complete a REAL sim swap

[#7]

@padduan wrote:

But the sim swap was initiated before i gave my details away....

I think that might have been a fib @padduan. and you may well find that the sim swap actually took place after you’d given them the means of getting into your account.

This is how these scams work in that they play on people’s fears by saying that “something is going on” and they tell you that if you “just click here” it’ll all get sorted.

So you panic and click and then as the site looks genuine you don’t take the few seconds to “check it out” because you are keen to get to problem sorted and you know that speed is of the essence.

So you “log in” using you username and password and bingo you’ve given them everything they need to take control of your phone number and everything it’s connected to.