I'm writing this here 1) so I have a log of what i did to refer to in case it happens again and 2) the lady at the Tmobile store said they're seeing 3-4 people per day come in and report this happening.
If you didnt already know late last year Tmoble got hacked and the data for 50 million users was/is compromised. Apparently mine was one of them because, Im assuming, they cross-reffed my email to find I also had a coinbase account. For the past few days I've been getting 3 or 4 text alerts per day from CB sending me login codes so I knew someone was poking around my account.
Then yesterday someone in Laurel, Maryland went into a Tmobile store yesterday evening and purchased a sim card, then convinced store employee ****058 to port my sim info onto that card and allowed them to put it into a old crappy Nokia. That allowed them to get text messages meant for me. This happened around 6:55pm EST.
I got an email around 830 central time telling me "Tmobile has completed the imsi number transfer you requested" and about 3 minutes later my phone showed a "No Service" tag. Since I was on wifi I immediately opened coinbase and saw my account was making transactions in real time. The hacker had cut off my ability to make calls even on wifi so I went next door and my neighbor let me use their phone to call Coinbase fraud protection. On the 4th attempt when I actually got thru to a live person they flagged the fraud and locked the account. They were my first call since avoiding monetary loss was my primary objective. Luckily all they'd been able to do was a switch some of my ETH to BTC so I didn't technically lose anything, at least what CB fraud protection told me. While I was on the phone with them I logged into the Tmobile site and reported my phone as stolen since that locks the line.
After that I made the call to Tmobile customer service (smart of the hacker to wait until Sunday when stores were closed earlier and most CS lines are down) and spent 90 minutes with Margie from I'm guessing India explaining to her what happened and proving my identity. She blocked the spoofed sim card and then attempted to transfer the rights to the phone line back to my sim card. This did not work so I had to go in to a physical store this morning (as of this writing the store off of 95th and Quivira is closed for remodeling and the store at 119th and Mur-len in Olathe is packing up and closing down - just a heads up in case you have to go to one also) so i ended up at 151st and Black Bob - i told them I'd been hacked and my phone wasnt working and they said It'd be an hour long wait while they helped some 70 year old guy create an MLB.com account and some Karen who was throwing a fit her iphone 13 order hadn't arrived.
The lady said "we can call you when youre up" and I told her no she couldnt because the phone didnt work, I left and ended up finding another store in southwest Olathe - they got me a new sim and put my account into the "port protection program" which is their program to protect against this thing happening to you (I didnt bother asking why you need to opt into it instead of it just being a thing already).
So anyway, if this happens to you there's a rough idea of how to handle it.
If you didnt already know late last year Tmoble got hacked and the data for 50 million users was/is compromised. Apparently mine was one of them because, Im assuming, they cross-reffed my email to find I also had a coinbase account. For the past few days I've been getting 3 or 4 text alerts per day from CB sending me login codes so I knew someone was poking around my account.
Then yesterday someone in Laurel, Maryland went into a Tmobile store yesterday evening and purchased a sim card, then convinced store employee ****058 to port my sim info onto that card and allowed them to put it into a old crappy Nokia. That allowed them to get text messages meant for me. This happened around 6:55pm EST.
I got an email around 830 central time telling me "Tmobile has completed the imsi number transfer you requested" and about 3 minutes later my phone showed a "No Service" tag. Since I was on wifi I immediately opened coinbase and saw my account was making transactions in real time. The hacker had cut off my ability to make calls even on wifi so I went next door and my neighbor let me use their phone to call Coinbase fraud protection. On the 4th attempt when I actually got thru to a live person they flagged the fraud and locked the account. They were my first call since avoiding monetary loss was my primary objective. Luckily all they'd been able to do was a switch some of my ETH to BTC so I didn't technically lose anything, at least what CB fraud protection told me. While I was on the phone with them I logged into the Tmobile site and reported my phone as stolen since that locks the line.
After that I made the call to Tmobile customer service (smart of the hacker to wait until Sunday when stores were closed earlier and most CS lines are down) and spent 90 minutes with Margie from I'm guessing India explaining to her what happened and proving my identity. She blocked the spoofed sim card and then attempted to transfer the rights to the phone line back to my sim card. This did not work so I had to go in to a physical store this morning (as of this writing the store off of 95th and Quivira is closed for remodeling and the store at 119th and Mur-len in Olathe is packing up and closing down - just a heads up in case you have to go to one also) so i ended up at 151st and Black Bob - i told them I'd been hacked and my phone wasnt working and they said It'd be an hour long wait while they helped some 70 year old guy create an MLB.com account and some Karen who was throwing a fit her iphone 13 order hadn't arrived.
The lady said "we can call you when youre up" and I told her no she couldnt because the phone didnt work, I left and ended up finding another store in southwest Olathe - they got me a new sim and put my account into the "port protection program" which is their program to protect against this thing happening to you (I didnt bother asking why you need to opt into it instead of it just being a thing already).
So anyway, if this happens to you there's a rough idea of how to handle it.
