Warning: Bad actors transferring out Tracfone numbers

[tomseys]

This security warning message is now being displayed on the Tracfone website.

If not visible on TF site, refresh browser to see message and link near top of site.


Attachment 170167

IMPORTANT INFORMATION:
If you were contacted by us via text message (from 611611) or e-mail it is important that you take action immediately and change your account PIN. When you change your PIN, do not reuse a PIN you have used before.

In order to reset and update your PIN you can use your My Account APP or click the brand below to login into your account and access Manage Profile.

If you experience a sudden loss of service, or are having difficulty with a number transfer, please contact customer service at 1-800-353-1842.

If you suspect unauthorized activity regarding your wireless service, and use your mobile number as a form of authentication on other accounts (e.g., financial accounts, social media accounts), consider changing passwords to these accounts immediately.

Attachment 170169

https://www.tracfonewirelessinc.com/...ecurityMessage

[hpham]

I wonder if TF database got hacked.

[tomseys]

Sounds like it. I think I'm gonna change my account pin and account passwords.

[Mosaic55]

“Important Customer Security Message
We were recently made aware of bad actors fraudulently transferring, or porting out, some mobile telephone numbers to other carriers. These bad actors may have also had access to your name, address, PIN code, account number, secret question (but not answer) and email address to the extent you provided us with such information.”

Hack from outside or inside data theft? Either way, time to change password and pin.

[tomseys]

I changed the account passwords and pin on 3 accounts (one a friend's).
Been meaning to do it anyway and now seems like a real good time so done.

[malet]

I went and changed my PWs, PINs, and security questions on my TF account and my SO's Net10 account. As is typical when dealing with the various TF MVNOs, the experiences were slightly different:

TF - no notice on the page after logging in about a security breach. I was able to get to account settings and edit my PW etc. once I was logged in with no further authentication, but had to enter my old PW to save the changes.

Net10 - there was a notice about this issue on the main page once I logged in. To edit my account settings I had to authenticate via either a text message or email to the number/address on the account (before it would update to the edit screen) but it then saved the changes I made without requesting the old password.

[tomseys]

Yeah I want ahead and also changed the security question/answer.
Thinking about changing email as well but I've left if like this for now.

[IsLand_BoY]

Ugh. T-Mobile has been having issues like this. You knew you were affected if you got a text message, or logged in and saw a message indicating so. This is a little harder since thieves were actually able to take the phone numbers so you obviously can't get a text message. Like others, I'm going to change my account PIN and password just to be safe but I don't see any message (yet) regarding this.

iCloud+'s "Hide My Email" feature is becoming more and more attractive to me. That way my real email address is not revealed and thieves can't use it to try and log into other things if you use individual emails on each website. Something to look into for those who pay for iCloud+ with Apple.

[tomseys]

To see the security message warning go to the TF site home page and it should be there at the top of the site. If it isn't, give it a refresh.

Attachment 170179


Attachment 170177


I see it on Chrome and Firefox.

[IsLand_BoY]

You may be able to see the message if you go to the TF site home page and refresh once if you are not seeing it.

I see it on Chrome and Firefox.

You're right, I had to refresh to see it. What kind of janky alert is that when you can't see it unless you refresh?? I'm using Safari.

I don't have anything really important tied to my TracFone numbers but I'd still be pretty annoyed if someone stole one of my phone numbers.

[hpham]

T-Mobile has been having issues like this. You knew you were affected if you got a text message, or logged in and saw a message indicating so.

I had postpaid T-mo accounts on and off from Jan 2020 to July 2021. I read that the data stolen from their database includes those of past and current customers. My account is no longer active, so I can't log in to check if I was affected. All I could do is beef up my credit file security and set up alerts when someone tries to use it.

Visible also had a bad breach but never acknowledged it. This happened when the iPhone 13 was introduced. The hackers got into customer accounts, changed their passwords and mailing addresses, then ordered new iPhone 13s from Visible to be shipped to those addresses. People noticed that their credit cards (on file with Visible) were charged for those purchases, but they couldn't get into their Visible accounts because the hackers had changed their passwords. Visible claimed the orders were placed from their Visible accounts and refused to take actions. That was a big mess. I had several active Visible accounts and that time but luckily was not affected.

[eohippus]

Thanks for the warning. I went and updated the PW and PINs in the TF accts I manage.

[rpz1]

Did any of you that changed your PW and Pin have to go through any verification process to do it? What's to keep the same hackers from just changing that info on your account if they have your info but haven't yet transferred the number ?

Wonder if their was a specific carrier or network they ported to.

[tomseys]

Did any of you that changed your PW and Pin have to go through any verification process to do it? What's to keep the same hackers from just changing that info on your account if they have your info but haven't yet transferred the number ?

Wonder if their was a specific carrier or network they ported to.

I only had to give the current account password to confirm the changes like usual. My guess is they may need the new password and pin and security answer plus contend with any changes TF has made. But I'm not sure.

I called corporate and one rep said that it is not a data breach, they just need the affected to change their pins.
I don't know how they got this other info provided by the account owner to TF then if that is true. I don't know so I just change what I can.

[pitflyer]

So the account password is used to login, and the account PIN is used when you transfer. Are there any other pertinent pieces of info to secure? I know zip code is often set to Miami by default -- does that matter? How about date of birth? Anyone know what we should be setting and securing?