SIM swap: how a phone number stops being yours
Nothing is hacked. The number is moved by the company that owns it, on a request that looked legitimate — and your phone losing signal is the only warning you get.
Tag
#Account takeover
The filter scam that asks you to log in first
The filter is the packaging; the login is the product. Why a real effect never needs your social password on another website, and what to do in what order if you gave it.
A deepfake call is no longer easy to spot
Faces and voices are synthesised live from material already public. The visual tells are disappearing — the behavioural ones are not, and neither is calling back on a number you already had.
The OTP code you were told to read out
The message arrives from the right number, because they caused it to be sent. Why the request itself is the answer, and the one method that cannot be spoken aloud.
The support chat that opened by itself
Because you arrived rather than being contacted, every instinct about unsolicited approaches is disabled — and searching for a helpline is how most people get there.
Checking an invoice before you pay it
It rides on a real transaction between two parties who genuinely owe each other money, with one field changed — which is why it survives the scrutiny that stops other frauds.
The refund that needs your bank details to process
Being owed money switches off the caution that being asked for money turns on. One fact disqualifies nearly every version of it, and small businesses get the inverted variant.
Your recovery options are the real password
Account takeovers rarely start with a guessed password. They start with a recovery email or phone number nobody had checked in years — and the change is designed not to be noticed.
SMS codes, authenticator apps, passkeys: which actually stops account takeover
All three are called two-factor authentication and they are not equivalent. Two of them can be phished in real time; one cannot, for a structural reason worth understanding.