U.S. Investor Sues AT&T for $224M Over SIM swap and Loss of Cryptocurrency | Hacker News Reader

U.S. Investor Sues AT&T for $224M Over SIM swap and Loss of Cryptocurrency

money.usnews.com

31 pointswalterbell6 comments

This seems like a frivolous lawsuit to me. I would argue that the exchange/wallet provider is more at fault here (if applicable) for using poor security. SIM hacking/SMS intercepting is something that should be addressed, but these issues have been known for quite some time. Companies shouldn't be relying on them as authentication mechanisms. Seems like he is grasping at straws here since he can't sue BYOB (Be Your Own Bank).

edit:

I found the actual text of the lawsuit here, and it's hilarious.

https://www.law.com/therecorder/2018/08/15/prominent-crypto-...

The hackers also used the phone to hijack Mr. Terpin’s Skype account to impersonate him. By that means, the hackers convinced a client of Mr. Terpin to send them cryptocurrency and diverted a payment due to Mr. Terpin to themselves.

Yep, AT&T totally at fault here!

I don't know, I feel that AT&T should support greater security in their accounts -- after all they'd certainly have been happy to bill the user for usage if the hijacked usage had incurred charges.

ATT is infrastructure at this point, and a critical one at that since even the government uses your phone number as your identity. As such, it must be held to a higher standard like utilities are.

There are huge American banks that rely on SMS as a form of 2FA. It's totally unacceptable for AT&T to happily hand over a SIM activated against somebody's phone number without performing basic identity verification checks, especially since AT&T committed to addressing these failures under the terms of a 2015 settlement with the FCC.

Frankly, I'd be delighted to see AT&T get thrown under the bus for this and have to start paying out damages when it can be shown that the company failed to conform with its own documented security policies.

In the unlikely event that Mr. Terpin is reading this, could he please contact me? I lost big money through a similar attack and would like to join as a plaintiff.

Incidentally, I also lost big on Gox... though, in hindsight, since the money is tied up in Japanese bankruptcy/civil rehabilitation courts, it is in a way, also, protected..

The problem is ATT never claimed that sms for auth is secure. People just assumed that and started doing it.

Reply on news.ycombinator.com