“Mobile emulator farms” used to steal millions from US and EU banks

Besides the fact that Sim-swap attacks are still super common, if they've compromised the Android devices themselves (as is implied in the article) then they could grab the Device ID that way and potentially add some SMS-forwarding malware perhaps?

Would explain the preparedness for phone emulation and the thought of it too.

Same regarding GPS, this is really prevalent on darknet market tutorials and services, where you get the ID and credit card of someone (large markets for that called fullz) and then find a compromised windows computer near that residential/billing address (there are whole markets for that called rpc, sorted by bandwidth and location) and then run the credit card but from a computer near where the owner lives, to avoid being flagged.

What happened here seems to be a mixture of those concepts, to address bank accounts without getting flagged.

Air time is practically free and untraceable. How do you think the ‘I’m Bob with Microsoft’ scam works?

The problem is that SMS 2FA is more user friendly.

App based 2FA requires user to download Google Authenticator, copy the key there, copy the resulting number out. It’s a lot of friction. And on top of that users can lose the 2FA key.

SMS is less secure, cloneable, but it reduces friction, which in turn results in more revenue. And without revenue, there will be nothing at all, secure or not.

When the cost of fraud handling exceeds that of redoing their security, I guess. It'd have to be a 10x or more factor though, because companies seem to be quite accepting of existing / recurring costs.

That said, my banks have had 2FA for a long time. The one started off 20 years ago with a device where you'd punch in the numbers on screen, it would give you some numbers back. The second version required you to insert your bank card, PIN, and the number on screen, while the website asked for your account number and card number. The third version that I'm using nowadays is pretty much the same, but instead of punching a code it has a camera that scans a color-QR code on screen.

The other bank used to send printed lists of one-time codes, where the website would say 'type the code at index xyz'. Later they went for SMS-based 2FA, I think they're still on that nowadays.

Both have mobile apps, and use PIN codes or Face ID for quick access. They know it's a higher risk than their 2FA solutions, so they limit the maximum amount that can be transferred (thus limiting their own damage). The limit has slowly increased over time as their security proved itself. In essence it's like an insurance policy, whose price changes depending on risks and track record.