What's Your Number?
"Can you do me a favor? What's your number?"
It was a quick Instagram DM from a friend. Totally normal because friends ask for your number all the time... so she sent it.
Except it wasn't her friend.
It was a hacker who was already inside her friend's account. And now, he was inside hers too...messaging all her friends, pretending to be her, asking them to send money through Zelle and Paypal. Some of them did.
Then he messaged her: pay $2000 to get your accounts back or he'd delete them.
Not that big of a deal for a normie, but for this model and influencer with over 100K followers, that's her livelihood.
And she wasn't his only target. From 2019 to 2023, this particular hacker ran this playbook on hundreds of people, lots of them influencers or models, and it cost hundreds of thousands of dollars in losses.
|
The pattern we keep seeing
Your accounts are only as secure as the easiest way to reset them. For most creators, that's an email or a text message.
|
Your phone number is a skeleton key
Think about what happens when you click "forgot password." For most of your accounts, that means you get texted a code to your phone. And that means whoever gets your text gets access to your accounts.
Not just one account, though, all of them.
That's because your phone number is a skeleton key, the one key that can open every lock. Landlords have them, hotel managers have them, and your online life has them too. Digital skeleton keys are the things that can reset your other accounts, so for most folks, that means your phone number and your email address.
The problem with skeleton keys is that they're a single point of failure. You can have all the best security hygiene in the world: different passwords, all long and unique, stored in a password manager like you're supposed to, and none of it matters if someone can just click "forgot password" and have the reset land in their pocket. Then they don't have to break through the locks, they can just open them with your key.
The phone number is sneaky because it's usually the key to your other key. A lot of email accounts will let you recover them... with a text to your phone. So whoever holds the number can usually get access to your email, and from there, to every single one of your other accounts.
Here's how it works... it's called a SIM swap. Someone calls your phone carrier pretending to be you with a sob story, "I lost my phone, can you move my number to this new SIM?" and a well-meaning customer service rep, moves it. Your phone drops to "SOS only" and every reset code starts landing on their phone instead of yours.
For creators, your phone number is probably easier to find than the average person. It's in media kits, business inquiry forms, data broker sites... and your friends have it too, which means anyone who gets into a friend's account can just ask. That's what happened here. She didn't do anything negligent or careless, she just answered a friend.
Break the Chain
Most attacks work like links in a chain. Get your number → move your number → catch the reset code → lock you out → use your account to get the next person's number.
An attacker needs all those links in the chain to hold together, but you only need to break one of them (though we always try to break as many as we can). A skeleton key, like your phone number, makes the attacker's chain really short, so the goal is to make it longer again (add links they have to get through, and take the skeleton key totally off the key ring if you can).
- Turn on sim protection/number lock. Most major phone carriers have a setting that blocks your number from being moved or ported without extra verification. You're looking for something called SIM protection/Number lock/Port-out Lock.
Then, for each of your accounts (start with your primary email account... the other skeleton key), then your social media accounts, then the rest of them:
- Switch off text codes. If you can (some software won't let you), don't use text codes for 2FA (two-factor authentication), swap that out with an authenticator app like Proton Authenticator, or the authenticator in your password manager. That forces someone to have to have the authenticator to get into your accounts instead of your phone.
- Remove your phone number on "forgot passwords". If the platform will let you, use another method to reset your password other than your phone number. If that's still sitting there, the skeleton key is still live.
- Use passkeys where you can. A passkey is a login that lives on your device. It means there's no code to read to someone who is pretending to be a support agent, and nothing to type into any fake login pages. Not every app has this as an option, but where you can choose a passkey, do.
- Keep your team out of your texts. Lots of us keep text codes on because there's a manager or editor who needs them to get access to the accounts. Switch to a password manager that holds the authenticator code and you can share access without any of the text forwarding.
Each one of these steps disrupts one or more links in the chain, layer them all, and you're pretty well protected.
|
Your move · This week
|
Lock your number
Log into your phone carrier account and turn on number lock/SIM protection. If there's an option to set a port-out PIN, set that too. It only takes about five minutes and can make you WAY more protected,
|
|
On the Radar
|
What we're watching
|
|
|
Recommended Tool
Affiliate
Proton Pass
Proton Pass lets you set secure, unique passwords for all of your accounts, includes an authenticator (so you don't have to use those text codes), and lets you easily share the passwords with your team, without risking the security of your skeleton keys.
Try Proton Pass →
Affiliate link: we may earn a commission if you sign up, at no extra cost to you. We only recommend tools we use.
|
|
|
Stay safe,
Susan @ Unpublic
|
|
You're getting this because you signed up at unpublic.co.
Unpublic, PBC. · 600 1st Ave Ste 330 PMB 92768 · Seattle, WA 98104-2246
|
