For years, organizations have encouraged users to enable multi-factor authentication (MFA), use one-time passwords (OTPs), and protect their accounts with passcodes. Those controls remain important. However, a recent attack against my own wireless services account demonstrated that point-in-time authentication is no longer sufficient against determined identity-focused adversaries.
What began as a seemingly routine customer service call quickly evolved into a coordinated attack that combined social engineering, identity impersonation, stolen personal information, SIM swapping, session hijacking, and unauthorized account changes. Although the attackers ultimately failed to achieve full account takeover due to rapid detection and response, the incident exposed significant weaknesses in how organizations continue to treat identity as a one-time event rather than something that must be continuously evaluated throughout the customer journey.
Attack Stage 1: Establishing Trust
The attack began with an unsolicited call from someone claiming to represent my wireless carrier. The phone number was not flagged as suspicious, and the caller opened with a customer satisfaction survey and discussion of loyalty discounts. The conversation felt natural and personalized, demonstrating familiarity with my account before requesting any authentication information.
