EE texted to say they had processed my sim activation request, and the new sim would be active in 24 hours. I was told to contact them if I hadn’t requested this. I hadn’t, so I did so immediately. Twenty-four hours later, my mobile stopped working and money was withdrawn from my bank account.
With their alien sim, the fraudster infiltrated my handset and stole details for every account I had. Passwords and logins had been changed for my finance, retail and some social media accounts. Worst of all, two longstanding email accounts are forever irretrievable as the hacker set up their own two-factor authentication, allowing them to halt any password alteration requests, and change my lifelong mobile number.
I have experienced four weeks of stress and misery, a loss of data and funds, and unfathomable customer relations.
JN, Bath
You have fallen victim to sim swap fraud, where criminals trick a mobile phone provider into transferring a number to a sim card in their possession. This allows them to receive texts, including two-factor authentication codes, giving them access to victims’ bank accounts. Providers will never disclose what security information they require before activating a new sim, but it seems the fraudster must have got hold of your personal details after hacking into your email account. Be that as it may, you did what you were supposed to do and alerted EE as soon as it notified you. That’s where things should have ended.
EE blames an unfortunate coincidence of timings. You and the fraudster were on the phone to EE at the exact same time, it says. The fraudster was in the last stages of the sim activation when you rang to report suspected fraud. Your account was flagged after you had hung up, but by then the account activation order was already being processed.
The fraudulent sim was automatically activated after 24 hours. The 24-hour grace period is, EE tells me without irony, to let customers get in touch if they did not request a sim.
The company is unapologetic and appears to lay the blame squarely with you for allowing the fraudster to glean your personal details. It says it blocked the fraudster’s sim and issued you with a new one. If you want to take this further, you could complain to the Communications Ombudsman. In the meantime, I’d set up a pin code for communications with EE and stop using your phone number as ID.