Verizon’s wholly owned TracFone unit settled with the FCC for $16 million after data breaches left customers vulnerable.
Verizon subsidiary TracFone Wireless has agreed to write a $16 million check to cover a civil penalty that has been imposed on it by the FCC. The company was charged the penalty following an investigation into three separate data breaches that occurred between January 2021 and January 2023. The first one was discovered in December 2021 and resulted in numerous attempts by the attackers to transfer customer phone numbers to other carriers without the permission of the subscribers whose phone numbers were involved.
This attack is known as port-out fraud which is when criminals, using stolen personal information, trick the wireless firm, in this case TracFone, into believing that a customer has made a legitimate request to move his account to another one he has with a different carrier. Instead, the customer’s wireless service is ported over to an account owned by the attacker who then takes over the phone and the apps installed by intercepting phone calls, SMS messages, and two-factor authentication codes. This allows the attacker access to the victim’s bank, securities, credit card and cryptocurrency accounts draining all of the available funds in seconds.
