T-Mobile sued by victim of port-out scam for not validating PIN
Carlos Tapang is suing T-Mobile for not properly enforcing its security measures for customer account access after a scammer was able to move his account over to another network and drain his cryptocurrency accounts. This suit comes as the carrier begins to notify its subscribers on how to protect themselves from these port-out scams.
Tapang claims that his, his daughter’s and his wife’s phones had apparently performed factory resets without them knowing. After trying to connect with a T-Mobile customer service center, he discovered that his account was closed and moved to AT&T.
What’s more, the carrier actually realized that Tapang did not commit the cancellation:
T-Mobile admitted to Mr. Tapang that, based on its records, he did not authorize the cancellation and transfer of his phone number to AT&T. T-Mobile was unable to contain this security breach until the next day or so when T-Mobile was finally able to get Mr. Tapang’s phone number back from AT&T.
The suit alleges that in the meantime, the malicious actor was able to lock Tapang out of his OmiseGo and BitConnect cryptocurrency accounts and were able to obtain 2.875 Bitcoin — worth about $20,000 at the time of transfer and could have been worth as much as $55,000 at Bitcoin’s peak valuation in late December.
And while T-Mobile is currently out getting people to set up passcodes dedicated specifically to confirm that a customer was switching carriers, Tapang had already set up an account access PIN back when he set up his account in 2015 — he was told that the PIN would be validated before major account actions were taken.
More claims alleged against T-Mobile include the failure to suspend attempts to access an account after too many failures, the irresponsible sharing of user credentials by customer service agents in validating account access and the lack of any general framework to prevent and recover from a failure in the system.
The suit is seeking damages including a triple penalty for a breach of a clause in the Washington Consumer Protection Act, where Tapang resides.
The Register has the full suit available and we’ve linked to it below.