Cellphone industry leaves Canadians vulnerable to identity theft

'Phoneporting' makes victims vulnerable to ID theft The CRTC and the cell phone industry have made it so easy to keep your cell phone number and move it around that it's easy for thieves to hijack it too.

Thieves have found a way to steal your identity by hijacking your phone number and the Canadian Radio-television and Telecommunications Commission and the cellphone industry have made it easy for them to do that.

Our cellphone is the key to unlock many of our accounts. A code or a link sent via text is all that’s needed to unlock sensitive accounts to reset passwords and login information. And if someone hijacks your phone number, they have the tool they need to steal from you.

It happened to a Vancouver woman.

“If they have your number, they’ve got everything,” said Krystal Ho.

In her case, thieves gained access to her PayPal account and started buying expensive merchandise worth thousands of dollars.

“A lot, a lot of money,” she said, refusing to disclose just how much.

She was on her home Wi-Fi when she started getting emails notifications about changes to her PayPal account.

“Suddenly your PayPal password has been changed. If you didn’t do this, call us right away. Hit the call button. Phone failed. Couldn’t call out,” she said.

Then she got another email stating her email address had been updated.

“So I’m like no. And then I’m calling. Phone failing then I got into panic mode.”

Ho said she rushed to her office and got on the phone.

“And immediately called PayPal, called Rogers – freaked out on them,” she said.

Her phone number had been moved to Bell, the parent company of CTV News, and it wasn’t that difficult to do.

All that’s needed is a phone number and the account number associated with your current provider to move or ‘port’ your number to a new SIM card and a new phone.

Rogers gave Ho the Bell account number now associated with her phone number and she said she immediately went to a Bell store.

“I ran to Bell and said, 'Hey you have my phone number. This is my phone number, this is my name, this is my account number with you guys. Give it back. And they gave it back to me on a SIM card.'”

And she said she wasn’t asked for identification.

“The amount of people that I’ve heard that it happened to is insane,” said Ho.

It’s not too difficult for thieves to gain access to basic information like a phone number and an account number associated with a provider. Through social engineering, they can often gather enough information to be able to use to trick some cellular customer service representatives out of needed information.

| Related - Beware of thieves hijacking your phone number |

The CRTC set out the standards to make it easy to move your number from one carrier to another. The Canadian Wireless Telecommunications Association administers the rules which the carriers follow.

Ho said she had to convince Rogers to put an extra layer of protection on her account to prevent anyone else from hijacking her number.

“You shouldn’t have to be a victim in order to get protected,” Ho said.

Rogers told CTV News, “In regards to porting, we are working with the Canadian Wireless Telecommunications Association to review ways to increase customer protections while also adhering to the guidelines that ensure customers can easily switch providers and keep their phone number.”

Bell said it would add porting protection “on an exceptional basis, as port blocking doesn’t comply with the number portability rules.”

Bell stated, “It’s working with CWTA and other wireless carriers on a review of the porting rules to look at possible solutions to combat porting fraud without making it more difficult for customers to switch providers.”

Telus stated, “TELUS has proposed changes that will prevent numbers from being ported unless customers validate – by responding to a text message – that they actually requested the number port. Outside of the CWTA process, we recently introduced a one-way SMS notification (text message) that asks our customers to contact us if they have not requested a port, but we believe that any industry-wide process for porting must have two-way validation as a cornerstone.”

That makes sense to Ho.

“Why would I be uncomfortable if I was porting my number out to have someone call me and say, 'Hey, we’re just double checking, it’s you porting your number out.'”

But the changes must be made by the CWTA. It declined an on-camera interview and sent CTV News an email, “The issue you raise is one of the issues that the Canadian Wireless Number Portability Group is looking at as part of its can ongoing review of the Guidelines to determine if improvements be made without sacrificing the benefits that number portability provides for consumer choice and competition within the industry.”

Ho was fortunate she was on Wi-Fi at the time of the theft and was able to respond quickly. She said she restored her PayPal account, called all the retailers where the merchandise was purchased and blocked the deliveries and worked with them to help return the money to her bank account which was linked to PayPal.

“It’s ridiculous, for someone to just be able to go and take something, just claim it’s theirs, you’re so, so at risk,” she said.