Bitcoin Forum
July 23, 2019, 08:16:35 AM *
News: Latest Bitcoin Core release: 0.18.0 [Torrent] (New!)
 
   Home   Help Search Login Register More  
Pages: [1]
  Print  
Author Topic: [2018-08-15]U.S. investor sues AT&T for $224 million over loss of cryptocurrency  (Read 56 times)
vit05
Hero Member
*****
Offline Offline

Activity: 672
Merit: 524



View Profile
August 15, 2018, 05:10:59 PM
 #1

REUTERS

NEW YORK (Reuters) - U.S. entrepreneur and cryptocurrency investor Michael Terpin filed a $224 million lawsuit on Wednesday against telecommunications company AT&T (T.N), accusing it of fraud and gross negligence in connection with the theft of digital currency tokens from his personal account.
In a 69-page complaint filed with the U.S. District Court in Los Angeles, Terpin alleged that on January 7, 2018, the tokens were stolen from him through what he alleged was a “digital identity theft” of his cellphone account. In the complaint, he said AT&T was his service provider.

In an emailed response, an AT&T spokesman said: “We dispute these allegations and look forward to presenting our case in court.”

At the time of the theft, the three million stolen tokens were worth $23.8 million, the complaint said. Terpin is also seeking $200 million in punitive damages.

The complaint said that AT&T had been previously contacted by law enforcement authorities about such frauds.

AT&T Inc
32.495
T.NNEW YORK STOCK EXCHANGE
+0.25(+0.79%)
T.N
T.N
Cryptocurrencies have a market capitalization of about $200 billion, according to data from virtual coin tracker coinmarketcap.com. Nine years after bitcoin came into existence, the market has seen the emergence of more than 1,800 digital currencies.

Terpin, represented by Los Angeles litigation firm Greenberg Glusker, claimed in the lawsuit that after the theft of the digital currency, his cellphone account was transferred to an international criminal gang.

Terpin co-founded the first angel group for bitcoin investors, BitAngels, in early 2013, and the first digital currency fund, the BitAngels/Dapps Fund, in March 2014. He is a senior advisor to Alphabit Fund, one of the world’s largest digital currency hedge funds.

The complaint claimed that the theft of the tokens occurred through what is called a SIM swap fraud. SIM stands for subscriber identification module, and SIM cards are used to authenticate subscribers on mobile phones.

SIM swapping consists of tricking a provider into transferring a subscriber’s phone number to a SIM card controlled by someone else. Once that person gets the phone number, it can be used to reset the subscriber’s passwords and access online accounts.

Reporting by Gertrude Chavez-Dreyfuss; Editing by Toni Reinhold and Nick Zieminski

Our Standards:The Thomson Reuters Trust Principles.
1563869795
Hero Member
*
Offline Offline

Posts: 1563869795

View Profile Personal Message (Offline)

Ignore
1563869795
Reply with quote  #2

1563869795
Report to moderator
The network tries to produce one block per 10 minutes. It does this by automatically adjusting how difficult it is to produce blocks.
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction. Advertise here.
1563869795
Hero Member
*
Offline Offline

Posts: 1563869795

View Profile Personal Message (Offline)

Ignore
1563869795
Reply with quote  #2

1563869795
Report to moderator
Samarkand
Sr. Member
****
Offline Offline

Activity: 574
Merit: 278


View Profile
August 17, 2018, 06:40:42 AM
 #2

...
SIM swapping consists of tricking a provider into transferring a subscriber’s phone number to a SIM card controlled by someone else. Once that person gets the phone number, it can be used to reset the subscriber’s passwords and access online accounts.
...

This is an attack vector that is often used to bypass the 2FA that secures the exchange
accounts of many people. Usually it isn´t that difficult to trick the customer service
of the provider into transferring a phone number (even if they ask you a few security
questions, the answers to these questions are usually not too difficult if you have researched the
victim or know them in person).

I´d advise anyone to not keep a meaningful amount of funds on an exchange even
if they offer additional security-related features like 2FA. As this example shows
2FA is vulnerable to this kind of social engineering attack.
snipie
Legendary
*
Offline Offline

Activity: 1358
Merit: 1007


sMerit4art:bitcointalk.org/index.php?topic=2957836


View Profile
August 17, 2018, 06:40:48 AM
 #3

Too bad for AT&T, apparently they will have to pay since it is clearly its fault but I doubt the punitive damage will be accepted as it is by the court.

Kemarit
Legendary
*
Offline Offline

Activity: 1330
Merit: 1152


View Profile
August 17, 2018, 07:28:15 AM
 #4

Let this be a lessons learned for cellphone providers, those hackers are really a pain in our community. Yes, this 2FA is also vulnerable and exploits has been reported already. We can even say that 2FA isn’t always totally secure and perhaps we really need to be aware that at any moment, you will be hacked. So make the necessary precautions as just like @Samarkand, its not a smart thing to put a lot of money in your crypto trading account.

1Referee
Legendary
*
Offline Offline

Activity: 1946
Merit: 1326

Segwit please.


View Profile
August 17, 2018, 10:55:32 AM
 #5

I´d advise anyone to not keep a meaningful amount of funds on an exchange even
if they offer additional security-related features like 2FA. As this example shows
2FA is vulnerable to this kind of social engineering attack.

When people talk about not having 'meaningful' amounts sitting in their exchange accounts it's all relative to the person. In other words, what you consider to be a lot money is literally pocket change for others. Some times I see insanely large buy or sell walls (worth millions $$) pop up that I ask myself why would someone have that much funds on an exchange, but then you have to think about the main rule of there always being a bigger fish than you, which helps you put things into perspective.

In the end there is no way for traders to not be exposed to counterparty risks. People can say you should withdraw your funds immediately, but that doesn't go up for traders with sessions lasting days and some times weeks. In most cases smart and responsible traders never leave more than 10% of their total stash on an exchange.

audaciousbeing
Hero Member
*****
Offline Offline

Activity: 980
Merit: 559


XETHER - BET ON HONESTY!!!


View Profile
August 17, 2018, 11:31:53 AM
 #6

Even though this might not turn out to give the best outcome, its still going to make a statement that telecommunication service providers equally owe us significant duty of care in keeping our assets safe. Today, even in the fiat world, you bank account is linked to your mobile number that which means there should be another level of security that should happen at that point to ensure that when I lost my phone, I don't only lose a gadget but my entire assets.

I have read about people losing money in their bank accounts because they lost their phones and someone else retrieved the sim card without their authorization only to have access to classified information. Its not far that this is case of what is happening here that those people only believes they are doing you a favor by allowing you use their services. I just wished someone sue both the banks and the telecommunication providers in the case of fiat losses and both the telecommunication and the wallet providers in the case of crypto.



       ▄▄██████████▄▄     
     ▄████████████████▄   
   ▄████████████████████▄ 
  ▄██████████████████████▄
 ▄███████████████████████▄
▐██████████████████████████▌
▐██████████████████████████▌
▐██████████████████████████▌
▐██████████████████████████▌
 ▀███████████████████████▀
  ▀██████████████████████▀
   ▀████████████████████▀ 
     ▀████████████████▀   
       ▀▀██████████▀▀     

                   ▄▄████
              ▄▄████████▌
         ▄▄█████████▀███
    ▄▄██████████▀▀ ▄███▌
▄████████████▀▀  ▄█████
▀▀▀███████▀   ▄███████▌
      ██    ▄█████████
       █  ▄██████████▌
       █  ███████████
       █ ██▀ ▀██████▌
       ██▀     ▀████
                 ▀█▌

             ▄████▄▄   ▄
█▄          ██████████▀▄
███        ███████████▀
▐████▄     ██████████▌
▄▄██████▄▄▄▄█████████▌
▀████████████████████
  ▀█████████████████
  ▄▄███████████████
   ▀█████████████▀
    ▄▄█████████▀
▀▀██████████▀
    ▀▀▀▀▀

 ▄███████████████████▄
██████▀▀▀▀▀▀▀▀▀▀▀██████
████▀ ▄▄▄▄▄▄▄▄▄▄▄ ▀████
███  █████▀▀▀██  █  ███
███  ███▀ ▄▄▄ ▀███  ███
███  ██▀ █████ ▀██  ███
███  ██▄ █████ ▄██  ███
███  ████ ▀▀▀ ████  ███
███  █████▄▄▄█████  ███
████▄ ▀▀▀▀▀▀▀▀▀▀▀ ▄████
██████▄▄▄▄▄▄▄▄▄▄▄██████
 ▀███████████████████▀

   ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
 ▄█████████████████████████▄
 ███████████████████████████
▐███████████████████████████▌
▐███████████  ▀█████████████▌
▐███████████     ▀██████████▌
▐███████████     ▄██████████▌
▐███████████  ▄█████████████▌
▐███████████████████████████▌
 ███████████████████████████
 ▀█████████████████████████▀
   ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
[
FXTradingPro
Newbie
*
Offline Offline

Activity: 97
Merit: 0


View Profile WWW
August 17, 2018, 01:46:12 PM
 #7

Even though this might not turn out to give the best outcome, its still going to make a statement that telecommunication service providers equally owe us significant duty of care in keeping our assets safe. Today, even in the fiat world, you bank account is linked to your mobile number that which means there should be another level of security that should happen at that point to ensure that when I lost my phone, I don't only lose a gadget but my entire assets.

I have read about people losing money in their bank accounts because they lost their phones and someone else retrieved the sim card without their authorization only to have access to classified information. Its not far that this is case of what is happening here that those people only believes they are doing you a favor by allowing you use their services. I just wished someone sue both the banks and the telecommunication providers in the case of fiat losses and both the telecommunication and the wallet providers in the case of crypto.



We often focus on how exchanges need to protect us but this clearly illustrates that telecoms need to do their part as well. If this suit is won by the plaintiff I am sure we will see changes to address the issue. It also might mean that we will see additional language in the terms and conditions that will try and limit liability in the event of asset theft.
FlamingFingers
Sr. Member
****
Offline Offline

Activity: 588
Merit: 270



View Profile
August 17, 2018, 02:03:09 PM
 #8

For the life of me, I can't fathom why people still trust phone authentication—since 2016, it has been proven to be vulnerable to social engineering hack practices (and not complex by any means). It is still the major authentication method on Asian exchanges (particularly Chinese) and it is not good. One should take all security measures when it comes to using money online (whatever that might be).


                         ███████
                      ████    ████
                      ███       ███
                      ███       ███
                       ████   ███
                         ███████

               
        
        ██████████████                ██████████████
     ███████████████████         ████████████████████
   ███████████████████████████████████████████████████
 ████████████    ██████████████████████████    █████████
███████████                                     ███████                                 
████████████    ██████████████████████████    █████████ 
   █████████████████████████████████████████████████
        ███████████████              ███████████

                                     
      ██████████████                ██████████████
     ███████████████████         ████████████████████
   ███████████████████████████████████████████████████
 ████████████    ██████████████████████████    █████████
███████████                                     ███████                                 
████████████    ██████████████████████████    █████████ 
   █████████████████████████████████████████████████
        ███████████████              ███████████
AUDITCHAIN
.
   ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀   ▀▀▀▀▀▀▀▀
.



.
.


.
READ OUR WHITEPAPER
.
YouTubeRedditLinkedInInstagramMedium
▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
.
squatter
Hero Member
*****
Offline Offline

Activity: 1162
Merit: 852


STOP SNITCHIN'


View Profile
August 17, 2018, 07:58:59 PM
 #9

Too bad for AT&T, apparently they will have to pay since it is clearly its fault but I doubt the punitive damage will be accepted as it is by the court.

It’s clearly their fault in a literal sense, but that doesn’t mean they have to pay. The law (Data Protection Act, etc.) calls for exercising some sort of reasonable care in authenticating customers. Across most industries, the threshold is pretty low. Usually all a hijacker needs is your account #, name, and a few pieces of identifying info about you.

That’s why it’s been an industry standard among exchanges for years now to offer at least TOTP authentication for 2FA. Anyone linking a phone number to an exchange account is asking to get robbed.

Pages: [1]
  Print  
 
Jump to:  

Sponsored by , a Bitcoin-accepting VPN.
Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!