Security expert on $12k stolen from Pennsylvania man’s account: ‘A human should have called and verified’

HARRISBURG, Pa. (WHTM) — Scott Zeiders thought his problems were solved when his cell phone started working again almost as quickly as it mysteriously stopped working.

Instead, the worst — by far — was yet to come.

“I drove home. My phone was working,” said Zeiders, who lives in Highspire. “Next day, I wake up, I see $12,000 wired out of my bank account at Wells Fargo.”

The longer version of what happened to his phone, Zeiders said, is someone logged into his Xfinity Mobile account using his username and password — he said he guesses someone got the information on the “dark web” of stolen information from other data breaches, although abc27 News couldn’t independently verify that.

How much of Pennsylvania is covered in woods and farmland?

Once in the account, he says that person changed his SIM card number — essentially, the number that associates a phone with a phone number — to a different number; they took control of his phone so his calls and texts went to them.

Then, he says, someone logged into his Wells Fargo account and initiated an $11,975 wire transfer. He says the bank sent a text message with a numeric code to his cell phone — a practice called multi-factor authentication, or MFA — and that code had to be entered to proceed with the wire transfer. The problem was, the code went not to Zeiders but to the person who stole the cell phone number, who — he says — entered it, and then the money was gone.

Zeiders said — and showed a message from the bank confirming — the bank tried to claw back the money to return it to Zeiders, but it couldn’t get the money (which had already been withdrawn from the destination bank) and thus couldn’t return it to him, which he says shocked him: The point of a bank, he says, is to keep money safe.

“I had no idea that I wouldn’t get the money back,” he said.

Zeiders blames Xfinity, whose parent company is Comcast, for not doing more to prevent the SIM card number from being switched and Wells Fargo for not doing more to prevent the wire transfer.

Based on Zeiders’s account of what happened, Jonathan S. Weissman, a security expert and principal lecturer at the Rochester Institute of Technology Department of Cybersecurity, agrees.

He says multi-factor authentication should be a requirement, not an option.

“The fact that companies today are not requiring multi-factor authentication for accounts allows attacks like this to happen by simply stealing a password or getting a password from a previous data breach,” Weissman said. “For a major configuration change like a SIM card, there have got to be multiple layers of protection to verify that the account user is the legitimate account user.”

“Our teams are investigating, and we’ve reached out to Mr. Zeiders to discuss this matter as well as safety measures to protect his account from ‘bad actors,'” a Comcast spokesperson said in a statement.

Did you know Pennsylvania is spelled ‘wrong’ on the Liberty Bell and Constitution?

The company doesn’t require MFA but encourages it with a series of security tips. Many companies have struggled to strike an optimal balance between making online accounts easy for legitimate users — but difficult for criminals — to access.

Wells Fargo did require an extra layer — the code sent to Zeiders’s cell phone number — but that wasn’t enough, because the phone number had been stolen. Zeiders, a retired truck driver, says the transaction was highly unusual and should have raised a red flag; Weissman agreed, based on Zeiders’s account.

“Even with verification through multi-factor authentication in text messages, for something of this magnitude, a human should have called and verified because this was anomalous behavior,” Weissman said.

Zeiders said Wells Fargo told him it is attempting to set up a conference call with him and Comcast to learn more about how his phone was compromised before the bank makes a final decision.

“We are continuing to work with the customer on this issue,” Wells Fargo said in a statement. “When a customer files a fraud claim, we conduct a thorough review. In some instances, such as this specific claim, additional information may be required for us to complete our investigation.

“Scams are an industry-wide concern,” the statement continued, “and we never want to see anyone become a victim. We are actively working to raise awareness of common scams to help prevent these heartbreaking incidents through various resources, including ongoing education efforts.”

The bank said bank customers bear some responsibility for preventing fraud. An example of when a customer — according to the bank — could be out the money permanently?

“We want everyone to know that if you provide someone remote access to your computer or mobile device that enables them to access your bank account and remove funds, you may be responsible for those transactions,” the statement said.

The precise tactic used by the fraudster to access Zeiders’s account remains unconfirmed. More tips from the bank are below.

Toddler hit, killed by train in Cumberland County

Zeiders had another source of hope: $15,000 of identity-theft protection under his Farmers homeowner’s insurance policy. But he said the company denied his claim, before later paying him $250.

“After a thorough review of the facts of this loss, we have issued payment to our customer for the portion of their claim that is covered by their policy,” Farmers said in a statement.

The company didn’t elaborate, but insurance companies generally have strict definitions regarding what constitutes identity theft, as opposed to other monetary crimes.

Zeiders is holding out hope the bank will restore his losses after it learns more about the case. Otherwise, his last hope is Pennsylvania’s Victims Compensation Assistance Program, or VCAP.

Wells Fargo provided these additional tips:

• Be wary of unexpected calls, texts, social media posts, or emails from scammers impersonating tech support companies, financial institutions, and government agencies.

• Don’t trust caller ID. Scammers can “spoof” legitimate numbers.

• Never give control of your computer to anyone who contacts you.

• Don’t share personal information. Never give out passwords, PINs, or access codes.

• Don’t be afraid to end communication with the person who contacted you and take time to research what that person is telling you.

• If you’re concerned about your computer, call your security software company directly using the number on the company’s website.

For the latest news, weather, sports, and streaming video, head to ABC27.