SIM-bytter, databrud og stjålne konti: hvordan svindlere forvandler lækager til rigtige penge

/Teknologi/ Af

Databrud er blevet så rutineprægede, at mange mennesker behandler dem som baggrundsstøj – en irriterende e-mail, en nulstilling af adgangskode og så tilbage til livet. Men den virkelige fare opstår ofte senere, når lækkede detaljer sys sammen til målrettede angreb, der føles personlige, plausible og svære at stoppe.

En BBC-undersøgelse af svindelofre viser, hvordan denne pipeline fungerer i praksis: gamle datalækager hjælper kriminelle med at præstereSIM-swap-angreb, kapre e-mailkonti, åbne kredit i nogens navn eller overtage kontrollen over virksomhedens reklamekonti. Det, der ligner "bare en lækage af e-mailadresse", kan blive en direkte vej til penge, identitetssvindel og måneders oprydning.

Denne forklaring gennemgår mekanismerne: hvordan SIM-swaps lykkes, hvorfor tofaktorgodkendelse kan mislykkes, og hvilke praktiske trin der rent faktisk reducerer risikoen.

"Brach-to-scam"-pipelinen (på almindeligt dansk)

De fleste svindelnumre, der ender med stjålne penge, følger en gentagende rækkefølge:

  1. Personoplysninger eksponeres(gennem et brud på en virksomhed, du brugte for år siden).
  2. Kriminelle beriger detved at kombinere flere brud, offentlige oplysninger og sommetider datakilder.
  3. De går efter det svageste led(et mobilnummer, en e-mail-indbakke eller en arbejdsgang med "glemt adgangskode").
  4. De eskalerer— bruger det første kompromis til at nulstille adgangskoder og overtage andre konti.

BBC's cyberkorrespondent Joe Tidy bemærker, at det at være offer for et brud øger din chance for at blive målrettet. Nøglen er ikke, at ethvert brud fører til svindel, men at brud leverer de råmaterialer, som kriminelle har brug for til troværdig efterligning.

SIM-swap-angreb: hvorfor dit telefonnummer er en masternøgle

I ét tilfælde fortalte en kvinde ved navn Sue BBC, at hendes digitale liv blev kapret via enSIM-bytte.

Et SIM-swap-angreb fungerer sådan her:

  • En kriminel overbeviser en mobilnetoperatør om, at de er den rigtige kontoindehaver.
  • Operatøren udsteder et nyt SIM-kort (eller overfører nummeret), og offerets telefon mister forbindelsen.
  • Kriminelen modtager nu opkald og sms'er beregnet til offeret – inklusive bekræftelseskoder.

Når angribere har kontrol over dit nummer, kan de opsnappeSMS-baserede sikkerhedskoderbruges til nulstilling af adgangskode og loginbekræftelse.

Sue sagde, at svindlere overtog hendeGmailog låste hende derefter udebankkontiefter mislykkede sikkerhedskontroller. Hun havde også enkreditkort åbnet i hendes navnog kriminelle købtemere end £3.000 i værdikuponerDet krævede adskillige ture til hendes bank og mobiludbyder at få kontrollen tilbage.

Denne historie er et skoleeksempel på, hvorfor sikkerhedseksperter anbefaler at gå væk fra SMS som din primære sekundære faktor for vigtige konti.

Hvor svindlerne fik Sues oplysninger fra

BBC rapporterer, at Suestelefonnummer, e-mailadresse, fødselsdato og fysisk adresseblev afsløret i tidligere brud — herunder spilleplatformePaddyPower (2010)og e-mailvalideringsværktøjVerifikationer.io (2019)Andre samlinger af hackede optegnelser indeholdt også hendes oplysninger.

En cybersikkerhedsanalytiker, Hannah Baumgaertner fra Silobreaker, citeret af BBC, sagde, at angriberne sandsynligvis brugte lækkede personlige data til at udføre SIM-kortudskiftningen. Når de havde Sues telefonnummer, kunne de opsnappe sikkerhedskoder, der blev sendt for at bekræfte identiteten til Gmail.

Dette er problemet med "efterskælvet efter bruddet": selvom det oprindelige brud er et årti gammelt, kan dataene fortsætte med at cirkulere, blive ompakket og brugt som social engineering-bevis.

Hvordan små hacks skaleres: markedet for kaprede abonnementer

BBC-historien fremhæver også en form for cyberkriminalitet med lavere risiko, men ekstremt almindelig: overtagelse af abonnementskonto.

Fran, i Brasilien, fortalte BBC, at hun fandt ud af, at nogen havde registreret sig på hendesNetflixkonto og øgede sit månedlige abonnement – ​​et klassisk “freeloader”-kapring.

Artiklen siger, at det ikke altid er muligt at udpege et enkelt brud som den grundlæggende årsag. Men BBC fandt ud af, at Frans e-mailadresse var blevet afsløret i mindst fire brud, herunderInternetarkiv (2024),Trellov (2024),Descomplica (2021)ogWattpad (2020).

En sikkerhedsforsker citeret i artiklen, Alon Gal fra Hudson Rock, beskrev et marked for crackede streamingkonti, hvilket forvandlede et firmas lækage til løbende misbrug.

Når tofaktorgodkendelse stadig mislykkes

En af de mest foruroligende dele af moderne svindelnumre er, at angribere nogle gange kan omgå beskyttelser, som brugerne antager er "nok".

BBC beskriver en lille virksomhedsejer, Leah, som blev målrettet mod en phishing-e-mail, der så ud til at komme fra Facebook. Hun klikkede på et link, indtastede oplysninger på en falsk Meta-side, og svindlere overtog hendes virksomhedskonto, selvom hun havdetofaktorgodkendelse.

Angriberne lagde derefter videoer af seksuelt misbrug af børn op i hendes navn (hvilket fik hende blokeret) og kørte hundredvis af pund i reklamer betalt af hende i de tre dage, det tog at genvinde kontrollen (hun fik til sidst pengene tilbage).

Hvordan kan 2FA stadig fejle? Almindelige fremgangsmåder omfatter:

  • Proxy-phishing i realtid:Det falske websted videresender loginoplysninger til det rigtige websted og beder om 2FA-koden, som det bruger med det samme.
  • Sessionstyveri / tokenfangst:Nogle phishing-kits indfanger sessionscookien efter login.
  • Smuthuller i kontogendannelse:Hvis gendannelses-e-mail/telefon kompromitteres, nulstiller angriberne adgangen uden at udløse normale kontroller.

Pointen er ikke, at 2FA er meningsløst – det er, atDen stærkeste konto er den med flere lag, ikke et eneste afkrydsningsfelt.

Datamæglernes rolle og "berigelse"

Selv når et brud ikke omfatter alt, hvad en angriber ønsker, kan kriminelle kombinere kilder.

BBC bemærker, at svindlere ofte blander stjålne private oplysninger med offentlige oplysninger. Efterforskere beskrev, hvordan en angriber kunne forbinde en stjålet e-mailadresse med et offentligt registreret virksomhedsnummer for at sende en mere overbevisende phishing-besked.

Det er dét, der får moderne svindelnumre til at føles uhyggelige: beskeden ligner ikke spam. Den ser ud som om, den blev skrevet.til dig.

Skalaproblemet: Masseindbrud giver næring til en global svindeløkonomi

BBC bemærker, at flere højprofilerede angreb i2025eksponerede millioner af poster, med eksempler som:

  • 6,5 millionerberørt af et brud på Co-op-sikkerheden (april)
  • et hackerangreb, der påvirker Marks & Spencer-kunder (virksomheden specificerede ikke hvor mange)
  • 400.000Harrods-kunder berørt
  • 5,7 millionerpåvirket af et Qantas-hack

Den citerer også Proton Mails observatorium for databrud:794 verificerede brudfra identificerbare kilder opdaget indtil videre i 2025, hvilket afslørermere end 300 millionerindividuelle optegnelser.

I den skala behøver kriminelle ikke at være geniale. De skal være vedholdende og flittige.

Hvad virksomheder gør (og ikke gør) efter sikkerhedsbrud

Ofre opdager ofte, at der ikke findes nogen standard "efterbehandling efter brud".

BBC rapporterer, at det plejede at være almindeligt at tilbyde gratis kreditovervågning, men færre virksomheder gør det nu. Den bemærker, at nogle virksomheder ikke tilbød disse tjenester, mens Co-op tilbød en voucher under visse betingelser.

Artiklen nævner også en stigende tendens til gruppesøgsmål – selvom de er svære at vinde, fordi det er vanskeligt at bevise individuel indflydelse – og et bemærkelsesværdigt forlig: T-Mobile indvilligede i at betale350 millioner dollarsefter et brud i 2021, der påvirkede76mkunder, med rapporterede betalinger fra$50 til $300.

En realistisk handlingsplan, hvis du har mistanke om et SIM-kortbytte

Da SIM-swaps er tidsfølsomme, er det nyttigt at have en tjekliste.

  1. Hvis din telefon pludselig mister forbindelsen(og du er ikke i en dødzone), så betragt det som hastende.
  2. Ring til din udbyder fra en anden telefonog spørg, om der er sket en SIM-kortoverførsel eller nummerportering.
  3. Anmod om en øjeblikkelig låsningved yderligere SIM-kortændringer og nulstil kontooplysningerne/pinkoden.
  4. Sikr din primære e-mailkontonæste, fordi den kan nulstille alt andet.
  5. Skift adgangskodertil banktjenester, betalingsapps og alle konti, der er knyttet til SMS-koder.
  6. Tjek for nye konti/kreditaktiviteti dit navn.

Selv hvis angrebet viser sig at være et netværksproblem, taber du kun lidt ved at handle hurtigt.

Praktiske trin, der reducerer risikoen (uden paranoia)

Du kan ikke forhindre, at en virksomhed, du brugte for år siden, bliver hacket. Men du kan gøre lækkede data mindre nyttige for angribere.

1) Beskyt din mobilkonto

  • Spørg din udbyder omkonto-PIN-koder, port-out-låse og ekstra verifikation.
  • Minimér antallet af tjenester, der bruger SMS som gendannelsesmetode.

2) Brug stærkere godkendelse, hvor det er muligt

For dine vigtigste konti (e-mail, bank, adgangskodeadministrator) foretrækkes:

  • autentificeringsapps (TOTP)
  • adgangsnøgler
  • eller hardwaresikkerhedsnøgler

...via SMS-koder.

3) Brug en adgangskodeadministrator + unikke adgangskoder

Det er stadig billigt at udfylde legitimationsoplysninger. Unikke adgangskoder forhindrer ét enkelt brud i at låse op for alt.

4) Behandl din primære e-mail som din "root-konto"

Hvis kriminelle får fat i din e-mail-indbakke, kan de nulstille næsten alle andre konti. Gør din e-mail:

  • stærkt autentificeret
  • sikrede gendannelsesmuligheder
  • og overvåges for mistænkelige logins

Konklusion

Databrud er ikke kun et privatlivsproblem – de er forsyningskæden for svindelnumre. Gamle lækager kan kombineres med offentlige oplysninger for at udgive sig for at være dig, stjæle dit telefonnummer via et SIM-kortskifte, omgå logins og forvandle et enkelt kompromitteret dataangreb til en kaskade på tværs af e-mail, finansielle konti og sociale profiler. Det mest effektive forsvar er lagdelt: beskyt dit telefonnummer, sørg for din primære e-mail, og fjern dig fra SMS-baseret sikkerhed, hvor du kan.

Kilder

Document Title
SIM swaps, breached data, and stolen accounts: how scammers turn leaks into real money
Data breaches feed a scam economy: SIM swap attacks, hijacked Netflix accounts, and phishing that bypasses two-factor authentication. Here's how leaked personal data becomes account takeover.
Title Attribute
oEmbed (JSON)
oEmbed (XML)
JSON
View all posts by Admin
UK bans Coinbase ads: what it means for crypto marketing in Britain
Steam’s UK £656m lawsuit explained: what Valve is accused of and why it matters
Page Content
SIM swaps, breached data, and stolen accounts: how scammers turn leaks into real money
Nature
Climate
/
Technology
/ By
Admin
Data breaches have become so routine that many people treat them like background noise — an annoying email, a password reset, then back to life. But the real danger often arrives later, when leaked details are stitched together into targeted attacks that feel personal, plausible, and hard to stop.
A BBC investigation into scam victims shows how this pipeline works in practice: old data leaks help criminals perform
SIM swap attacks
, hijack email accounts, open credit in someone’s name, or seize control of business advertising accounts. What looks like “just an email address leak” can become a direct route to money, identity fraud, and months of cleanup.
This explainer breaks down the mechanics: how SIM swaps succeed, why two-factor authentication can fail, and what practical steps actually reduce risk.
The breach-to-scam pipeline (in plain English)
Most scams that end in stolen funds follow a repeatable sequence:
Personal data is exposed
(through a breach of a company you used years ago).
Criminals enrich it
by combining multiple breaches, public info, and sometimes data-broker sources.
They target the weakest link
(a mobile number, an email inbox, or a “forgot password” workflow).
They escalate
— using the first compromise to reset passwords and take over other accounts.
The BBC’s cyber correspondent Joe Tidy notes that being a victim of a breach increases your chance of being targeted. The key is not that every breach leads to a scam, but that breaches supply the raw materials criminals need for believable impersonation.
SIM swap attacks: why your phone number is a master key
In one case, a woman named Sue told the BBC her digital life was hijacked via a
SIM swap
.
A SIM swap attack works like this:
A criminal convinces a mobile network operator they are the real account holder.
The operator issues a new SIM (or transfers the number), and the victim’s phone loses service.
The criminal now receives calls and texts meant for the victim — including verification codes.
Once attackers control your number, they can intercept
SMS-based security codes
used for password resets and login verification.
Sue said scammers took over her
Gmail
and then locked her out of
bank accounts
after failed security checks. She also had a
credit card opened in her name
, and criminals purchased
more than £3,000 in vouchers
. Getting control back required several trips to her bank and mobile phone provider.
This story is a textbook example of why security professionals recommend moving away from SMS as your primary second factor for important accounts.
Where the scammers got Sue’s details
The BBC reports that Sue’s
phone number, email address, date of birth and physical address
were exposed in earlier breaches — including gambling platform
PaddyPower (2010)
and email validation tool
Verifications.io (2019)
. Other compilations of hacked records also included her details.
A cybersecurity analyst cited by the BBC, Hannah Baumgaertner of Silobreaker, said attackers likely used leaked personal data to conduct the SIM swap. Once they had Sue’s phone number, they could intercept security codes sent to verify identity for Gmail.
This is the “breach aftershock” problem: even if the original breach is a decade old, the data can keep circulating, being repackaged, and being used as social-engineering proof.
How small hacks scale: the market for hijacked subscriptions
The BBC story also highlights a lower-stakes but extremely common kind of cybercrime: subscription account takeover.
Fran, in Brazil, told the BBC she found someone had registered to her
Netflix
account and increased her monthly subscription — a classic “freeloader” hijack.
The article says it’s not always possible to pinpoint a single breach as the root cause. But the BBC found Fran’s email address had been exposed in at least four breaches, including
Internet Archive (2024)
,
Trellov (2024)
Descomplica (2021)
and
Wattpad (2020)
A security researcher quoted in the piece, Alon Gal of Hudson Rock, described a market for cracked streaming accounts, turning one company’s leak into ongoing abuse.
When two-factor authentication still fails
One of the most unsettling parts of modern scams is that attackers can sometimes bypass protections users assume are “enough.”
The BBC describes a small business owner, Leah, targeted by a phishing email that appeared to come from Facebook. She clicked a link, entered details on a fake Meta page, and scammers took over her business account even though she had
two-factor authentication
Attackers then posted child sexual abuse videos under her name (getting her blocked) and ran hundreds of pounds of adverts paid for by her in the three days it took to regain control (she eventually got the money back).
How can 2FA still fail? Common paths include:
Real-time proxy phishing:
the fake site relays credentials to the real site and asks for the 2FA code, using it immediately.
Session theft / token capture:
some phishing kits capture the session cookie after login.
Account recovery loopholes:
if recovery email/phone is compromised, attackers reset access without triggering normal checks.
The point isn’t that 2FA is pointless — it’s that
the strongest account is the one with multiple layers
, not a single checkbox.
The role of data brokers and “enrichment”
Even when a breach doesn’t include everything an attacker wants, criminals can combine sources.
The BBC notes that scammers often mix stolen private information with public information. Investigators described how an attacker could connect a stolen email address with a publicly listed business number to send a more convincing phishing message.
That’s what makes modern scams feel creepy: the message doesn’t look like spam. It looks like it was written
for you
The scale problem: mass breaches fuel a global scam economy
The BBC notes that several high-profile attacks in
2025
exposed millions of records, listing examples such as:
6.5 million
affected by a Co-op breach (April)
a hack affecting Marks & Spencer customers (the company did not specify how many)
400,000
Harrods customers affected
5.7 million
impacted in a Qantas hack
It also cites Proton Mail’s Data Breach Observatory:
794 verified breaches
from identifiable sources discovered so far in 2025, exposing
more than 300 million
individual records.
At that scale, criminals don’t need to be brilliant. They need to be persistent and industrial.
What companies do (and don’t do) after breaches
Victims often discover there is no standard “breach aftercare.”
The BBC reports that offering free credit monitoring used to be common, but fewer firms are doing it now. It notes that some companies did not offer these services, while Co-op offered a voucher under conditions.
The article also mentions a growing trend of class action lawsuits — though hard to win because proving individual impact is difficult — and a notable settlement: T-Mobile agreed to pay
$350m
after a 2021 breach affecting
76m
customers, with reported payments ranging from
$50 to $300
A realistic response plan if you suspect a SIM swap
Because SIM swaps are time-sensitive, it helps to have a checklist.
If your phone suddenly loses service
(and you’re not in a dead zone), treat it as urgent.
Call your carrier from another phone
and ask if a SIM transfer or number port happened.
Request an immediate lock
on further SIM changes and reset the account credentials/PIN.
Secure your primary email account
next, because it can reset everything else.
Change passwords
for banking, payment apps, and any accounts tied to SMS codes.
Check for new accounts/credit activity
in your name.
Even if the attack turns out to be a network issue, you lose little by moving fast.
Practical steps that reduce risk (without paranoia)
You can’t prevent a company you used years ago from being breached. But you can make leaked data less useful to attackers.
1) Protect your mobile account
Ask your carrier about
account PINs
, port-out locks, and extra verification.
Minimise how many services use SMS as a recovery method.
2) Use stronger authentication where possible
For your most important accounts (email, banking, password manager), prefer:
authenticator apps (TOTP)
passkeys
or hardware security keys
…over SMS codes.
3) Use a password manager + unique passwords
Credential stuffing is still cheap. Unique passwords stop one breach from unlocking everything.
4) Treat your primary email like the “root account”
If criminals get your email inbox, they can reset almost every other account. Make your email:
strongly authenticated
recovery options secured
and monitored for suspicious logins
Bottom line
Data breaches aren’t just a privacy problem — they’re the supply chain for scams. Old leaks can be combined with public information to impersonate you, steal your phone number through a SIM swap, bypass logins, and turn a single compromise into a cascade across email, financial accounts, and social profiles. The most effective defence is layered: protect your phone number, secure your primary email, and move away from SMS-based security wherever you can.
Sources
https://www.bbc.com/news/articles/czrk7gxk2l6o?at_medium=RSS&at_campaign=rss
←
Previous Post
Next Post
→
oEmbed (JSON)
oEmbed (XML)
JSON
View all posts by Admin
UK bans Coinbase ads: what it means for crypto marketing in Britain
Steam’s UK £656m lawsuit explained: what Valve is accused of and why it matters
Data breaches feed a scam economy: SIM swap attacks, hijacked Netflix accounts, and phishing that bypasses two-factor authentication. Here's how leaked personal data becomes account takeover.
Document Title
Page not found - Florin.blog
Image Alt
Florin.blog
Title Attribute
Florin.blog » Feed
RSD
Skip to content
Placeholder Attribute
Search...
Page Content
Page not found - Florin.blog
Skip to content
Home
Blog
Garden Decor
Indoor
Main Menu
This page doesn't seem to exist.
It looks like the link pointing here was faulty. Maybe try searching?
Search for:
Search
Quick Links
Outdoors
About
Contact
Explore
Bestsellers
Hot deals
Best of The Year
Featured
Gift Cards
Help
Privacy Policy
Disclaimer
: As an Amazon Associate, we earn from qualifying purchases — at no extra cost to you.
Florin.blog
Florin.blog » Feed
RSD
Search...
a Dansk