Hands-On Tech 290 Transcript

Please be advised that this transcript is AI-generated and may not be word-for-word. Time codes refer to the approximate times in the ad-free version of the show.

Mikah Sargent [00:00:00]:
Coming up on Hands-On Text, is that text message code from your bank really keeping you safe? Stay tuned. Hello and welcome to Hands-On Tech. I am Mikah Sargent, and today we are answering a very important question, a question about codes sent to your phone. Multi-factor authentication. Let's take a look at this week's tech question. Otis has written in with the following. Hey Mikah, my bank texts me a 6-digit code every time I sign in, and I've always thought of that as the gold standard.

Mikah Sargent [00:00:42]:
Nobody can get in without my phone. Then I read a story about people having their phone numbers stolen right out from under them, something the writer called a SIM swap, and now the whole arrangement feels flimsy. If someone can take over my number, are those text codes worth anything? And is there something I can do at the carrier to lock my number down? Otis from Corpus Christi, Texas. Well, Otis, I have to say, very good question and something that I hear a lot. I hear a lot of people asking about this because they go, look, I'm already doing the annoying thing of setting up these 2-factor codes. So am I— is this actually safe or is this serving no purpose? Well, the fact is it absolutely is serving a purpose. And in most cases, you are protected. I shouldn't say in most cases, but in a lot of ways, you are absolutely more protected than you would be without some sort of second form of authentication.

Mikah Sargent [00:01:42]:
But just how much more protected are you? The first thing that I wanna tell you about this is do this, keep the codes because they will stop the most common types of break-ins, which are of course someone stealing your password, through some means typing it in and trying to get access. That's the whole point of having the second factor. So I will sometimes get password reset requests or some other type of login, and then I get a code sent to me and I know, ooh, that one's gotta change. But here is the important thing to understand. That code, it goes to your phone number, Not your phone. And your number does not live within the phone, it lives at your carrier. So that's something to bear in mind. And I also wanna say that if your bank offers something stronger, you should switch to it.

Mikah Sargent [00:02:39]:
If you're not sure, reach out to your bank and ask if they have another means of authenticating yourself. If that is the case, try that instead because while it is more secure than not having another factor of authentication, it is one of the least secure methods and therefore it is not the gold standard when it comes to protecting yourself. So we have to think about this first and foremost in the means of whether it's your phone or it's your phone number and that's where that kind of correction comes into place. If you are saying that nobody can get in without your phone, then I'm sorry, no, that's not the case. It's that nobody can get in without your phone number, but that number isn't exactly just yours on your phone. Your carrier controls that aspect of it. So text codes do offer some level of protection, And if somebody tries to get into your device and they only have your password, they hit a wall. But when it comes to second factor authentication, turns out text message codes rank last.

Mikah Sargent [00:04:03]:
CISA, which is the organization that manages sort of cybersecurity and tells and works with with security researchers to make sure that we are protected here in the US, puts out a lot of different guides. And there's even an MFA toolkit that we'll link to in the show notes. And CISA will— so actually has a place where they have sorted these sign-in methods into different tiers, okay? Different types of multifactor authentication. And they explain multifactor authentication, they talk about how you can enable it, and they say, They, you know, here's what you should know about it. But here's the thing. At the very bottom, they list the types of multifactor authentication in a hierarchy, and text and voice codes are at the bottom. App-based codes are in the middle, including mobile push notifications, one-time passwords— that's OTP— mobile push notifications with number matching, and even token-based OTP. The best form according to the hierarchy are actual physical keys and of course passkeys.

Mikah Sargent [00:05:23]:
Those rank at the top. Security keys and passkeys rank at the top. CISA in fact says that you should note any MFA is better than no MFA. And reminding— I'll remind you that MFA means multi-factor authentication. But in its mobile guide on the same subject, they say, do not use SMS as a second factor for authentication. So you have to understand that that advice in its guide about mobile communications, that's aimed at what they call highly targeted individuals, which you are probably not, but it is a weakness and therefore it does apply to everybody. There is still that concern. And why is that concern there? Well, I'm glad you asked.

Mikah Sargent [00:06:14]:
Let's talk about why that concern exists. It's because when you are using your multifactor authentication and you get a text message, you have to understand where the code goes. On a normal day, your bank, We'll take that code. It's an entry in your carrier's system and it's pointed at a SIM card or an eSIM. Okay. So it's in the carrier's database and then it's tied to you on your side. And so your bank sends the code that goes to the carrier that says, okay, this is supposed to go to this SIM. And then whoop, it goes to you on your phone.

Mikah Sargent [00:06:59]:
The code arrives. But, and that of course like leads to your normal sign-in. So this is the thing, pointing that code somewhere else is actually a pretty normal, uh, normal task. It's, it's routine because that's how upgrades and replacements work on your devices. So in the event of what you heard about, a SIM swap, that is where Somehow the scammer convinces the carrier that your phone was lost or was broken, and then they're able to get your number moved to a SIM on their phone. So your bank sends the code, your carrier renegotiates that to a new SIM, and then the scammer's phone gets that code that was supposed to go to you. They do their homework. They look at social media, they look at data breaches, they look at the dark web, they do phishing attacks, and they do all of that so that they can pass the carrier's identity questions.

Mikah Sargent [00:08:04]:
Then they go to work making that SIM swap happen. From then on, they get to sign on with your codes. Every call and text to your number, including bank codes, can land on their phone. Now there's another thing called port-out fraud, and it is sort of the relative of this. Instead, the number gets moved to a different carrier. So where before they have to convince this specific carrier that the phone is still on that carrier, but just a new SIM, a phone out— or excuse me, a port out fraud is where they take it to a different carrier. And then it's a race. Reset as many passwords as you possibly can before you— Uh, Otis, notice that your phone is not receiving codes.

Mikah Sargent [00:09:00]:
So there's one thing that people need to understand because we've got this newer technology that is, uh, sweeping the mobile world, especially here in the US. It's been other places for a while, and that is the eSIM. Sometimes people think that, well, I've got an eSIM and that's the newer kind, so it must mean that I'm safe. Well, no. The FCC does say that eSIM does cut down on physical SIM theft. Obviously, there's no physical SIM to steal, but port-out scams are still something that have to be watched for. And then of course, there is the sort of everyday way, right, that these codes get stolen. So It's important to understand that, you know, a SIM swap— look at the process that's involved there.

Mikah Sargent [00:09:56]:
Learning about you enough to figure out how to pass your identity tests and get in. That's why they say highly targeted individuals. So a SIM swap takes effort. It tricks you into handing over the code. It takes a text message. Fake bank sites and fraud departments will call and ask you to type in or read back the code that you just got, and then the scammer uses it right then in that moment. So that is what CISA means when it says that text codes aren't phishing resistant, right? They can still figure out a way to get it. So here's a rule for you.

Mikah Sargent [00:10:31]:
A code is for typing into the bank's own app or site. It's not to be read to a person who called you. There are times where you're on the phone with a support agent that you have placed a call to them and they say, well, I'm going to send you a code. Can you read it back to me? That is different. You placed the call and then they send the code. If they're calling you and asking you for your code, that's not the way it needs to happen. A code is for typing into the bank's own app or site. It is not for reading to a person who called you.

Mikah Sargent [00:11:11]:
The FTC says if someone asks for account info, go ahead and contact the company yourself using a phone number that you have found or a website that you know is real. Now, there are some methods of locking things down a little bit, and it can depend on your carrier and what they offer. But there are, again, some processes for doing this. At Verizon, you can lock your number. 3 free locks are worth turning on, and of course, it depends on the carrier. So when it comes to an account PIN or passcode for customer service, look for that and turn it on. SIM protection, that will block moving the number to a new SIM or eSIM. And then also look for port-out protection, which blocks moving the number to another carrier.

Mikah Sargent [00:12:04]:
So for Verizon, with that company, to block SIM swaps, you open up the My Verizon app, you go to Me, you go to Edit Profile and Settings, and then you go to SIM Protection. That will allow you to keep those SIM swaps from happening. If you are trying to stop the port out option where your move to another carrier is used, You again go into the Edit Profile and Settings and you choose Number Lock. So SIM protection was the first one, Number Lock is the second one. Uh, you can usually do this all in the Verizon app as we're talking about here, but you can also go to a Verizon store and ask for help there. The thing is that phone reps and the Verizon store agents are not supposed to turn SIM protection off. So that is something that you are supposed to be able to do yourself or can be kind of walked through, but they cannot— they're not supposed to turn it off for you. So if you turn it on, make sure you remember how to turn it off if you do want to turn it off to switch devices.

Mikah Sargent [00:13:12]:
What about T-Mobile and AT&T? Well, they do allow versions of protection, SIM protection, port-out protection, and it's available for free or postpaid accounts. So T-Mobile, You can block SIM swaps from the T-Life app. Manage, the gear icon, security, and then SIM protection. We'll have links in the show notes as well. AT&T, you launch the app, you go to person, you tap on the person icon, and then you choose wireless account lock. And those will both keep you from those port out and number, uh, changes as well. So AT&T's wireless account lock blocks SIM and eSIM swaps, number transfers, and also changes to your billing. And for the T-Mobile option, it is for keeping the port-out protection locked in as well.

Mikah Sargent [00:14:08]:
If you're on a prepaid brand or a smaller carrier, it's a good idea to call and ask for those 3 things by name. Okay? So call them and say, I'd like to know about SIM protection, I'd like to know about port-out protection. I would like to know how to also set up an account PIN or passcode for customer service. And they should be able to help you hopefully with all of those. Of course though, what is the trade-off? Well, you're going to have to switch the lock off before upgrading your phone or changing carriers. And Verizon, which I don't think this is a big deal, makes you wait 15 minutes after turning SIM protection off. Oh, that's a long time. And that's part of the feature to make sure that somebody turning it off that's not you doesn't gain access as they're supposed to.

Mikah Sargent [00:14:58]:
Uh, rules adopted in November of 2023 by the FCC actually require carriers to verify your identity before a SIM change or port out, and then they're required to notify you right away when one has been requested, and they have to give you the ability to lock your account immediately. So since 2023, it has gotten harder to do one of these, these attacks, but it is still possible. Now we've locked it at the carrier. Can we do more? Yes. You can also fix it at the bank side. So when it comes to the bank, let's go ahead and move up the ladder of, of CISA's multi- factor authentication hierarchy. If you're at text message or voice message, let's climb up. Let's get better.

Mikah Sargent [00:15:50]:
Lock in, look inside of your bank's security settings for anything that's better than a text. You could try to find perhaps an authenticator app, uh, you know, with the text code being at the bottom, the authenticator app is sort of that middle ground. So using Google Authenticator, Microsoft Authenticator, uh, a third-party password manager that has authenticators. And of course we've got the new passkey option Many companies, many services are hopping on board the passkey train, and it is so much better than a text code. As I said, CISA puts it up there at the top. You sign in with your face, your fingerprint, a phone PIN, and it's set up so that it can't work on a fake site in the first place. So it won't be able to take that passkey and steal it from you. And then of course, there's the option for a hardware security key if they support one.

Mikah Sargent [00:16:45]:
It has been my experience that many of these sites do not support hardware security keys, but some of them do, and so you could also ask about that as well. After you add one, always check if text codes are still switched on as a backup because all that does is it still makes that option available, so you're only as strong as your weakest link. We don't want that. Unfortunately, plenty of banks do still only offer texts, but the fact is they are far more powerful and protecting than not having them turned on at all. It's not as if you are lessening your security by turning them on. You are increasing your security. So if you Have it, keep it on. If you have it and haven't turned it on, turn it on.

Mikah Sargent [00:17:36]:
And then of course, make sure you just lean on that carrier lock. And then when you can, look for places to get email alerts for all sorts of account changes so that a password change or a new device will result in you getting an email about it. And that is the best way to protect yourself. Now, you may be going, if this is happening in the background, somebody's doing this to me, how will I know? Well, your first sign, the thing you should be looking for first, or not necessarily looking for, but if it happens to you, then you might go, huh, I think something might be going on here. First thing to pay attention to is that usually your phone will lose service out of nowhere. No bars, emergency calls only, and that will happen while everyone around you is still fine. Or perhaps a text or email from your carrier about a SIM change or new device you didn't ask for. That can also be the case.

Mikah Sargent [00:18:48]:
And if that happens, call your carrier immediately from another phone, call your bank and other financial accounts, and then— Once your number is back, change your passwords as quick as you can. Quick as you can. Make it happen. Here's what you need to know. Bottom line. We've got this figured out, right? So the bottom line here is this. Text codes are absolutely worth keeping. They beat a password alone, okay? But they're still The weakest of the second step options.

Mikah Sargent [00:19:24]:
The code goes to your number, your number lives at the carrier, and that is the weak spot. Turn on your carrier's account PIN, turn on SIM protection and port-out protection. Of course, AT&T rolls all of that into the one wireless account lock. And if your bank offers a passkey or authenticator app, please switch to it and never, ever Read a code sent to your phone to anyone who calls you. That's a no-no. So, Otis, I hope that helped, and I hope that you come out of it feeling more comfortable knowing that you are safer by having the 2-factor 6-digit code sent to you. than you are not having it. But bearing in mind at all times that there are better forms of security if you can get them.

Mikah Sargent [00:20:26]:
Folks, that is going to bring us to the end of this episode of Hands-On Tech. I wanna thank you so much for taking the time to join us today. Really appreciate you being here, uh, and we will catch you again next week for another episode of the show. Bye-bye. Bye.