Three handed my new phone Sim to a fraudster and they took £3,235 from my Coinbase: CRANE ON THE CASE

Last Saturday, I suddenly lost service on my Three mobile phone and this happened intermittently for the next couple of days.

On the Monday, a large amount of money – £3,235 – was withdrawn from my Coinbase cryptocurrency account which I manage through an app.

It appears someone has duplicated my phone’s Sim card and was able to get in to my Coinbase app through that.

While Three has now cut off the duplicate Sim, most of the customer service staff don’t seem to understand what Sim swap fraud is. 

They can’t explain how this person was able to pass security checks and order the Sim – or if I can get my money back.

I have contacted Coinbase but haven’t had any answers yet. Can you help? H.J

Helen Crane, This is Money’s consumer champion, replies: Getting hold of our mobiles is the lodestar for scammers right now.

Often they will snatch the phones from our hands before raiding our bank accounts, but unfortunately there is a way they can worm their way into them without even needing to do that.

It is called Sim swap fraud and it sounds as if you are the latest victim.

This is where a fraudster persuades your mobile phone network to send them a replacement Sim card for your number, which they then put into another device.

This means they can receive texts and calls intended for you. 

If the scammer also has information such as your usernames or email addresses, they could potentially reset the passwords for your banking and other money apps, as they would be able to pass the two-factor authentication checks which usually rely on copying a code received in a text message. 

The first the legitimate customer will hear of it is when their phone service suddenly drops out, because their number is now being used elsewhere.

When you initially contacted Three after discovering the fraud, it agreed to cancel the duplicate Sim and sent you a new one.

But when you asked it to look further into how this happened and asked whether it would compensate you for the money you lost as a result, its response was slow and confused.

Some of those you spoke to referred to your phone being lost or stolen, which it never was. You repeatedly had to point out that you were a victim of Sim swap fraud, and that the person who ordered the new Sim was not you. 

I was astounded that it was so easy for this trickster to persuade Three to send them a Sim card with your number.

I contacted the network to ask what checks were undertaken, why this person was able to pass them – and whether it would pay you back for the money you lost.

First, it asked me if you thought a replacement Sim had been requested for your phone, and what the evidence was of that – despite you having told Three this so many times. 

You also have a record of an online chat with Three itself where it told you a Sim had been ordered. I can understand why you were so frustrated with their response.  

Once we established the details, Three told me that the fraudster would have had to go through stringent security checks to get your replacement Sim.

Though it did not reveal the specifics of what was asked, it said the fraudster already had your personal information and was therefore able to pass them.

Based on a phone conversation you had with Three, you believe that the checks only involved a one-time passcode being sent to your email address, and that no extra security questions were asked. 

If that is the case, I don’t think it is anywhere near stringent enough. It means anyone who has hacked into someone’s email account can also get into their phone.

Sim swap fraud has been happening for years, and an investigation by the BBC’s Watchdog programme in 2018 found that O2 and Vodafone both handed out replacement Sim cards to potential criminals without completing proper ID checks, so this is not without precedent. 

Three said that the Sim card received was a digital eSim, which the fraudster would have needed to get into your email account to access.

Therefore, it is assuming that the fraudster had already hacked into your email account, which was something you suspected. You have now closed it and set up a new one. 

In other cases of Sim swap fraud, it is thought scammers have been able to piece together enough information to pass these checks from a combination of things like seeing a passport or driving licence, knowing someone’s address or the last four digits of their debit or credit card number.  

As the fraudster got the information to pass the checks from ‘other sources,’ Three says it will not refund you for the money lost.

The other reason Three gave for not refunding you was that the loss of the Coinbase money occurred before you notified Three of the fraud.

That doesn’t stack up in my view. Losing service on your phone can happen for a number of reasons, and you wouldn’t have immediately suspected fraud. 

You also didn’t initially realise that money had been taken from your Coinbase, as your password had been changed. It took some time to regain this access. 

A Three spokesman said: ‘We take the security of our customer’s phone numbers very seriously. The fight against fraud is constantly evolving due to the changing tactics of criminals, so we continuously review our processes.

‘We have a manual validation process in place, and in this case, a third party had obtained the information required to access [the customer’s] account from other sources.

‘They were therefore able to pass the validation process, and subsequently access [his] email account to retrieve the eSim. The financial loss experienced occurred prior to Three being notified of the situation on 20 March.’

It has put extra security measures on your account going forward, as well as offering you a goodwill gesture of £100 in light of the time it took to look into the problem.

But that still left you more than £3,000 in the red.

I decided to contact Coinbase, to see if it would help you get your money back – but I didn’t hold out much hope of this happening. 

The fraudsters had not got into your account through any fault of Coinbase’s, and crypto platforms can’t attempt to claw back money directly from scammers in the same way banks are sometimes able to. 

However, I am pleased to say I was wrong. Coinbase told me it is piloting a new service for UK customers called the Coinbase Account Guarantee.

It means that, if someone gains unauthorised access to your account, you may be able to get reimbursed up to £150,000 – subject to conditions such as filing a police report, having previously completed ‘know your customer’ security checks and having had your account open for at least 30 days.

This is a one-off and customers cannot use the service a second time, even if they are scammed again.

Coinbase told me it believed you would qualify, so I encouraged you to apply.

It was a relatively arduous process, with you having to get hold of a full police report on your case which took around a month. 

However, it worked, and a few weeks later, you were repaid £2,200.

That is less than what you lost, because instead of refunding you in cash Coinbase has refunded you the same number of crypto coins you had when the fraudster transferred them out.

Unfortunately the coins you hold have lost value since then, but that is the name of the crypto game and you are still pleased to have got the bulk of what you lost back.

While you were in the refund process with Coinbase, Three contacted both you and me to ask where you had got to and if it looked likely to refund you.

This is unusual in my experience, and suggested to me that it was waiting to see whether Coinbase would refund you before considering its own position – though Three says this was not the case.

If it had decided to pay you back, it would have saved you weeks of your time going back and forth trying to get police reports, for one.

While the scammer may have got to your email account first, I do think Three has failed you here. 

It, and other phone networks, should seriously consider upping their security checks when someone orders a replacement Sim – as it is clear the current system isn’t working.