cross-posted from: https://midwest.social/post/6303502
The FBI investigated a man who allegedly posed as a police officer in emails and phone calls to trick Verizon to hand over phone data belonging to a specific person
Despite the relatively unconvincing cover story concocted by the suspect … Verizon handed over the victim’s data to the alleged stalker, including their address and phone logs. The stalker then went on to threaten the victim and ended up driving to where he believed the victim lived while armed with a knife
Version Security Assistance Team–Court Order Compliance Team (or VSAT CCT) received an email from [email protected].“Here is the pdf file for search warrant,” Glauner, allegedly pretending to be a police detective, wrote in the email. “We are in need if the this [sic] cell phone data as soon as possible to locate and apprehend this suspect. We also need the full name of this Verizon subscriber and the new phone number that has been assigned to her. Thank you.”
Verizon is not the only telecom that has failed to properly verify requests like this. In a somewhat similar case, I spoke to a victim who was stalked after someone posing as a U.S. Marshal tricked T-Mobile into handing over her phone’s location data.
Having worked in the industry on the retail side for both Sprint and then T-Mobile since 2007 and the amount of continuous annual training and borderline annoying effort these companies put out to retail employees about not disclosing CPNI (Customer Proprietary Network Information)… and considering how often this seems to happen… it’s clear the back end teams don’t get the same training or reminders despite their jobs actually being to disclose this info under the right circumstances.