3 hours.
That’s all it took for a fraudster to bypass 2FA and drain $38,000 from Justin Chan’s bank account.
The method? SIM swapping — a type of cyberattack where your phone number is hijacked and used to intercept one-time passwords.
Justin didn’t click a malicious link.
He didn’t fall for a phishing scam.
He simply trusted that his SMS-based 2FA would keep him safe.
It didn’t.
* The attacker called his mobile carrier and transferred his number.
* They used that number to receive 2FA codes.
* They accessed his bank and investment accounts.
* $38,000 gone before sunrise.
Most users still think “I’ve set up 2FA, so I’m safe.” But if that 2FA is tied to your phone number, it’s an open door for modern hackers.
Justin eventually got his money back — after months of stress and media pressure. But many victims don’t.
Let this be a reminder:
- Use app-based or hardware 2FA wherever possible.
- Audit your basic mobile privacy options.
- Rethink how much control your number gives others.
And if your mobile carrier doesn’t offer strong protections by default… maybe it’s time to switch.
#CyberSecurity #MobileSecurity #SIMSwap #2FA