FTC tech chief presses mobile carriers to boost verification after account is hijacked

The technology chief at the Federal Trade Commission (FTC) is calling on mobile carriers to boost their customer verification features after the official’s mobile phone account was hijacked in Ohio a few weeks ago. 

The FTC’s Lorrie Cranor, who took over the job in December, published a blog post about the long back-and-forth with her mobile phone carrier after an identify thief posed as Cranor at a retail store to buy and activate two new iPhones on her account, which ended up cutting off service for Cranor. 

{mosads}“Carriers should adopt a multi-level approach to authenticating both existing and new customers and require their own employees as well as third-party retailers to use it for all transactions,” she said in her blog post. 

The FTC’s technology chief recommended that customers should add an extra security PIN to help guard against that kind of theft. While all the major carriers offer the extra security, she noted that Sprint is the only one that requires it at the outset. 

She did not reveal her mobile carrier, but she said the company blamed her for the fraud. 

“I called my mobile carrier’s fraud department and reported what happened. The representative agreed to remove the charges, but blamed the theft on me,” she said. “When I asked how the store authenticated the thief, he told me that employees of stores owned by the mobile carrier would have asked for the account holder’s photo ID and the last four digits of their social security number, but if the theft occurred at another retailer, that might not have happened.”

According to FTC statistics, customers reported 2,658 instances of mobile phone hijacking to the consumer protection agency in January of this year. That number has more than doubled in the past three years. The agency says those numbers are likely low, since surveys have shown that only about 1 percent of people report identity theft to the FTC. 

She noted that safeguards are increasingly important now that individuals, businesses and banks are increasingly using mobile phones as authentication. Cellphone account hijacking can make it easier for an identity thief to access a person’s bank account or other records. 

“Mobile carriers and third-party retailers need to be vigilant in their authentication practices to avoid putting their customers at risk of major financial loss and having email, social network, and other accounts compromised,” she said.