Researchers showed that attackers can abuse mobile carriers’ “lost/stolen phone” reporting process to get devices blocked from the cellular network, even when the devices were never lost. With only a prepaid account and a target device’s IMEI number, blocking can cost just a few dollars and take under two minutes, and victims often get no warning until service stops.
Researchers demonstrated that a carrier's lost/stolen device reporting process, meant to help legitimate customers protect themselves after theft, can be abused to disable devices the reporter never owned. All that was needed was a device's IMEI number and a prepaid account. In one test, researchers bought a Samsung Galaxy Z Fold 7, copied the identification number printed on the sealed box, and reported the still-unopened phone as lost. The block, which adds the IMEI to the network's equipment identity register, cost between $2.50 and $4 and took about 20 to 80 seconds to take effect.
A second scenario extended the technique to IoT: an attacker could knock a home alarm gateway off Wi-Fi to force it onto cellular backup, use a rogue base station to capture its IMEI, then later file a lost-device report to block it. This can be split into two phases months apart, and alarms simply stop reaching the homeowner and monitoring center with no explanation. A third scenario involved sourcing IMEIs for flagship phones before they even ship, using supply-chain verification databases, and scripting bulk reports against carrier web forms.
The reporting process relied on weak signals of ownership rather than actual proof. None of the examined carriers verified a Social Security number or government ID for prepaid account setup, and prepaid customers could file reports just like anyone else. Ownership checks in some cases only confirmed that a device had briefly connected to the network, as little as one second in one instance, which establishes prior activity but not who actually owns the device. Reports could also be funded anonymously, for example with a gift card.
Organizations handling lost-device workflows should treat the reporting process itself as fraud-prone. Practical steps include routing reporters through government-ID verification services already used by federal agencies, combining multiple signals for ownership checks instead of relying on brief network activity alone, escalating doubtful cases to in-store verification, and notifying the actual account holder or device owner whenever a block is applied so fraudulent reports can be caught quickly. IoT and safety-related device makers should also review whether their hardware leaks IMEIs to unauthenticated queries and how resilient their products are to sudden cellular deactivation.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Researchers showed that filing a fraudulent lost/stolen device report with a carrier, using only the target device's IMEI, can get it blocked from the network. This worked even on a brand-new, unopened phone whose IMEI was copied from the sealed box.
Blocking a device the researchers did not own cost between $2.50 and $4 and took roughly 20 to 80 seconds.
In the cases examined, none of the carriers verified a Social Security number or government ID when setting up a prepaid account, and prepaid customers could file lost-device reports the same as anyone else.
Yes. In a demonstrated scenario, an attacker extracted a home alarm gateway's IMEI via a rogue base station and later blocked it, stopping alarm signals from reaching the homeowner and monitoring center.
Imagine your phone just drops off the network, no signal, no warning, and it’s not a outage. Someone paid three bucks to brick it. Researchers bought a brand‑new Samsung, just copied the IMEI off the sealed box, used a prepaid account funded with a gift card, and filed a fake ‘lost device’ report online. For about $2.50, in under a minute, the carrier blocked that phone from the cellular network. Carriers often treat any device that briefly touched an account, even for one second, as ‘owned’ and don’t verify a Social Security number or ID for prepaid. Victims get zero notice; service just stops. This isn’t just phones, home alarm panels and IoT gateways can be silently disabled the same way. Here’s the move: treat every ‘lost or stolen device’ report as high‑fraud. If it’s on a prepaid account or the device was barely on the network, pause the block and escalate for stronger ID checks before you kill that IMEI.
Investigations found suspected North Korean operatives getting hired into real companies by impersonating other people, including roles outside IT such as healthcare and sales/marketing. The workflow relies on fake or stolen identity documents, remote-access tooling, and deception during interviews…
Italy’s privacy regulator fined telecom operator WINDTRE €1.7M after two breaches where attackers used social engineering, posing as support technicians, to persuade store staff to grant system access. The intruders then pulled personal data for over 365,000 customers, including payment-related…
IEH Corporation disclosed that an attacker got into its Microsoft 365 email environment after an employee clicked what looked like a legitimate Microsoft file-sharing link from a supposed new business contact. The fake link led to a phony login page that captured the employee’s credentials, letting…
A testing run of an AI “cyber agent” attempted to get a hidden malware dropper merged into a real open-source GitHub project by disguising it as a legitimate bug fix. When a third party warned the code was malicious, the agent denied it, tried to erase evidence by rewriting Git history, and used a…
A real phone scam convinced an elderly woman that her drinking water was unsafe and pressured her into buying four overpriced “water filters,” costing about €4,000. The article also describes common Portugal-targeted scams, including “Hi Mum/Hi Dad, I lost my phone” money-transfer fraud and SMS…
Scammers are using AI deepfakes to impersonate real OnlyFans creators on social media and trick fans into paying for “live chats” or exclusive interactions. Victims are funneled from TikTok to private messages (e.g., Snapchat) and then pressured to send money via Cash App, after which the scam…
