@nbosscher Hopefully the damage from this turns out to be minimal. Once you have things under control and have had a chance to take a breath, you need to figure out how they got into your account. Was it through email, social media? How did they find your account and name and get your log in credentials? If your paypal was compromised I would look at your email account especially if there are messages about Public Mobile and PayPal in there. Here is something I wrote awhile ago on cyber security online. Too late, I know, but maybe someone reading this will take steps based on it.
For everybody reading this thread I offer the following as food for thought, hopefully getting people to think about their online presence.
The first issue is how did whoever sim jacked you get your account info including PIN that allowed them to port out your number or swap your sim? Figuring this out could help you to minimize the damage.
Second, a lot of people tend to use the same email/user name and passwords over a number of accounts. Now I admit I do the same to a limited extent. But I differ from most in the following:
1. My actual email accounts have a different, more difficult password than that used on sites like here.
2. My government accounts have a different username and a different difficult password from my emails.
3. My work accounts have a different username and a different difficult password than any others I use.
4. My banking has the toughest and longest passwords of all.
While on the topic of banks, having your number stolen doesn't give someone access to your bank accounts or anything else. The thieves have to know what bank you use and in my case the client card number used for sign in before they can try the lost password link. Assuming they have that info, they cannot get a password reset sent to them because I do not use my phone number on any accounts to get password resets sent to . None, nada, zero. In my opinion tying your phone number to any account is a horrible idea, as we have seen numerous times here. I will receive an email from the bank (see number 1 above).
5. I use an authenticator app for 2FA. I have set up all my accounts that allow 2FA to use this. No text sent to my phone number. You have to have the correct app and enter the time sensitive number to allow access. If an app/site determines that sign in is coming from an unknown (to this point) location/device, it asks for the authenticator code. Without it you can't get into my accounts. There are a number of authenticator apps out there and resources explaining step by step how to set it up for your particular account (if available). Yes it take time initially to go through your online life and do this, but I think it's worth it in the long run. If I recall correctly, It took me about an hour to complete when I went this route.
Finally, stop giving thieves your life story on social media. Believe it or not there are bots that mine data from social media sites. My fav post is the one that asks you to answer a bunch of seeming harmless questions like what was your first pets name or the name of your favourite teacher. These are the same types of questions that some sites (banks, government etc) use as another layer of security. Don't make it easy for the bad guys.
I feel bad for people that have had their lives upended by sim jacking. Hopefully there is a nugget or two above worth considering to help your selves.
