@joel_lisSim jacking is not isolated to Public Mobile. It is an issue that requires industry wide protocol change. You have to understand people demand things when it coming to porting, it has to be seamless, easy, quick. Currently the process is mostly automated with problematic ones throwing exceptions that require human intervention. There are minimal standard times defined by the CWTA tradegroup with supervision from CRTC that Public Mobile has to meet. Any changes will change all that and require rewrites. % wise SIMjacking is really a small phenomenon.
Public Mobile staff, I think is shielded by the extra long moderator time. It cuts both ways, it takes longer for people to social engineer (people might just go for an easier target).. but sucks for the victim (the thief got away, while victim waits). Currently Public Mobile sends a heads up text to the user of any port out attempt.
To port a wireless line, you need: Your Name, Phone number + (combination of: Account #, PIN or IMEI) So remember your attacker will need the information ahead of time. The first 2 is rather easy. IMEI can be had easier if you use an Android phone with a bad app. However all the information can be had really easily if you had been compromised by a RAT.
From my observation and experience, working in litigation and security (I see them once every other week, thankfully only from staff's personal devices). Nearly SIM jacking victims had been scooped ahead of time. The attacker knows the value of the target. Often the phone and/or the computer had been compromised.
Here is a few suggestions from my experiences (the objective is to minimize the risk of the information required to port is leaked out and damage mitigation):
1. Minimize your exposure to loosing your phone# ie don't use your wireless phone # as a 2FA method. Even VOIP services like textnow is more secure because it takes days, weeks to transfer a number out.
2. Be very particular with what kind of services you use (eg Bitcoin exchanges, might want to use another wireless# if you so inclined)
3. Be even more particular on what apps you install on your phone, especially if you use an Android phone. It doens't take much for your IMEI number to be betrayed. Oh don't rely on antivirus on Android because once they tracked something is amiss, your information will had been exfiltrated.
4. If you use Android phones use only reputable ones, or at the minimum use Android One Or pure Android. Avoid "Skinned" ones. Especially low cost Chinese phones, they have undocumented APIs which will betrayed you. That's their business models if they survive long enough, or someone will exploit that knowledge once they had folded.
5. Make sure your internet accessing devices are clean and patched. It wont' hurt to restore from a known good backup once a while.
6. This might be controversial but block all texts from unknown numbers. Also make sure people you know don't use unkown numbers. If they do, get them on Slack etc etc.
7. Since Public Mobile doesn't do hard credit check, modify the name in your account. It won't affect your credit card / autopay/ 1 times payment. Unless your account access has been compromised, it gives an added of protection.
8. Have a backup plan. If you are really paranoid, get an extra phone line on the Rogers network. Create a checklist of who to talk to / contact in case you got compromised. Also practice the checklist a couple of times and update it annually.
Other readers suggestions of not reusing passwords, password managers etc are great and should be practiced as part of good internet hygiene. At my work we use Google Titan keys for 2FA for anyone that needs computer access from receptionists to head of the company, they work great and I highly recommend them as the 2FA source. Yubikey is another good 2FA provider.
