Comcast's Xfinity Mobile service used "0000" as a default PIN for all of its mobile customers, which left them vulnerable to hacking attempts, identity theft, and more.
Comcast's decision to use simple default PINs for all of its customers came to light in a "Help Desk" article from The Washington Post included one Comcast customer's tech horror story.
Larry Whitted, an Xfinity Customer in California, had someone hijack his phone number, port it to a new account on another network, and steal his identity to commit fraud.
The thief put Samsung Pay on a new phone with Whitted's phone number and credit card then bought himself a computer at the Apple Store.
This was possible because Comcast does not ask its customers to create a PIN to secure their accounts to prevent them from being transferred to another carrier. Instead, Comcast uses the default 0000 code. From Comcast's support document:
We don't require you to create an account PIN, so you don't need to provide that information to your new carrier.
Taking control of a person's telephone number is a popular way to obtain logins for email, social media accounts, bank accounts, and more. Any site that uses a phone number as a way of authenticating data can be accessed when someone has your phone number.
Charismatic hackers who use social engineering techniques can often get access to phone numbers from customer service representatives who don't know any better, but many carriers have implemented PIN codes to make it more difficult. Not Comcast.
This has led to other Xfinity Mobile customers having their phone numbers hijacked as well, and with phone numbers used for so much, hackers can access a lot of a person's data.
Comcast says that it has since implemented new measures to make it harder to steal phone numbers and that it is "working aggressively" to create a PIN-based solution, something that common sense dictates should have been available from the time the service launched.
Comcast says that a "very small number" of its customers have been impacted by this issue, and rightly admits that having even "one customer impacted" is "one too many." Comcast claims that customers who were affected perhaps used passwords leaked in other data breaches
