This woman's cellphone number was given to another customer — without her consent

An international student in Cape Breton says a recent transfer of her cellphone number — without her consent — highlights potential security risks for all mobile phone users in Canada.

On the morning of Dec. 30, 2024, Huijun Long received a notification on the Virgin Plus app that her phone number with the company had been cancelled. Turns out, her number had been "mistakenly transferred" to a Bell Mobility account. 

"I was really anxious because all of my banking information and other accounts' information are connected to the phone number," said Long.

Like millions of other customers, she regularly uses her mobile phone number as two-factor authentication — a security method that requires two forms of identification to access websites, software or data.

Long said she felt unsafe not knowing who had access to her number during the six-day period she didn't have her phone number.

She said she repeatedly asked for the number to be suspended, which was done after going back and forth with multiple customer service agents on the first day.

"I asked them, 'Why do you ask me about my personal information — you are so cautious about it — but transfer my phone number away so easily without any notification?'" said Long.

The company confirms that her number was transferred at a Bell retail location in Halifax. Virgin Plus is owned by Bell.

"Bell apologizes for any inconvenience this situation caused the customer," spokesperson Geoff Higdon said in a statement.

According to Bell, Long's phone number was removed from the other Bell Mobility account on the same afternoon.

Bell said the experience is "not typical" and the company found "no evidence to suggest that Ms. Long's information was compromised."

In a statement, Higdon said such an incident is rare and while "people can transfer or 'port' their number between carriers, and despite mechanisms to prevent fraud and errors from occurring during that process, this customer's service was interrupted due to human error." 

Ali Dehghantanha, a Canada Research Chair in Cybersecurity and Threat Intelligence at the University of Guelph, said even though Long's case was determined to be a human error and not fraud, she had every right to be worried about someone else potentially gaining control of her mobile number.

"If it goes to the hands of the wrong people, they can significantly misuse it. And if it becomes a case of identity theft, recovering that would be very difficult," said Dehghantanha.

"It could lead to serious, serious damages."

Claudiu Popa, founder of KnowledgeFlow Cybersecurity Foundation in Toronto, agrees it's a valid concern — especially since data can be transferred within minutes, or even seconds.

"Any time your phone number is assigned to somebody else, it doesn't just mean that your phone calls are going to go through somebody else's telephone," Popa said. 

"It means that all of your communications, your one-time passwords being sent to your device, your communications with your chat groups and your personal networks on social media will also be hijacked."

SIM swapping

Illegitimate SIM card swapping has become an increasing concern in the telecom industry in recent years and is monitored closely by the industry regulator, the Canadian Radio-television Telecommunications Commission (CRTC).

In a letter to the CRTC in 2020, the Canadian Telecommunications Association described how the mobile transfer process has been targeted by scammers.

"Once fraudsters have the customer's personal information, they can execute a SIM-swap or wireless port, and route all text messages and phone calls to their own device," the letter said. 

"In the instance of two-factor authentication, these new codes are sent to the fraudster's device and they are then able to gain control of the victim's accounts."

Last summer, Toronto police intercepted a SIM-swap scheme that targeted 1,500 cellular accounts across Canada and resulted in 10 arrests.

Geoff White, executive director of the Public Interest Advocacy Centre, which is a national non-profit, said the Nova Scotia case points to the wider risks for consumers.

"What it highlights to me is the vulnerability of a customer's personal information," said White. "The electronic SIM card is akin to your personal identity right now."

Cybersecurity experts Popa and Dehghantanha told CBC News that telecom retail stores and call centres are particularly vulnerable to SIM-swapping scams because employees can be manipulated. 

In followup statements, Bell said retail employees are provided with "all necessary training, regular coaching, and oversight to ensure policies and procedures are followed" when accessing customer accounts.

"Bell and its subsidiary brands follow industry standard procedures when porting numbers from other Canadian carriers, which includes two-factor SMS authentication where the customer whose number is being ported accepts the transfer before the process is completed," Higdon said.

"Transfers between a carrier's various brands (Virgin Plus to Lucky Mobile, for example) is done through a secure internal process as our systems allow us to verify the customer."

The Canadian Telecommunications Association said that while protecting consumers is a "top priority," it doesn't disclose details on security measures. 

The reason is "to prevent criminals from gaining knowledge of how our industry continues to evolve protections to stay ahead of threats," spokesperson Nick Kyonka said in a statement.

"At the same time, these safeguards must balance security with accessibility, ensuring that all customers — including those who may not have an alternate phone number or email — can access their accounts when needed."

The association said service providers implemented new security measures in 2020, and as a result, the CRTC reported a 95 per cent decline in unauthorized mobile number transfers and SIM-related frauds over a six-month period. 

But the CRTC will not publicly release statistics related to unauthorized mobile number transfers, citing confidentiality.

"The CRTC continues to rely on the Canadian Telecommunications Association (CTA) and telecommunications service providers to find solutions for Canadians to address unauthorized number transfers, known as SIM swapping," said CRTC spokesperson Megan MacLean in a written statement.

"Their efforts to prevent fraudulent activity have helped to reduce these cases."  

The Public Interest Advocacy Centre isn't satisfied with the lack of public disclosure on this issue. White says his group has been calling for a public inquiry.

"The problem is the information about this issue has all been filed confidentially, so we don't really have a sense of the scale of the problem — although we know it is significant," White said.

Last year, the Commission for Complaints for Telecom-Television Services said it tracked 40 issues related to unauthorized wireless transfers in Canada. This month, Long added her complaint to the list.

As a newcomer to Canada less than two years ago, Long didn't know where to turn to verify her personal accounts were safe. 

She isn't satisfied, despite an apology from the company.

"My personal information was at risk and I am unsure whether there was an information leak," she said. 

"I still don't know how the transfer happened, who is responsible for it, or how Virgin plans to prevent this kind of mistake in the future."