From Digits To Data: How eSim Numbers Fuel Account Takeovers
INTRODUCTION
A threat actor who goes by the moniker “crdEPATAGE” on the Russian-speaking underground forum XSS1 shared a novel step-by-step method for taking over victims’ bank accounts. This reputable actor specializes in developing bypass techniques and schemes targeting U.S. financial institutions.
Traditional PII-based banking fraud workflows typically begin with the acquisition of a victim’s personally identifiable information (PII), followed by social engineering and attempts to acquire a phone number to bypass multi-factor authentication (MFA) controls.
In contrast, the novel method described by crdEPATAGE starts backwards – with an eSIM-based phone number purchased through providers such as usmobile.com and then checks whether that number was previously associated with a real individual. If a match is found, the actor works backward to reconstruct the full identity profile, building from the phone number to the reconstructed full PII profile including name, address, date of birth, SSN, and other sensitive information. Since financial institutions often rely on credit agency–linked identity data for user verification, this approach gives threat actors a powerful advantage, bypassing authentication checks and gaining access to accounts without requiring control of the victim’s device or inbox.
Here’s how the process works, step by step:
Purchase and activate a mobile number via eSIM through services such as usmobile.com. The number becomes the starting point for the identity-building process.
Run the acquired number through background check services (e.g., TruthFinder,2 FamilyTreeNow3) to determine whether it was ever linked to a real person. If results indicate a past owner with associated identity details, continue to the next step.
Continue gathering information from background check services to build out the victim’s profile. This includes full name, date of birth, address history, and any other personal details linked to the phone number.
With the basic identity information in hand, query Dark Web lookup services to find the victim’s SSN and complete the full identity set.
Using victim’s name, DOB, SSN and address, request a real-time credit report from a major Credit Reporting Agencies such as Experian4, TransUnion5, or Equifax6. This provides insight into which banks the victim uses and what accounts or credit lines are active.
Choose a financial institution listed in the credit report and initiate the account recovery process. Submit the victim’s identity details along with the phone number currently under your control. Select SMS as the 2FA method.
According to the threat actor, once the bank verifies that the submitted identity and phone number match credit agency records, it sends a one-time passcode (OTP) via SMS. The code is delivered directly to the eSIM device under the fraudster’s control now linked to the victim’s account.
Use information from the victim’s credit report to answer any identity verification questions the bank may request, such as previous addresses, loan amounts, or linked phone numbers. Since the information matches Credit Reporting Agencies records, the responses are accepted, resulting in full access to the victim’s account.
RECOMMENDATIONS
The method detailed in this report highlights an alleged vulnerability in the way financial institutions rely on identity data from Credit Reporting Agencies (CRAs), particularly for phone number verification during account recovery and multi-factor authentication. Institutions that depend heavily on CRA-sourced data for these processes are at increased risk of exploitation.
We recommend that financial institutions revise their verification protocols to treat CRA data strictly as a secondary validation layer rather than a primary authority. Identity verification should prioritize current, customer-provided information, with CRA records used only to cross-check for consistency and not as an automatic basis for approval.