Blog

From Digits To Data: How eSim Numbers Fuel Account Takeovers

Dima Khrustalov

Dima Khrustalov serves as the Research Team Manager for Q6 Cyber, based out of the Berlin, Germany office. With over five years of specialized experience in combating e-crime and cyber fraud, he is a leading expert in the Russian-language cyber underground ecosystem. In his current role, Dima tracks complex dark web threat networks and oversees the production of advanced threat intelligence reporting on topics ranging from fraud-as-a-service to malicious infrastructure exploitation. Prior to joining Q6 Cyber, he built a solid investigative foundation working as an Anti-Money Laundering (AML) and Due Diligence analyst. Dima holds a B.A. in Business Administration and Communications from The Hebrew University of Jerusalem.

INTRODUCTION

A threat actor who goes by the moniker “crdEPATAGE” on the Russian-speaking underground forum XSS¹ shared a novel step-by-step method for taking over victims’ bank accounts. This reputable actor specializes in developing bypass techniques and schemes targeting U.S. financial institutions.

Traditional PII-based banking fraud workflows typically begin with the acquisition of a victim’s personally identifiable information (PII), followed by social engineering and attempts to acquire a phone number to bypass multi-factor authentication (MFA) controls.

In contrast, the novel method described by crdEPATAGE starts backwards – with an eSIM-based phone number purchased through providers such as usmobile.com and then checks whether that number was previously associated with a real individual. If a match is found, the actor works backward to reconstruct the full identity profile, building from the phone number to the reconstructed full PII profile including name, address, date of birth, SSN, and other sensitive information. Since financial institutions often rely on credit agency–linked identity data for user verification, this approach gives threat actors a powerful advantage, bypassing authentication checks and gaining access to accounts without requiring control of the victim’s device or inbox.

Here’s how the process works, step by step:

Step 1: Acquire a Phone Number

Purchase and activate a mobile number via eSIM through services such as usmobile.com. The number becomes the starting point for the identity-building process.

Step 2: Check for Previous Ownership

Run the acquired number through background check services (e.g., TruthFinder,² FamilyTreeNow³) to determine whether it was ever linked to a real person. If results indicate a past owner with associated identity details, continue to the next step.

Step 3: Collect Identity Data

Continue gathering information from background check services to build out the victim’s profile. This includes full name, date of birth, address history, and any other personal details linked to the phone number.

Step 4: Obtain the Social Security Number (SSN)

With the basic identity information in hand, query Dark Web lookup services to find the victim’s SSN and complete the full identity set.

Step 5: Pull a Credit Report

Using victim’s name, DOB, SSN and address, request a real-time credit report from a major Credit Reporting Agencies such as Experian⁴, TransUnion⁵, or Equifax⁶. This provides insight into which banks the victim uses and what accounts or credit lines are active.

Step 6: Target a Bank and Start a Recovery Process

Choose a financial institution listed in the credit report and initiate the account recovery process. Submit the victim’s identity details along with the phone number currently under your control. Select SMS as the 2FA method.

Step 7: Receive the OTP

According to the threat actor, once the bank verifies that the submitted identity and phone number match credit agency records, it sends a one-time passcode (OTP) via SMS. The code is delivered directly to the eSIM device under the fraudster’s control now linked to the victim’s account.

Step 8: Bypass Knowledge-Based Authentication (KBA)

Use information from the victim’s credit report to answer any identity verification questions the bank may request, such as previous addresses, loan amounts, or linked phone numbers. Since the information matches Credit Reporting Agencies records, the responses are accepted, resulting in full access to the victim’s account.

RECOMMENDATIONS

The method detailed in this report highlights an alleged vulnerability in the way financial institutions rely on identity data from Credit Reporting Agencies (CRAs), particularly for phone number verification during account recovery and multi-factor authentication. Institutions that depend heavily on CRA-sourced data for these processes are at increased risk of exploitation.

We recommend that financial institutions revise their verification protocols to treat CRA data strictly as a secondary validation layer rather than a primary authority. Identity verification should prioritize current, customer-provided information, with CRA records used only to cross-check for consistency and not as an automatic basis for approval.

Don’t forget

to Visit

Our Solutions

Read More¹https://xssforum7mmh3n56inuf2h73hvhnzobi7h2ytb3gvklrfqm7ut3xdnyd.onion
²https://www.truthfinder.com
³https://www.familytreenow.com
⁴https://www.experian.com
⁵https://www.transunion.com
⁶https://www.equifax.com

About the Author(s)

Anton Vilenskiy is a E-crimes Intelligence Analyst II at Q6 Cyber. Anton’s background includes a BBA in Management and MA in Supply Chain Logistics from Kazan National Research Technological University. His work at Q6 Cyber focuses primarily on research and analysis of Deep and Dark Web with a major focus on Eastern European digital underground.

Dima Khrustalov is a manager of the research team at Q6 Cyber, covering global cybercriminal activities on the Dark Web and Deep Web. Dima has more than seven years of experience in fighting cyber fraud and e-crime, specializing in Eastern European cyber underground. Prior to Q6 Cyber, Dima was an Anti-Money-Laundering and Due Diligence analyst. Dima holds a BA in Communications and Business Administration from the Hebrew University of Jerusalem. Currently resides in Berlin, Germany.