< Back
Episode #
124

Efani's Mark Kreitzman on the SIM swap that cost Marks and Spencer 350 million euros

In our latest episode of the Future of Threat Intelligence podcast, Mark Kreitzman, Chief Cyber Evangelist at Efani, shares how organized crime is scaling SIM swap attacks with AI, why most U.S. financial institutions still rely on SMS authentication, and how Efani's reversed MVNO model locks every carrier and phone store out of customer accounts.

Mark knows these attacks firsthand. In 2017, an attacker ported his number for 61 minutes, stole his crypto, and ported it back to hide the attack. That experience drove him to help build a secure mobile service now protecting executives, crypto holders, and high-net-worth individuals with up to $5 million in insurance backing per customer.

‍

Topics discussed:

  • How organized crime and AI are scaling SIM swap attacks from lone hackers to industrial operations
  • Efani's reversed MVNO model that locks carriers, phone stores, and support agents out of customer accounts
  • Why 80% of U.S. financial institutions still default to SMS authentication
  • The Marks and Spencer breach that started with a middle manager's SIM swap and cost 350 million euros
  • How every data breach feeds targeting data to SIM swap attackers

Key Takeaways:

  • Separate email accounts across personal, banking, and crypto to prevent a single compromised address from exposing multiple accounts.
  • Replace SMS-based authentication with authenticator apps and hardware keys wherever your financial institutions allow it.
  • Audit which services are tied to your mobile number and remove phone-based recovery from high-value accounts.
  • Assume your personal data is already exposed from past breaches and layer your defenses accordingly.
  • Evaluate your mobile carrier's security model, because the default carrier setup prioritizes convenience over account protection.
  • Monitor unexpected password reset texts or authentication codes as potential reconnaissance by attackers testing your accounts.
  • Protect executive and leadership phone numbers as enterprise attack surfaces, not just personal devices.

Listen to More Episodes:  YouTube  •  Apple  •  Spotify  •  Website