Vulnerability in Vodafone.it

I am going to write this article in English, maybe someone will read it and will take action about this huge problem found few days ago. First off all, I have to mention that I had already spoken with their customer care service department, with two different dealers and nobody is interested. I am not speaking in general situation but most of the time, the people from around are acting like this : I am presenting a very seriously problem, and they are ignoring it hoping that someone else will handle it or will be resolved by it self.

I had a lot of Vodafone numbers, most of them where initially DigiMobil Italy, and then I port-out that number in Vodafone Italy. So, every time, for a couple days I had a temporary number until my final number is accepted by the network. Every time I made accounts at vodafone.it website in order to keep tracking about my credit, minutes, extra options , etc.

Because I am using Google Chrome as default browser, most of the time when I have to log in somewhere, the browser auto completes the fields corresponding to Username and Password. Honestly speaking, I don’t even remember the password from my blog.

Yesterday I took a look into my Vodafone Account in order to see the balance and amount minutes from my number. By default, there was saved my last credential from few months ago. So I stepped inside and it was totally messed up. I had another balance, other extra option and a lot of calls that I am not recognizing . It was strange because my calls weren’t there. My first thought was that someone made a clone after my SIM Card. I don’t think that I have people around me so smart, but everything is possible. So I re-arranged all my options, my tariff plan , I made a SIM exchange (!) online and will arrive home in about a week.

After I made all the modifications, in “my account”, I saw that I am not receiving confirmations via SMS. So, I took a look more deeper in the account and I was shocked : it was someone else account !

Then I saw the number and I believe that was a temporary number that I had few moths ago, and I let it unused after the first month.

What happened ? Vodafone gave the number to some other guy, he activated that number in 5th March 2013 and started to call. There was a balance for about 9€, the Vodafone Unlimited promotion, and a lot of personal data : the fiscal code, full address, the calls in clear text, data sessions and everything that can exist in their data base.

Yesterday and today I made a lot of calls to customer care department, I went to my dealer to speak about it and nobody cares . If the new client will write a complain, that’s fine, they will analyse it and reestablish his account as original. But nobody cares that I still have access to that number. Nobody cares that there are so many accounts in this situation. Basically , when a phone number is terminated, they are only blocking the incoming / outgoing calls, SMS and data . But they are not deactivating the services. So, when someone is buying that number as a new, they are making virtual SIM exchange in HLR so the services will become active on the new IMSI (unique code written behind the SIM).

Until they will wake up about the fraud that can be done, about  their vulnerabilities, about working and self respect, about working responsibility … the problem persists.

As I wrote few moths ago, since July 2012 the new technical director in Romania, is an Italian guy called Giovanni Chiarelli. I am still hoping that he is not getting all the Italian problems, vulnerabilities, free of charge data traffic (if you remember last year when I had about 12 * 20€ reactivation’s but free of charge) into Romania. This is the last thing that we need : chaos in Romanian GSM Networks.

And a screenshot for eternity :