How I Lost My $50,000 Twitter Username

This is some seriously scary stuff.

It’s hard to decide what’s more shocking, the fact that PayPal gave the attacker the last four digits of my credit card number over the phone, or that GoDaddy accepted it as verification.

Social engineering has been done since the beginning of time. Giving out credit card information, regardless of who is asking for it should just not be done. Since it has the powers to be used as a password substitute, it should be treated in the same manner.

Using two-factor authentication is a must. It’s probably what prevented the attacker from logging into my PayPal account. Though this situation illustrates that even two-factor authentication doesn’t help for everything.

There is no reason to not use two-factor authentication these days. Do however take note¹ of all sites using two-factor auth connected to your phone , in case you need to change the phone number in the future².

I use a tag in 1Password for all sites requiring two-factor authentication. ↩
This happened to me a while ago (a story for another day), which has lead me to always make it a conscious decision when entering my phone number on a website. I keep track of websites having my phone number using a tag in 1Password. ↩