‘Got that boomer!’: How cybercriminals steal one-time passcodes for SIM swap attacks and raiding bank accounts

TechCrunch revealed that a criminal service called "Estate" has automated thousands of phone-based social-engineering attacks since mid‑2023 to capture one-time passcodes (OTPs), enable account takeovers and conduct SIM swaps; a bug exposed Estate’s unencrypted backend database with line-by-line logs of more than 93,000 attacks, victim phone numbers, member details and attack scripts, highlighting large-scale abuse of telecom providers and weaknesses in MFA reliance.