“I’ve been considering changing my bank account number, social security number, and other accounts that are critical to living and working in the US,” Miller wrote in a post. According to AT&T documentation, all that is required for transfer is the information one could find on a recent cell phone bill: Account number, name of the account holder, billing address, and “pin or password if applicable” — noting that the minimal billing info is all that’s required if someone “can’t remember” their pin or password. It was all that juicy billing information, with which attackers can get way, way more by SIM porting and stealing people’s phone numbers and accounts. And it probably won’t change until an executive at T-Mobile or AT&T experiences the stomach-plummeting terror of having their Gmail account taken (along with Google Photos, Google Drive, Calendar, Contacts) and any number of their other accounts raided — like with Miller and Coonce, their Coinbase accounts, and financial accounts drained. We can, however, learn from the security mistakes Coonce and Miller made before losing their SIMs and connected accounts.