AT&T Wireless Customer Information

by Frater Perdurabo

I got home from work last night and saw an odd number on my Caller ID: UNKNOWN NAME, (812)-123-4567

As paranoid as I am, I put on my tinfoil helmet and decided to see what I could do to find out who the number belonged to.  After visiting a handful of sites which promised results, but which I really didn't want to pay for, I decided to see what I could do with the wireless providers' websites themselves.

I didn't know which provider owned the exchange, so I went through a few and found that it was owned by AT&T.  Whitepages.com will give you some information about an exchange, usually including the city and state and sometimes the provider, so it may be worth a shot.

After a quick scan of the AT&T Wireless home page, I found out how to get the information I wanted.  Here's what to do:

Fire up your web browser, go to: wireless.att.com

and click on "Sign in to your account."  Next, click the "Get Started" link for new user registration.  The next page will ask for "your" cell phone number.  Put in the AT&T cell number that you would like a little more info on, and one of a few things will happen:

1.)  If the phone number in question is one of AT&T's prepaid "GoPhone" numbers, you will get a page with another link and instructions to log in through the GoPhone portal.

2.)  If the subscriber has already registered their phone with the site, you will simply get a message to that effect.

3.)  Or, if the subscriber has yet to register, you will be directed to a sign-up page.  In many cases, this will include one or more of the email addresses that the subscriber provided when he or she began to contract with AT&T.

Obviously, this is poor handling of customer information.  How many people do you know with an email address in the format: firstname_lastname123@provider.com

It turns out that this was the case with the number in question.  I now knew that my fiance's former coworker had called her, wondering how she was doing.  I removed my tinfoil hat.

Additionally (and this is where things can get really fun), one only needs the last four digits of the subscriber's Social Security number to complete the registration process and be able to check the subscriber's mail, change their voicemail password, or order additional crap from AT&T to be charged on their bill.  While I don't know where one would be able to acquire someone's SSN with only a name, address, and phone number, I'm sure that at least one of you readers out there can lead the way.  We're hackers, right?

Well, that's about it for now.  If anyone else has info regarding other wireless providers' websites, feel free to submit it to 2600, or maybe just bang your head against the walls of corporate policy in an attempt to tell them first.

Shout outs: Robert Anton Wilson, LSD, Dr. Croi.  And, remember, Barack Obama is the only candidate to support Net Neutrality.