New reports show thieves can use your personal details and your phone number without touching your device. Here are 9 simple steps.
Two new reports show how thieves can use your personal details and your phone number without ever touching your device. One explains a student loan fraud built on stolen identities. The other explains how text message codes can be caught inside phone networks. Today, check your credit, move away from text codes where you can, and keep one backup unplugged.
What the reports say
According to Ars Technica, the U.S. Justice Department charged five people in a crackdown on "ghost students." These are fake students created with real people's stolen personal details. Fraudsters buy those details. They most often target high school graduates who never went to college and went straight to work.
The fraudsters then fill out the FAFSA. That is the Free Application for Federal Student Aid. If a school accepts the fake student, leftover aid money goes to bank accounts the fraudsters control. They use AI to fill out forms, do coursework, and even look like they are attending online classes.
Officials said they found over 830,000 possibly fraudulent student aid accounts. Victims may not learn about it until the government asks them to repay loans years later. In the meantime, their credit can be damaged.
A separate report from BleepingComputer explains "signaling." These are background messages phone companies send each other to route your calls and texts. Two systems do most of this work. SS7 is used for 2G and 3G. Diameter is used for 4G and most 5G. Someone with access to these systems can track a phone, redirect its calls and texts, and receive its text message codes. None of this touches your phone, and it leaves no trace on it.
Tips to protect your identity
- Check your credit reports. Look for loans or accounts you did not open. Do the same for young adults in your family, especially those who went straight to work after high school.
- Do not ignore student loan mail you did not expect. A bill for a loan you never took can be the first sign. Contact the lender or the Department of Education using contact details you find yourself, not ones in the message.
- Never let anyone use your bank account to receive money. The Justice Department said dozens of Americans opened bank accounts to act as "money mules." A money mule moves stolen money for someone else. Say no, even if the offer sounds like a simple job.
Tips to protect your phone number and codes
- Choose app codes over text codes. Many sites send a one-time code by text when you log in. Where a site offers it, pick an authenticator app instead. That kind of app makes the code on your phone, so the code is not sent as a text.
- Use a strong, different password for every account. BleepingComputer explains that a caught text code is most dangerous when paired with a stolen username and password. A password manager can store long passwords for you.
- If you suddenly lose service for no clear reason, act fast. The report says a false roaming claim can cut off service to a phone. Call your phone company from another phone. Then check your bank and email accounts for changes.
Tips for backups and AI helpers
- Keep one backup that is unplugged. Ars Technica reports that Fujifilm is making five times more storage tape. Large cloud companies use tape because it can be disconnected and stored in a drawer or vault. Fujifilm says this helps protect data from ransomware. Ransomware is harmful software that locks your files and demands payment. At home, you can copy files to an external drive, then unplug it and put it away.
- Give AI helpers only the access they need. Help Net Security notes that AI agents can now open accounts, place orders and move money for their owners. An AI agent is a program that takes actions for you. If you use one, set a spending limit and an end date. Remove its access when the task is done.
- Small businesses: ask who stands behind an AI request. The same report says a valid login token alone cannot prove an AI agent is genuine. Stolen logins can look real. For example, a bank might let an agent pay approved billers but require an extra check for new payees. Ask for a second check on new payees and on actions over a set limit.
The short version
Thieves often do not need your device. They need your personal details, your phone number, or a login. Check your credit and watch for loans you did not take. Use app codes and strong passwords. Keep one backup offline. Put clear limits on any AI tool that can spend money for you.
Have a question about anything here? Email me at sales@appwt.com or call (888) 565-0171, and I will answer it.
Sources
- Thousands of "ghost students" use AI to steal millions in student loans, DOJ says, Ars Technica, 2026-10-30
- SS7 and Diameter Attacks: How Signaling Flaws Expose Your Phone, BleepingComputer, 2026-10-30
- Fujifilm to boost tape production 5x as AI fuels archiving demand, Ars Technica, 2026-10-30
- Shufti ties AI agent actions to verified owners and permissions, Help Net Security, 2026-10-30
Tags
Frequently Asked Questions
What is a ghost student?
It is a fake college student created with a real person's stolen personal details. Fraudsters use the fake student to collect student aid money.
Who do ghost student fraudsters target most?
Officials said they most often target high school graduates who never attended college and went straight to work.
How would I know if my identity was used for student aid?
Victims often do not find out until the government asks them to repay loans years later. Checking your credit reports can help you spot accounts you did not open.
Can someone get my text codes without touching my phone?
Yes. BleepingComputer explains that attackers with access to phone network signaling can redirect texts, including one-time codes. It leaves no trace on your phone.
Why keep a backup unplugged?
A backup that is disconnected cannot be reached by an attack on your computer. Fujifilm says this is why tape is used to protect data from ransomware.
Enjoyed this article?
Share it with your network
