If you missed part 1 and part 2, here's the "too long, didn't read" version so you can quickly catch up on the story:

TL;DR of previous chapters

Part 1. I found out someone is calling companies from my phone number, trying to hack various accounts. They had control of my phone by getting into my cellular account and also hacked several of my emails. They hacked my Facebook, bank, Authy (used for my Purse.io and Coinbase), PayPal, and quite a few other websites. Nothing was stolen from me yet, and after adding an extra layer of security and 100s of password changes, they seemed to have stopped trying.

Part 2. A little more than six months later, the hacker tries to get into my T-mobile account again. This time they can't because I added security measures. Instead, they steal my phone number altogether by porting it out to Sprint because that is now much easier than hacking into my T-mobile. They then get into my PayPal and Venmo accounts. The hacker stole a few hundred from my PayPal.

If you read part 1 and 2, start here:

They stole your what?!?

You've probably heard of many people who have had their phone stolen. It even happened to me once. But, have you ever heard of someone's phone number getting stolen? That's what just happened to me.

Your mobile carrier can take a lot of steps to keep your account secure, but in the US, phone number porting is federally-regulated. An employee of T-mobile's security department told me that regulations say a carrier must have the same porting requirements for every customer. Therefore, it's illegal for them to make my phone number more secure against unauthorized porting. Thus, all someone needs to steal my number is my T-mobile account number and the last four digits of my SSN.

After finding out my number was ported to Sprint, the T-mobile rep I spoke to said: I can see here that someone has been calling us every day, trying to get your account number. After trying enough times, they finally got someone on the phone who didn't follow protocol. This allowed them to steal my number.

Results of the hack

• My carrier ended up recovering my stolen number a couple days later. But, by that time, I had already been assigned a new phone number. Since I had already gone through the trouble of letting everyone know my new number (my friends, family, and companies) I decided to keep that new one.

• A couple of my backup email accounts got hacked, but that situation was easily rectified.

• Paypal ended up refunding the stolen funds after filing a claim.

• The Venmo employee had never seen a situation like this where a fraudster stole someone's phone number to get into thier account. Probably in the theif's attempt to establish his device as an authorized one, he sent $200 to my girlfriend. Fortunately for me, that was just about all I had in that bank account at the time, so he wasn't able to send additional funds elsewhere. Luckily, no damage done there.

How to avoid these issues in the future

Step 1. To prevent this from happening to you, you should secure your email with Google Authenticator. Or even better, purchase and use Yubikey.

Step 2. Remove your phone number as a way to verify and restore passwords everywhere. Twitter and Facebook default to this method.

I'm not alone here. Hackers have gone after many in the bitcoin community using this method, including prominent names. Jered Kenna had millions in bitcoin stolen from him when his T-mobile number was ported. Andrew Lee, CEO of purse.io had his phone number ported from T-mobile. Blockchain VC, Bo Shen fell victim to the same tactic. Brock Pierce, Adam Draper, and others are victims as well.

Check out this excellent article from Kraken, showing you how to secure your accounts