Episode 55 of The Security Podcast of Silicon Valley aired on October 1, 2024, with Jon McLachlan hosting. The guest was Haseeb Awan, founder and CEO of Efani Secure Mobile, a cell phone service built against SIM swapping (Podbean). Jon started with his LinkedIn.
“And just glancing at your LinkedIn, you’ve been a founder of something or another your entire life.”
Jon McLachlan, at 0:23
His LinkedIn headline calls him a Y Combinator alum who secures the cell phones of high-risk individuals. It dates Efani to September 2019 and his time as a co-founder of BitAccess to September 2013 through November 2015 (LinkedIn). Efani’s leadership page, in the company’s own words, credits him with two successful business exits, more than $100 million raised in venture capital, investments in more than 30 companies and advice to more than 10, a master’s in engineering management, a PMP, and the Y Combinator and Next Founders programs (Efani). CoinDesk profiled him in September 2020. He had been SIM swapped four times, the first in 2018, and he founded Efani in 2019 and bootstrapped it (CoinDesk, via Yahoo Finance).
For readers new to the vocabulary, four definitions. A SIM card is the chip that stores a subscriber’s identity number and the key used to identify and authenticate that subscriber on the network (Wikipedia). A SIM swap is account takeover fraud that goes after two-factor authentication when the second factor is a text message or a call (Wikipedia). Mobile number portability lets a customer keep a phone number when changing operators (Wikipedia), and a port-out attack abuses that process to move the number to someone else. And an MVNO, a mobile virtual network operator, sells service without owning the network, buying bulk access at wholesale rates and setting its own retail prices (Wikipedia).
The tape doesn’t give a recording date. It fits July 2023. Haseeb says the company he co-founded went public on the 3rd of July, just before the Fourth, and that he shared the story on the Fourth. Bitcoin Depot, which announced in November 2022 that it had acquired a majority of Bitaccess (Metro Atlanta CEO), closed its business combination with GSR II Meteora on June 30, 2023 and was set to begin trading on Nasdaq as BTM on July 3, 2023 (Crowdfund Insider). The episode aired about 15 months later.
This page is the rest of it: a section for each part of the conversation with the sources beside it, seventeen figures, twenty-eight clips from the tape, the full transcript, and five tools: a quiz, a scorecard for whether someone could take your number tonight, a calculator for how many accounts a SIM swap would open, a timeline from 2013 to 2026, and a to-do list.
A note before the sections. A few words on the tape are hard to hear, and where the decodes disagree, the transcript marks its best guess in brackets and the page doesn’t quote those words. The numbers about Efani’s customers, retention, insurance and growth, and about BitAccess’s locations and cash, are Haseeb’s account or Efani’s own claims, and the page says so.
Fundraising, business development and media
Jon asked what he did at BitAccess.
“I was responsible for fundraising most of the time, business development and media, mostly PR”
Haseeb Awan, at 0:46
In his words, the job was making sure people buy the product, give the company money to build it, and talk about it. Bitcoin Depot’s announcement describes Bitaccess as founded in 2013, with its first bitcoin ATM launched in January 2014, and by November 2022 providing operating software to bitcoin ATM operators in more than 15 countries (Metro Atlanta CEO). A bitcoin ATM is a kiosk where people buy bitcoin with cash or a debit card, and some machines also pay out cash for bitcoin (Wikipedia).
10,000 locations of Bitcoin ATM
Jon asked how BitAccess changed the world. Haseeb answered with the end of the story first.
“At the time of acquisition, we had 10,000 locations of Bitcoin ATM.”
Haseeb Awan, at 1:12
“We started from almost zero, obviously zero, and now 10,000 locations.”
Haseeb Awan, at 1:15
The listing landed just before the Fourth of July, and he shared the story on the holiday.
“So this is the American dream.”
Haseeb Awan, at 1:40
His LinkedIn tells the same arc in one line: growth to 10,000 locations, an acquisition in 2021 and a Nasdaq listing in 2023 under the ticker BTM (LinkedIn). The start, by his account, was practical. The founders wanted to buy bitcoin for themselves, and they needed a system so people could buy it.
Timing is very critical
Haseeb doesn’t credit a grand plan. He wasn’t planning, he said, to start one company and then the next.
“So we were in a good industry at the right time.”
Haseeb Awan, at 2:03
He compared it to the moment the tape was made, when any pitch with AI in it got a meeting.
“Nowadays, you talk about anything about AI, people want to invest in you.”
Haseeb Awan, at 2:11
“timing is very critical in the industry.”
Haseeb Awan, at 2:20
Jon put it in a founder’s terms.
“If the market is ready for what you’re about to do, it’s huge.”
Jon McLachlan, at 2:24
Haseeb’s counterexample was launching a new layer one blockchain at that moment, a much harder pitch. Jon offered security as the other kind of market.
“I feel like security is still a pretty hot topic.”
Jon McLachlan, at 2:43
Cyber attacks are not going anywhere
Haseeb agreed, and explained why it changes how a company grows.
“I think that cybersecurity, like cyber attacks, are not going anywhere. They’re increasing.”
Haseeb Awan, at 2:49
In an industry where demand grows automatically, he said, a company doesn’t have to do a lot of things.
“You just have to serve the customers.”
Haseeb Awan, at 3:02
His examples were anything medical during COVID, and bitcoin ATMs, where BitAccess just kept on producing machines. Efani, he said, is the same kind of business.
“So, in our current business, we don’t have to do a lot of marketing.”
Haseeb Awan, at 3:23
“Like, people are hacked, so they come, they say, what’s the more secure cell phone service?”
Haseeb Awan, at 3:26
The demand comes from the attacks. That’s the market Jon called a hot topic, seen from the inside.
I was hacked four times
Then the origin story.
“So, I was hacked myself. Like, I was hacked four times.”
Haseeb Awan, at 3:34
“I was looking for a solution, and I figured out that there’s no cell phone service for rich people.”
Haseeb Awan, at 3:36
His comparison was the rest of a wealthy person’s life, where there’s always a private option. The phone, he said, is the same for everyone.
“If Bill Gates wants to buy a cell phone service, he has to go to the same Verizon store.”
Haseeb Awan, at 3:44
“But when cell phone services come in, they all have the same plan.”
Haseeb Awan, at 3:57
So Efani built the premium tier that didn’t exist. Its company page today describes the customers as highly targeted individuals (Efani), and in 2020 CoinDesk reported that about a third of its clients were cryptocurrency users (CoinDesk, via Yahoo Finance).
Port attack, SIM swap, SIM jacking
Jon asked what had happened. Were they SIM jackings?
“So people call it port attack, SIM swap, SIM jacking.”
Haseeb Awan, at 4:22
Many names, he said, and one problem.
“The problem is that someone gets access to your telephone number without your consent.”
Haseeb Awan, at 4:27
He walked through how it feels from the victim’s side. You’re camping, or doing whatever, something seems off with the phone, and you tell yourself it’s maybe just a network issue. Then the emails start: your password was changed, please complete this verification. Then you can’t log into your email.
“someone has taken over your telephone account, because telephone account is my identity.”
Haseeb Awan, at 4:48
The attacker, he said, gets the number one of two ways.
“They bribe people in the store or do social engineering, and they take care of their telephone number for half an hour, an hour.”
Haseeb Awan, at 5:00
The FBI lists the same methods. Its 2022 public service announcement says criminals run SIM swap schemes mainly through social engineering, insider threat or phishing (FBI IC3). Social engineering, in this sense, is psychological manipulation to get people to take an action or give up information (Wikipedia). Once the number moves, everything tied to it follows.
“because your email is linked to your telephone number, your bank accounts are linked to your telephone numbers.”
Haseeb Awan, at 5:10
“And within, like, maybe an hour or so, they take away all your money”
Haseeb Awan, at 5:15
Then the email, with all the information in it, and the social media accounts, where the attacker asks your friends for money.
From janitors to CEOs
Jon asked whether being hacked was how he got into security. It was, and it’s common, Haseeb said.
“People from janitors to, like, CEOs of the company get hacked all the time.”
Haseeb Awan, at 5:46
“It’s happening as we speak.”
Haseeb Awan, at 5:50
He described the victim calling the carrier or the bank, hearing an apology, and spending the next day or two on the phone, only to get a letter saying nothing can be done.
“And they’ll say, sorry for the inconvenience, let me work on it.”
Haseeb Awan, at 6:01
His explanation for why so many people lose this way was the kind of plan they’re on.
“because they were on a family plan or they were using a common plan.”
Haseeb Awan, at 6:24
The FBI’s numbers rose fast in the years before the tape. From January 2018 to December 2020, its Internet Crime Complaint Center received 320 SIM swapping complaints with adjusted losses of about $12 million. In 2021 alone, it received 1,611, with adjusted losses of more than $68 million (FBI IC3).
Jon summed up why the number matters so much.
“And if you can steal someone’s phone number, you basically have access to their digital footprint, their digital identity.”
Jon McLachlan, at 6:39
“You can reset accounts. You can reset passwords.”
Jon McLachlan, at 6:46
We are all MVNOs
Jon asked how Efani pulls it off. Haseeb started with the business model behind every small carrier brand on a store shelf.
“So basically, we are all MVNOs, mobile virtual networks.”
Haseeb Awan, at 7:20
His analogy was cloud hosting. Plenty of companies run on someone else’s servers, and plenty of carrier brands run on someone else’s network. A new brand asks for a thousand SIM cards and a terabyte, in his example, and starts its own company.
“So you can start, like, hey, Jon Secure Mobile tomorrow, or Jon Mobile, right?”
Haseeb Awan, at 7:42
Each MVNO picks a demographic, he said, such as college students or a particular community, and most go after the low end of the market, because the top companies don’t want those customers.
“They don’t want to deal with someone who doesn’t have a credit card or doesn’t want to buy expensive plans.”
Haseeb Awan, at 8:07
Efani went the other way. CoinDesk described it in 2020 as operating a bit like an MVNO on the networks of Verizon, AT&T and T-Mobile, relying on them only for coverage, with everything else for its $99 a month plan handled in house (CoinDesk, via Yahoo Finance).
We control the port out
Haseeb went to the same kind of company every MVNO goes to, with one difference.
“but we control the port out, which means that no one can make changes to the account unless they go through a process.”
Haseeb Awan, at 8:20
The process came from his years in bitcoin ATMs, a business that moves cash and draws thieves.
“we have pretty much gone through every possible theft attempt that you can think about.”
Haseeb Awan, at 8:29
By his account, the company moved a lot of cash the year before, a figure he said is public now that the company is listed.
“so we transferred $1 billion in cash around 10,000 locations, right?”
Haseeb Awan, at 8:52
“So I realized that, okay, man, what are the weaknesses in the system? How do you protect?”
Haseeb Awan, at 9:22
One answer was to make employees hard to find and to limit what any one of them can do. Inside the company, he said, employees’ locations aren’t known and their access is limited.
“So, like, in our company, we make sure that no one knows our employee location.”
Haseeb Awan, at 9:25
CoinDesk’s 2020 profile spelled the process out. Every account had a minimum of seven authentication steps to replace a SIM card, and as many as 11. Calling customer service changed nothing, because the staff weren’t authorized to make changes. A change required a letter of intent signed in front of a notary, with the notary verified by Efani’s legal team, and then a seven-day cool-off before a new SIM card could be activated. Efani sent each customer two encrypted SIM cards at sign-up, ran background checks on employees and kept customer data in separate silos (CoinDesk, via Yahoo Finance). Its company page now speaks of 11 layers of checks before a SIM replacement (Efani). Haseeb’s line to CoinDesk described the company better than the word carrier does: “We are a cybersecurity firm that provides telecom services.”
An 80% chance
Telecom in general, he said, doesn’t go that far, because it’s super easy to hack people’s accounts anyway.
“So if someone comes after you, there’s an 80% chance they’ll be successful.”
Haseeb Awan, at 9:54
“So we said we will make it so difficult that an average hacker cannot come after clients.”
Haseeb Awan, at 10:00
The public research is close to his number. In a study published in 2020, Kevin Lee, Ben Kaiser, Jonathan Mayer and Arvind Narayanan of Princeton signed up for 50 prepaid accounts, 10 each at AT&T, T-Mobile, Tracfone, US Mobile and Verizon, and then called to ask for SIM swaps. 39 of the 50 attempts worked, including all 10 at AT&T, at T-Mobile and at Verizon. The weak spots were questions about recent calls, payment details from refill cards, information anyone could look up, security questions, and representatives who skipped authentication (Princeton, at IEEE ConPro 2020). 39 of 50 is 78%. Engadget’s report on the study added that 17 of the 140 websites the team examined, all using phone-based authentication, could have had passwords reset with the hijacked number alone (Engadget).
Not in a business of convenience
Control has a cost, and Haseeb named it. Efani made changes so hard internally, he said, that it can only offer one or two plans.
“So we only have two plans, yearly and monthly.”
Haseeb Awan, at 10:12
“We just say that we give you security, that’s it.”
Haseeb Awan, at 10:19
“And it’s frankly a pain to change anything on our system.”
Haseeb Awan, at 10:22
There are no streaming bundles, and some changes need permission. He’s fine with that.
“We are not in a business of convenience, we are a business of security.”
Haseeb Awan, at 10:30
“And with security, you have a lot of inconvenience.”
Haseeb Awan, at 10:33
“It’s the cost of being famous, the cost of being more secure.”
Haseeb Awan, at 10:41
“It’s the price to pay.”
Jon McLachlan, at 10:44
Haseeb called it the price of privilege. So it costs more, and his analogy for why was housing.
“If you live in a shared apartment, your cost is low. But if you want to have your own ranch, your cost will be higher.”
Haseeb Awan, at 10:55
“And you’re going to get a little bit better security if you’re not sharing that space.”
Jon McLachlan, at 11:01
In 2020, CoinDesk put the plan at $99 a month (CoinDesk, via Yahoo Finance). The trade-off is the same one every security team makes with a hardware key or a change freeze. Friction that stops an attacker also slows the owner, and the product is the friction.
I hate operations, but I love product work
Jon asked about a typical day.
“I hate operations, but I love product work.”
Haseeb Awan, at 11:19
Every couple of days he talks to the media and to professionals, as he was doing on the tape. Much of his work involves talking to extremely important people. He doesn’t watch TV or sports, so he often has no idea how famous they are, which he called the funniest part of the job.
“they probably will have 20, 30, 40 million followers, and I have no clue who they are.”
Haseeb Awan, at 11:46
To him, as Jon finished the thought, they’re just another human being.
The goalkeeper
The other constant is fear of the one bad day.
“I’m always scared of being hacked.”
Haseeb Awan, at 12:27
A security company, he said, is only good until it gets hacked.
“Our entire business, our entire life would depend on not being hacked.”
Haseeb Awan, at 12:39
His analogy was a goalkeeper.
“If you’re a goalkeeper or a defender in soccer or any sports, you don’t know who’s coming and where the ball is coming from.”
Haseeb Awan, at 12:45
The attackers he listed were state-level actors, ordinary criminals and people who work against Efani, and they don’t keep office hours.
“While I’m sleeping, they’re still working to hack our clients.”
Haseeb Awan, at 13:15
Then he came back to the goalkeeper.
“You only are remembered for the goal you missed most of the time.”
Haseeb Awan, at 13:24
“So, in a hack thing, there are thousands of cybersecurity companies, and we only really know about them until they get hacked.”
Haseeb Awan, at 13:26
Jon drew the conclusion for a company that sells security to individuals.
“So, if any of your customers get hacked, it’s actually you that get hacked, and you’re going to take that reputational damage.”
Jon McLachlan, at 13:42
In our case, you get money
Jon added that the customer suffers too. Haseeb’s answer was that the customer is insured.
“That’s part of the package, yeah.”
Haseeb Awan, at 13:58
His comparison was what happens at a big carrier after a SIM swap: you get an apology. And at Efani:
“In our case, you get money.”
Haseeb Awan, at 14:05
“And cybersecurity insurance is a very real thing, and it’s a great way to help cover the unknown unknowns and the gaps in there.”
Jon McLachlan, at 14:16
Efani’s company page describes $5 million in insurance coverage with Lloyd’s of London and doesn’t list the terms there (Efani). CoinDesk reported in 2020 that plans were insured up to $5 million by Lloyd’s for theft or data breaches (CoinDesk, via Yahoo Finance). Lloyd’s itself is an insurance and reinsurance market rather than an insurance company (Wikipedia). Putting money behind a promise is a strong signal. A company that pays when it fails has priced its own failures.
Everyone is an operator now
Jon asked how big the team was.
“Just over a dozen.”
Haseeb Awan, at 14:30
Jon guessed that a founder who doesn’t love operations must have strong operations people. Haseeb was more candid than most founders.
“Well, things are always breaking, to be honest.”
Haseeb Awan, at 14:45
“As a founder, I’ll be lying if I believe that everything is perfect.”
Haseeb Awan, at 14:50
For the previous two months, he said, they had been unable to scale as they wanted.
“So we had to shut down our system multiple times, so we can’t take any more orders.”
Haseeb Awan, at 15:05
The fix, two days before the tape, was a reorganization.
The engineering team stopped being called the engineering team.
“It’s called operations team now.”
Haseeb Awan, at 15:21
“what if we turn our engineers into operators”
Haseeb Awan, at 15:24
Haseeb started a sentence and Jon finished it.
“Whoever feels the pain”
Haseeb Awan, at 15:33
“Is going to be able to fix the pain.”
Jon McLachlan, at 15:36
“So if an engineer is working on helping a client, okay, I can just write a couple of lines of code and can automate this process.”
Haseeb Awan, at 15:38
By the end of the exchange, everyone at Efani was an operator.
Our first paid customer
Jon asked for the best day.
“I think the first one was when we got our first paid customer.”
Haseeb Awan, at 16:19
“and it was, like, just a month in.”
Haseeb Awan, at 16:27
Jon was impressed. A month is fast for a first sale. Haseeb was customer number one himself, so the first paid customer meant a call where both ends were on Efani.
“I made a call from my line to his line.”
Haseeb Awan, at 16:37
“So this is the most secure cell phone service you can have in the US.”
Haseeb Awan, at 16:45
Then the revenue milestones, and the retention rate, by his account.
“when we crossed $100,000 ARR, when we did a million-dollar ARR, and when we turned profitable.”
Haseeb Awan, at 16:51
“we have a retention of 98, 99%, which means that a customer signs up, they stay with us.”
Haseeb Awan, at 17:02
ARR is annual recurring revenue, and retention is the share of customers who stay. High retention is also what makes the referral business he describes later possible.
People’s lives depend on that
Jon asked for the hardest day. Haseeb’s answer was the moments when a customer is onboarding and the activation takes time.
“So they’re out of their cell phone for half an hour, or they sometimes screw up and they’re out of service for one day.”
Haseeb Awan, at 17:39
“people’s lives depend on that.”
Haseeb Awan, at 17:51
He thinks about the customer who needs the phone for work, or for a medical emergency, and is alone.
If the customer has no service, neither side can reach the other.
“And that is something that happened, like, maybe four or five times.”
Haseeb Awan, at 18:16
“It sounds like you care deeply about your customers and your customers’ well-being.”
Jon McLachlan, at 18:24
An outage on a secure service is still an outage. Port-out protection exists to keep a number from moving, and the hardest part of the job is the one moment it has to move on purpose.
My entire castle that I built
Haseeb explained why it’s personal. He had thought he was well protected.
“As in, I would use hardware keys, I will have a separate laptop, use fingerprints, like, firewalls.”
Haseeb Awan, at 18:42
“You think about a security product that you needed, and I’ll have it to install myself, and no one was able to hack me.”
Haseeb Awan, at 18:48
The SIM swap went around all of it.
“my entire castle that I built, basically, there’s no foundation to that, because someone can literally go into a store, steal my number, and I can’t do anything.”
Haseeb Awan, at 19:28
“You feel violated.”
Jon McLachlan, at 19:51
That’s the lesson for anyone who owns a security program. Hardware keys, a new phone and firewalls protect the device. The phone number is a separate asset held by a third party, and if account recovery still runs through it, the keys never get a chance to matter.
I was here
Haseeb described the feeling with a thought experiment.
“imagine you come to your house after camping, and there’s a note on your table.”
Haseeb Awan, at 20:27
“I was here. That’s it.”
Haseeb Awan, at 20:32
“The door was locked and the windows are shut and everything looks normal, except the note. That’s very creepy.”
Jon McLachlan, at 20:36
“So it happened to me four times.”
Haseeb Awan, at 21:03
Nothing visible is missing, but someone was inside. Later in the conversation Jon put the technical problem in one sentence. When the phone loses coverage:
“you can’t tell the difference between I’m out of range versus my phone just lost its phone number.”
Jon McLachlan, at 21:24
The FBI’s advice covers exactly that moment. Its 2022 announcement tells people to be aware of any changes in SMS-based connectivity, and to use strong multi-factor authentication such as biometrics, physical security tokens or standalone authentication apps (FBI IC3).
The house or the phone
Haseeb’s other thought experiment was a forced choice between giving a hacker access to one of two things for half an hour.
“Give me access to your house or give me access to your cell phone.”
Haseeb Awan, at 22:46
“What would you rather have it access for half an hour?”
Haseeb Awan, at 22:53
Jon’s answer was that he’d give up both, and then he thought about it.
“I know what my cell phone has on it. It’s probably more than what it’s inside my house.”
Jon McLachlan, at 23:06
“So this is how personal cell phones have become.”
Haseeb Awan, at 23:25
Jon tied it back to the market Haseeb found. He didn’t blame the victims, and he saw no incentive for the carriers.
“And no one wants to blame the victim.”
Jon McLachlan, at 23:56
“there’s no financial incentive for them to secure their services”
Jon McLachlan, at 24:02
“And you fixed it. You took ownership of that one problem and you focused on it.”
Jon McLachlan, at 24:30
The rules changed after the tape, when the FCC adopted requirements for SIM changes and port-outs, covered in After the tape.
If I can secure an extra person per day
Jon asked what success looks like in the future, as far out as Haseeb wanted to go.
“I’m super happy with wherever I am, to be honest.”
Haseeb Awan, at 25:00
Jon asked whether Efani was a lifestyle business or a hockey stick.
“I wouldn’t say, like, we are growing the venture scale, Silicon Valley style, but we are certainly growing pretty decently.”
Haseeb Awan, at 25:20
“We don’t have a quota to hit, because we don’t have, like, investors or anyone on the cap table.”
Haseeb Awan, at 25:29
Efani is profitable, he said, and he isn’t in a rush.
“That’s an amazing place to be.”
Jon McLachlan, at 25:46
Efani’s company page still describes it as founded and bootstrapped in 2019 (Efani). Without a funding round to chase, his goal is a daily one.
“So I said, if I can secure an extra person per day, that’s a win for me.”
Haseeb Awan, at 25:58
Ford v Ferrari
Jon asked for a book or movie that changed how he sees the world. Haseeb picked a movie, and started describing a scene about the start of the Ford Mustang, which he said is one of his favorite cars. Jon placed it.
“Oh, this is Ford v Ferrari. Oh, yes, yes, I did see this one, actually.”
Jon McLachlan, at 26:27
Ford v Ferrari is a 2019 film directed by James Mangold, with Matt Damon as Carroll Shelby and Christian Bale as Ken Miles, who build a car for Henry Ford II and Lee Iacocca to beat Ferrari at Le Mans in 1966 (Wikipedia). Ford has made the Mustang since 1964 (Wikipedia). The line Haseeb remembers, as he recalled it, is about who knows what you bought.
“But when people want to buy Ferrari, the entire town knows that he has bought a Ferrari.”
Haseeb Awan, at 26:49
“When people buy a cell phone service, they don’t tell their people that, oh, I just switched to T-Mobile, unless they got an amazing deal or something.”
Haseeb Awan, at 26:56
With Efani, he said, they tell everyone.
“I think 70% of business is referral.”
Haseeb Awan, at 27:07
“It’s not about how many people do you serve, it’s about how do you serve them.”
Haseeb Awan, at 27:12
“It’s not about how many, it’s about how.”
Jon McLachlan, at 27:15
Take more risks and play the long game
Jon asked what he would tell his younger self.
“Take more risks and play the long game.”
Haseeb Awan, at 27:32
Jon asked whether the younger Haseeb would listen, or write him off as a crazy old man. Haseeb’s pitch was about memory.
“I can just say that no one remembers you after what you did after a year.”
Haseeb Awan, at 27:54
“there are more chances to be forgiven when you’re younger.”
Haseeb Awan, at 28:01
No framework for security in crypto
Jon’s last question was the tool Haseeb wishes someone would build. His answer was a standard for crypto.
“we have a lot of frameworks on security for regular companies, but there’s no framework for security in crypto.”
Haseeb Awan, at 28:36
By his estimate, fewer than a dozen companies in all of crypto were SOC 2 certified at the time, while in finance the share is very high. SOC 2 is one of the AICPA’s system and organization controls reports, an audit of a service organization’s controls (Wikipedia). Our guide What Even Is a SOC 2? covers what the report does and doesn’t prove.
“the bar to enter in crypto is so low.”
Haseeb Awan, at 29:16
“there are billions of dollars hacks every year.”
Haseeb Awan, at 29:22
Chainalysis counted about $3.7 billion stolen in cryptocurrency hacks in 2022 and about $1.7 billion in 2023, as reported by SecurityWeek (SecurityWeek). Haseeb’s idea had two halves. For an investor, a short checklist with insurance at the end.
“like an insurance product for crypto, because you did all of those things.”
Haseeb Awan, at 29:33
For a company, an outside audit, because even well-funded teams get the basics wrong.
“people have raised a billion dollars in funding and they’re on a family plan”
Haseeb Awan, at 29:39
“So they don’t even know how to use self-custody and everything.”
Haseeb Awan, at 29:55
“So I think there’s a need for certification by an independent party on security of a company.”
Haseeb Awan, at 30:00
Jon agreed. Not yet.
That’s why I go into security
Jon thanked him and said he was sorry for what Haseeb had been through, and that he had used it to build something important. Haseeb’s reply was short.
“That’s improved people’s lives. That’s why I go into security.”
Haseeb Awan, at 30:58
Jon asked where people should go to try it.
“They just, obviously, Efani.com, E-F-A-N-I dot com, that’s the obvious place.”
Haseeb Awan, at 31:05
After the tape
The rules around phone numbers changed after the tape, and the case for keeping account recovery off them got stronger.
On November 15, 2023, the FCC adopted rules to protect consumers from SIM swap and port-out fraud (FCC). Carriers have to use secure methods to authenticate a customer before a SIM change or a port-out, and those methods can’t rely on readily available biographical information, account information, recent payment information or call detail records. They have to notify customers right away of a SIM change or port-out request, offer a free account lock against both, keep customer information away from anyone who hasn’t authenticated, train their employees, and keep records of these requests for three years (Federal Register). That list of banned methods reads like the Princeton study’s list of weak spots. The rules took effect on January 8, 2024, except the information collections that needed review. On July 5, 2024, the FCC waived the July 8, 2024 compliance date until the Office of Management and Budget finished its review and the agency announced a new date (TLP).
On January 9, 2024, an unauthorized party took control of the SEC’s account on X through the phone number tied to it, in an apparent SIM swap, and posted a fake announcement that the agency had approved spot bitcoin ETFs. Multi-factor authentication on the account had been turned off by X support in July 2023, at staff’s request (SEC).
On December 18, 2024, CISA published mobile communications guidance for highly targeted individuals, the same phrase Efani uses for its customers. One line is short: “Do not use SMS as a second factor for authentication.” It recommends FIDO security keys or passkeys instead, and a PIN and multi-factor authentication on the mobile carrier account, because porting a number needs the PIN and porting is a key step in a SIM swap (CISA).
Haseeb’s LinkedIn now lists membership in the InfraGard National Members Alliance since May 2025 (LinkedIn). InfraGard is a nonprofit public-private partnership between U.S. businesses and the FBI (Wikipedia). His recent posts go beyond the carrier to the accounts behind it. On October 24, 2026, he walked through how support staff can be talked into resetting an Apple account, starting from the 2012 hack of the journalist Mat Honan, and recommended security keys for an Apple Account and an offline encrypted backup.
If someone talked their way into my Apple account tonight, what would I lose?
Haseeb Awan · October 24, 2026
It’s the same attack one layer up. Whoever can talk a person at a counter or on a support line into a reset owns whatever that reset unlocks, whether it’s a phone number or an account.
Did you catch it? A seven-question quiz
Seven questions from the episode. Each answer links the moment in the transcript.
Quiz · seven questions
Did you catch it?
Pick an answer to see whether you caught it, and where it is on the tape.
-
How many times was Haseeb SIM swapped before he started Efani?
- Once
- Twice
- Four times
c. "Like, I was hacked four times." Transcript, 3:35.
-
What did Efani keep control of when it built on another company's network?
- The cell towers
- The port out
- The phones
b. "but we control the port out, which means that no one can make changes to the account unless they go through a process." Transcript, 8:20.
-
How many plans does Efani offer, by Haseeb's account?
- Two, yearly and monthly
- Five, with streaming bundles
- One per customer
a. "So we only have two plans, yearly and monthly." Transcript, 10:12.
-
After a SIM swap, what does an Efani customer get, in Haseeb's comparison with a big carrier?
- An apology
- A new phone
- Money
c. "In our case, you get money." Transcript, 14:05.
-
What did Efani call its engineering team after the reorganization?
- Product
- Operations
- Support
b. "It's called operations team now." Transcript, 15:21.
-
How much of Efani's business comes from referrals, by Haseeb's estimate?
- 70%
- 30%
- Almost none
a. "I think 70% of business is referral." Transcript, 27:07.
-
What does Haseeb say crypto is missing?
- Investors
- A security framework
- Exchanges
b. "we have a lot of frameworks on security for regular companies, but there's no framework for security in crypto." Transcript, 28:36.
Could someone take your number tonight?
Haseeb’s whole business rests on one question: if someone walked into a store tonight and asked for your number, would they get it, and what would it open? Eight questions on your company’s answer.
Scorecard · eight questions
Could someone take your number tonight?
Answer for your leaders, admins and finance team as they work today. If two answers fit, pick the lower one.
-
Do your leaders' email, bank and admin accounts still accept a text message code or a text reset?
- Yes, most of them
- Some have moved to keys or an app
- No, keys or passkeys wherever it matters
"because your email is linked to your telephone number, your bank accounts are linked to your telephone numbers." See Port attack, SIM swap, SIM jacking.
-
Do your leaders have a port-out lock or a PIN on their carrier accounts?
- No, or we don't know
- Some of them
- Yes, all of them, and we've checked
"but we control the port out, which means that no one can make changes to the account unless they go through a process." See We control the port out.
-
If a leader's phone lost service right now, would anyone treat it as a possible incident?
- No, we'd assume a dead zone
- Someone might notice
- Yes, there's a playbook
"you can't tell the difference between I'm out of range versus my phone just lost its phone number." See I was here.
-
Are critical company accounts tied to one person's personal number, or to a family plan?
- Yes, often
- A few are
- No, they're on company-controlled numbers and keys
"because they were on a family plan or they were using a common plan." See From janitors to CEOs.
-
Could someone talk your help desk, or a vendor's, into resetting an account?
- Probably
- We verify some requests
- No, every reset is verified out of band
"They bribe people in the store or do social engineering, and they take care of their telephone number for half an hour, an hour." See Port attack, SIM swap, SIM jacking.
-
Do you keep leaders' phone numbers, locations and crypto holdings out of public bios and posts?
- No
- Some of us do
- Yes, by policy
"So, like, in our company, we make sure that no one knows our employee location." See We control the port out.
-
If an executive lost $100,000 to an account takeover, do you know whether insurance would pay?
- We don't know
- Partly
- Yes, we've read the policy
"In our case, you get money." See In our case, you get money.
-
If you hold crypto, is there a written checklist for keys, custody and who can move funds, checked by someone outside the team?
- No
- Written, not checked
- Yes, or we hold no crypto
"So I think there's a need for certification by an independent party on security of a company." See No framework for security in crypto.
A phone number still unlocks your most important accounts, and nobody would notice it moving. This week, put a port-out lock or PIN on every leader's line, and move email and the bank off text codes first.
Some accounts and some people are covered. Next, finish moving recovery to security keys or passkeys, take company accounts off personal numbers, and write down what to do when a leader's phone goes dark.
Your numbers are locked and your accounts don't trust them. Keep testing it: try a reset through your own help desk and your carrier, and check the insurance before you need it.
How many accounts would a SIM swap open?
Haseeb’s point was that the phone number sits under everything: email, bank accounts, social media. This calculator counts how many of your people’s accounts still open with a text message, and how many sit behind numbers with no lock. Every default is our example, not a benchmark.
Calculator
How many accounts would a SIM swap open?
Four numbers: the people whose phone number matters most, the accounts each of them can reset or sign in to with a text, the share of those you've moved to keys, passkeys or an app, and the share of those people with a port-out lock or carrier PIN.
With 10 people and 12 accounts each that accept a text, 9 per person still open with a text after you move 25% to keys, passkeys or an app, or 90 in all. For the 8 people without a port-out lock or carrier PIN, a SIM swap could open about 72 accounts.
The 10 people, 12 accounts, 25% and 20% are our examples, not benchmarks. Put in your own. For scale, Haseeb's figure on the tape is an 80% chance that an attempt succeeds, and the Princeton study got 39 of 50 test SIM swaps through.
From BitAccess to the SIM swap rules
Everything on this page sits on one timeline, from BitAccess’s founding in 2013 to Haseeb’s posts in 2026. Filter it by thread.
Timeline · 2013 to 2026
From BitAccess to the SIM swap rules
Filter by thread. Dates are from the public record except where marked as Haseeb's account or part of this show.
- Bitaccess is founded
Haseeb is a co-founder from September 2013 to November 2015 (Metro Atlanta CEO, LinkedIn, on this show).
- The first Bitaccess ATM
The company launches its first bitcoin ATM (Metro Atlanta CEO, on this show).
- The first SIM swap
Haseeb is SIM swapped for the first of four times (CoinDesk, via Yahoo Finance, on this show).
- 320 complaints
The FBI receives 320 SIM swapping complaints from January 2018 to December 2020, with adjusted losses of about $12 million (FBI IC3, on this show).
- Efani
Founded and bootstrapped. His LinkedIn dates it to September 2019 (Efani, LinkedIn, on this show).
- Ford v Ferrari
James Mangold's film, the one Haseeb names (Wikipedia, on this show).
- The Princeton study
39 of 50 test SIM swaps succeed at five prepaid carriers (Princeton, Engadget, on this show).
- The CoinDesk profile
Seven to 11 steps, a notarized letter and a seven-day cool-off to change a SIM (CoinDesk, via Yahoo Finance, on this show).
- 1,611 complaints
SIM swapping complaints to the FBI in one year, with adjusted losses of more than $68 million (FBI IC3, on this show).
- The FBI's warning
A public service announcement on SIM swapping, with advice for consumers and carriers (FBI IC3, on this show).
- $3.7 billion
Stolen in cryptocurrency hacks, by Chainalysis's count (SecurityWeek, on this show).
- Bitcoin Depot and Bitaccess
Bitcoin Depot announces it has acquired a majority of Bitaccess (Metro Atlanta CEO, on this show).
- $1.7 billion
Stolen in cryptocurrency hacks, by Chainalysis's count (SecurityWeek, on this show).
- The business combination closes
Bitcoin Depot and GSR II Meteora (Crowdfund Insider, on this show).
- BTM on Nasdaq
Bitcoin Depot is set to begin trading (Crowdfund Insider, on this show).
- The conversation
The tape fits this month: Haseeb mentions the listing and the Fourth of July (on this show).
- The FCC's rules
Adopted to protect consumers from SIM swap and port-out fraud (FCC, on this show).
- The Federal Register
Secure authentication, customer notice and a free account lock (Federal Register, on this show).
- The rules take effect
Except the information collections that needed review (Federal Register, on this show).
- The SEC's account on X
Taken over through its phone number in an apparent SIM swap (SEC, on this show).
- The compliance date is waived
Until the Office of Management and Budget finishes its review (TLP, on this show).
- Episode 55 airs
On Podbean, Apple Podcasts and Spotify (Podbean, on this show).
- Episode 57 airs
Vijay Balasubramaniyan of Pindrop on fraud and deepfakes on phone calls (episode 57).
- CISA's mobile guidance
For highly targeted individuals: no text messages as a second factor (CISA, on this show).
- InfraGard
Haseeb joins the InfraGard National Members Alliance (LinkedIn, on this show).
- The Apple account post
Account recovery as an attack path, and security keys for an Apple Account (LinkedIn, on this show).
What to do this week
Five things, in the order the episode suggests.
- Find out whether someone could take your number tonight. Take the scorecard with your leaders, admins and whoever can move money, one phone each.
- Lock the numbers. Ask each carrier for a port-out lock or an account PIN and turn on multi-factor authentication for the carrier account itself, as CISA’s guidance for highly targeted individuals recommends. Take company accounts off personal numbers and family plans.
- Take the phone number out of account recovery. Run the calculator with your real numbers and start with email, which resets everything else. Our post on device-bound credentials explains why security keys and passkeys hold up where text codes don’t, and Enabled Isn’t Enforced covers proving that nothing can still sign in without them.
- Treat a dead phone as a possible incident. Write down what happens when a leader’s phone loses service unexpectedly: call the carrier from another line, check for password reset emails, and freeze money movement until it’s explained. Our posts on proving identity instead of detecting fakes and on hiring as an attack surface cover the other places where someone talks their way in.
- Get help with the parts you can’t staff. Our Penetration Testing team can test what an attacker would try against your people and your accounts, our Counter Business Espionage & IP Protection team handles the social engineering and insider side, our SOC 2 Type 2 team builds the kind of audited controls Haseeb wishes crypto had, a vCISO can own the program, and you can book 15 minutes with us.