Have a look at this other story from last month, "On Phone Numbers and Identity":
- https://medium.com/the-coinbase-blog/on-phone-numbers-and-id...
- https://news.ycombinator.com/item?id=12597609
"It turns out the attacker was able to impersonate the employee on a call with Verizon"