Enos, an IT director for a large company and resident of Bedford, fought the scammers online and was eventually able to recover most of her sister’s assets, including hundreds of thousands of dollars in retirement and savings accounts that the scammers were stealing.

Enos eventually concluded that the scammers were able to break into many of her sister’s apps and online accounts by taking over her cellphone number – not her physical phone number, but her “line.” And to accomplish that, the scammers posed as family members to deceive T-Mobile, her sister’s wireless carrier, Enos now believes.

By controlling Egan’s cellphone number, the scammers were able to obtain the authentication codes they needed to use the “I forgot my password” feature in Egan’s apps and online accounts, Enos said. And by changing the passwords, they gained access to those apps and online accounts.

Enos believes the scammers posed as family members when they contacted T-Mobile to report her sister’s death and arrange for her phone number to be transferred to a physical phone controlled by the scammers, she said.

What exactly happened is not clear to Enos or me. T-Mobile was extremely coy about the information it gave Enos because, they say, she was not the account holder. For months, T-Mobile repeatedly told her only that it had acted in accordance with company policy.

T-Mobile refused to even admit to fraud to Enos, but after I reached out, the company acknowledged that a “thief” had engaged in “fraudulent activity” on Egan’s account and promised to review its policies “in the ongoing fight against fraud and bad actors.”

I pointed out that, contrary to what it claimed to Enos, T-Mobile appeared to have violated its own policies. T-Mobile’s written policies allow family members with proper documentation to either close a deceased family member’s account or keep it running on the same phone. But Egan’s number was transferred to another phone. I asked T-Mobile several times how this could have happened.

“We will not disclose exactly what the scammer did,” T-Mobile responded, to avoid helping “other bad actors” who may want to attempt the same scam.

What may have helped the scammers in their multi-step plan was the fact that death certificates in Massachusetts are public documents and contain a deceased person’s Social Security number and birth date. T-Mobile requires this information before making any changes to a deceased person’s account, and Enos believes the scammers obtained this information from Egan’s death certificate. Many states redact Social Security numbers and restrict the release of death certificates to people who are related to the deceased.

Enos said she contacted me because she wanted to spare other grieving families what she had to go through and to urge T-Mobile to take steps to better deter scammers.

“Contact your family member’s cell phone provider and close the account before the scammers get there,” she said. “I’ve learned some really hard lessons.”

This is what happened:

Enos found her 60-year-old sister dead and alone in their South End apartment after a brief illness. She retrieved her sister’s phone but paid little attention to it as she grieved, organized the memorial service and wrote an obituary that was published on Legacy.com.

In hindsight, Enos is now convinced that the scammers learned of Egan’s death through this obituary and thought she would be a good target for their scam, as long as they could get her cell phone provider to transfer her phone number to her phone.

Enos believes that when the scammers learned of Egan’s death, they focused on obtaining Egan’s death certificate as soon as it became available at Boston City Hall, likely by searching for it online daily. For the scammers to successfully impersonate a family member, they had to reach Egan’s cell phone provider before her family did, Enos said.

Egan’s death certificate became publicly available on Feb. 7, and one of the scammers probably picked it up in person at City Hall that same day or shortly thereafter without being asked what he wanted it for or what his relationship was to the deceased – in accordance with state law, Enos said.

A few days later, Enos made the alarming discovery on her Greenfield bank account. By that time, she had already noticed that her sister’s phone had no reception. She was her sister’s only immediate relative, so who had authorized T-Mobile to cut off her phone service? She wondered if the unexplained lack of reception and the strange charges on their joint bank account could be related.

Enos immediately called Greenfield Bank to close the account. A few hours later, a bank representative called her back and said someone claiming to be Egan – dead for two weeks – had just called Egan’s phone number and asked for the account to be reopened. The bank refused.

Enos now knew for sure that she was dealing with scammers and that the scammers had her sister’s phone number. Enos knew that many apps and online accounts use an email address as a login and that the scammers probably wouldn’t have had much trouble finding her sister’s email address online. Egan used an MIT email address and is listed on LinkedIn as a graduate of MIT’s Sloan School of Management.

Enos said she had little doubt that the scammers did their own detective work online to obtain more information that they used in their scam. She pointed out that commercial companies provide a lot of personal information for a fee, including names, ages, phone numbers, and email and mailing addresses. When she gained control of her sister’s email account a few days later, Enos found emails that suggested the scammers used such a company.

After learning from Greenfield Bank that scammers were using her sister’s phone number, Enos called T-Mobile and asked them to close her sister’s account. She said scammers were using it to break into Egan’s apps and online accounts. However, T-Mobile said it could not release any information due to privacy concerns.

Enos later gave T-Mobile the identity theft report she had filed with Boston police, but that didn’t help either. (She also filed reports with the FBI and the state Attorney General’s Office.)

“I couldn’t understand why T-Mobile didn’t act,” Enos told me.

Enos soon called a high-ranking friend at MIT, who, following protocol, expedited Enos’ request to forward her sister’s MIT email account to a new account set up by Enos. This cut the scammers off from Egan’s email addresses while allowing Enos to view various emails that gave her clues about which apps and accounts the scammers had used, such as the email from Airbnb confirming a rental in California.

Enos then opened her sister’s apps and online accounts to change the passwords and have future authentication codes sent to her sister’s email address (which Enos controlled) rather than Egan’s phone number (which the scammers still controlled). She also removed her sister’s phone number from her sister’s apps and online accounts.

Enos said this prevented further fraudulent activity on her sister’s account. She said the scammers got away with a few thousand dollars in total in UberEATS and Airbnb fees, but nothing from her sister’s retirement and savings accounts.

Enos said people should think about what happens to their phone number when they die. For example, if you have an iPhone, Apple lets you set up a “legacy contact,” a trusted person who can access your phone after you die with a preset passcode and death certificate.

She also said you should give a trusted person an inventory of your apps and online accounts with instructions on how to access them after you die.

“Death is difficult for many people to talk about, but it is the last gift you can give your loved ones,” she said.

Have a problem? Send your consumer issue to [email protected]. Follow him @spmurphyboston.