When Identity Verification Fails: Lessons from a Real-World SIM Swap and Near Account Takeover