I think I read of a similar incident on Ars Technica last year and then subsequent incidents where people confirmed they had suffered the same kind of theft. It is pretty scary that the mobile phone companies can be socially engineered so easily and that they they are still open to this. Obviously their procedures for confirming identity before reassigning devices/numbers are not stringent enough. They certainly should not allow it to happen without the passcode.