Former AT&T store employee sentenced to 16 months for insider role in SIM-swap bank fraud ring targeting $594K
Kenneth Carter, 44, of Portland, Oregon, a former AT&T retail store employee, was sentenced to 16 months in federal prison for acting as the inside man for a SIM-swap gang. According to his plea agreement, the scheme ran from May 2018 to November 2019 and involved at least three co-conspirators. Carter used privileged store access to move victims' numbers onto SIM cards controlled by himself or accomplices. This let the gang intercept two-factor codes and password-reset links for victims' online banking accounts. Prosecutors put the three victims' combined intended losses at US $593,963.77, though only one attempt succeeded, draining US $99,528.33.
Technical Details
- Carter swapped victims' numbers onto attacker-controlled SIMs, including an Alcatel handset in Portland and a swap at an AT&T store in Lancaster, California.
- Co-conspirators triggered password resets on the victims' banking accounts. SMS codes and reset links were forwarded to a gang member, who logged in and attempted wire transfers, usually to a bank account in Portugal.
- May 2018: an attempted wire of US $247,652.74 was blocked by the bank's fraud checks.
- November 2018: an attempted transfer of US $246,782.70 was also blocked.
- December 2018: a victim identified as "S.Q.T" in Portland was drained of US $99,528.33.
- Carter was paid roughly US $1,000 to $2,000 per swap. A search of his home in November 2019 found victims' sensitive personal data, including social security numbers. He was not indicted until 2023 and admitted to swapping other AT&T customers' numbers as well.
Remediation
- Replace SMS-based authentication with an authentication app or hardware security key.
- Ask the mobile carrier to require a PIN or passcode before any SIM change is processed.
- Carriers should tightly control and monitor privileged SIM-change access in retail stores to limit insider abuse.
Linha do tempo
-
Former AT&T store employee sentenced to 16 months for insider role in SIM-swap bank fraud ring targeting $594K
ler a análise desta fonte ocultar
Kenneth Carter, 44, of Portland, Oregon, a former AT&T retail store employee, was sentenced to 16 months in federal prison for acting as the inside man for a SIM-swap gang. According to his plea agreement, the scheme ran from May 2018 to November 2019 and involved at least three co-conspirators. Carter used privileged store access to move victims' numbers onto SIM cards controlled by himself or accomplices. This let the gang intercept two-factor codes and password-reset links for victims' online banking accounts. Prosecutors put the three victims' combined intended losses at US $593,963.77, though only one attempt succeeded, draining US $99,528.33.
Technical Details
- Carter swapped victims' numbers onto attacker-controlled SIMs, including an Alcatel handset in Portland and a swap at an AT&T store in Lancaster, California.
- Co-conspirators triggered password resets on the victims' banking accounts. SMS codes and reset links were forwarded to a gang member, who logged in and attempted wire transfers, usually to a bank account in Portugal.
- May 2018: an attempted wire of US $247,652.74 was blocked by the bank's fraud checks.
- November 2018: an attempted transfer of US $246,782.70 was also blocked.
- December 2018: a victim identified as "S.Q.T" in Portland was drained of US $99,528.33.
- Carter was paid roughly US $1,000 to $2,000 per swap. A search of his home in November 2019 found victims' sensitive personal data, including social security numbers. He was not indicted until 2023 and admitted to swapping other AT&T customers' numbers as well.
Remediation
- Replace SMS-based authentication with an authentication app or hardware security key.
- Ask the mobile carrier to require a PIN or passcode before any SIM change is processed.
- Carriers should tightly control and monitor privileged SIM-change access in retail stores to limit insider abuse.