AT&T Contractors and a Verizon Employee Charged With Helping SIM Swapping Criminal Ring

Last week, the Department of Justice accused nine people of allegedly being part of a crime gang known as “The Community” that hijacked mobile phone numbers to then steal money and cryptocurrency. This is yet another criminal case brought forward against hackers who use a technique called SIM swapping to target bank accounts and, primarily, online cryptocurrency wallets.

Among the alleged criminals were also two former AT&T contract employees and one former Verizon employee, who helped the alleged criminals by providing private customer information in exchange for bribes, according to court documents.

SIM swapping, sometimes referred to as SIM hijacking or port out scam, if a type of fraud where criminals take over victim’s phone numbers and then use them to steal money. SIM swapping is a popular technique among criminals because it can bypass traditional security mechanisms such as two-factor authentication. Criminals either trick telecom employees into giving them control of the victim’s phone numbers, or bribe them in exchange for their help. Telecom employees can perform SIM swaps as part of their jobs (say, if the customer has lost their phone) or can provide personal information that helps the criminals impersonate the victim.

The two former AT&T contractors in Tucson, Arizona were Robert Jack and Jarratt White.

White allegedly received bribes from one of the criminals who was part of “The Community,” according to a criminal complaint. White, according to the feds, helped the criminals steal more than $2 million from several victims by performing 29 fraudulent SIM swaps. White communicated with the criminals via Telegram, according to the document.

Jack, who was an associate of White, allegedly performed twelve fraudulent SIM swaps in May of 2018. White allegedly paid Jack $585.25 for his help in the SIM swapping conspiracy, according to the complaint.

An AT&T spokesperson said in an email that this case ”involves two former vendor employees that we reported to law enforcement.”

Fendley Joseph used to work for Verizon in Murrieta, California, according to the criminal complaint and his LinkedIn profile.

He is also accused of accepting bribes in exchange for helping The Community’s criminal SIM swapping activities. With Joseph’s help, the criminals allegedly stole $100,000, according to the complaint.

Joseph did not perform SIM swaps himself. Instead, he would give the criminals private information about the targets, which would help them impersonate the victim and take over their phone number. Joseph allegedly earned $3,500 from one of the criminals, according to the court document.

A Verizon spokesperson confirmed that Joseph was once an employee, but declined to comment any further.

White, Jack, and Joseph are the first telecom employees to be indicted in a SIM swapping case. But they may not be the last ones. As Motherboard reported last year, criminals involved in SIM swap fraud often recruited employees who work at cellphone carriers.

“Everyone uses them,” someone who claimed to be a SIM hijacker told Motherboard last year. “When you tell someone they can make money, they do it.”

One T-Mobile employee who spoke to Motherboard at the time said the criminals found him via Instagram, and then offered him $100 per target.

Robert Ross, a tech entrepreneur who launched a website to support victims of SIM swapping and pressure telcos to protect their customers, said these indictments prove the companies could have done better.

“This isn’t social engineering anymore,” Ross, who was SIM swapped last year, said in an online chat. “The story needs to move from ‘the carriers aren’t doing enough to fix the problem’ to ‘the carriers have no control over their tens of thousands of customer service reps and knowingly allowed them to be bribed.”

Listen to CYBER, Motherboard’s new weekly podcast about hacking and cybersecurity.

Correction: The original headline for this story was "AT&T and Verizon Employees Charged With Helping SIM Swapping Criminal Ring." We have updated the headline to clarify that Robert Jack and Jarratt White weren't employed by AT&T directly, but by another company that was contracted by AT&T.

This story has been updated to include comments from AT&T and Verizon spokespeople.