AT&T store worker gets 16 months inside for SIM-swap side hustle

A former AT&T retail worker who used his system access to hijack customers' phone numbers for cybercriminals has been sentenced to 16 months in federal prison.

Kenneth Carter, 44, carried out the SIM swaps at a store in Portland, Oregon, , allowing the criminals to intercept authentication codes and raid victims' bank accounts.

Court documents show that Carter worked with at least three other people in the scheme, which ran between May 2018 and November 2019, and caused nearly $600,000 in intended losses.

Co-conspirator One, described in court documents as the operation's main "hacker," identified victims with online bank accounts, gathered their personal data, and sent it to Carter, who could reassign their phone numbers.

Carter abused his access to AT&T's systems to transfer victims' phone numbers to devices controlled by the other criminals.

His role was described as "instrumental to the scheme." Co-conspirator Two and Co-conspirator Three would walk into the store and impersonate the victim whose number they planned to SIM-swap, and Carter would reassign the number to a phone they controlled – usually a "cheap flip phone." Once the swap was complete, the criminals could use the flip phone to intercept SMS-based 2FA codes and password reset messages, take over the victim's bank account, and steal funds.

The intercepted codes were relayed to Co-conspirator One, who used them to access the victims' bank accounts.

Court documents also refer to "an unnamed family member" who held a minor role in the scheme.

They were described as someone "who occasionally passed along the two-step authentication codes" to Co-conspirator One.

According to the Justice Department, three victims incurred combined intended losses of $593,963.77, and Carter admitted carrying out additional unauthorized SIM swaps.

Carter's plea agreement [PDF] included details of three SIM swap attacks he helped execute.

Only one victim suffered an actual loss: $99,528.33 transferred to a Portuguese bank account.

The conspirators attempted to transfer $247,652.74 and $246,782.70 from the other two victims, but the banks' fraud controls blocked both transactions.

Prosecutors said Carter was paid between $1,000 and $2,000 per swap, although he maintained that he earned less than $4,000 in total.