Former AT&T store worker jailed after moonlighting as a SIM-swap gang’s inside man

44-year-old Kenneth Carter from Portland, Oregon, used to work in an AT&T retail store. But now he has been sentenced to 16 months in a federal prison.

That should be plenty of time for him to rue the day he agreed to increase his monthly income by helping a SIM swap gang in their attempt to steal over half a million dollars.

According to Carter's own plea agreement, the scam ran from May 2018 to November 2019 and involved at least three co-conspirators alongside Carter.

Carter would use his privileged store access to move a victim's number onto a SIM card under the control of himself or an accomplice.

Once the number was hijacked, one of his co-conspirators would trigger password resets on their victim's online banking accounts, with the two-factor codes and reset links now sent to a phone under the criminals' control rather than that of the victim.

Carter and the others would forward the codes on to a fellow member of the gang who would log into accounts and attempt to wire the money out - usually to a bank account based in Portugal.

In one incident in May 2018, described in Carter's plea agreement, the store employee swapped a victim's number onto an Alcatel handset while working his shift in Portland. A co-conspirator then attempted to wire US $247,652.74 out of the victim's account, only to be foiled by the bank's fraud checks.

On a different occasion in November 2018, after a SIM swap at an AT&T store in Lancaster, California, an attempted transfer was made of US $246,782.70 - which again was foiled.

But not every attempt by the gang to steal from mobile phone users was blocked. In December 2018, Carter successfully hijacked the number of a victim known as "S.Q.T" in Portland, and this time their account was successfully drained of US $99,528.33.

Carter's share of the criminal spoils? A comparatively paltry US $2,000 (he was typically paid between US $1,000 and $2,000 per SIM swap.)

Investigators finally searched Carter's home in November 2019, and found a wealth of sensitive personal data belonging to victims still in his possession, including social security numbers.

Prosecutors told the court that the three victims totalled intended losses of US $593,963.77 - and Carter himself admitted that he had carried out SIM swaps against other AT&T customers too.

If you're wondering why a scheme that ended in 2019 has only just resulted in a prison sentence: Carter wasn't indicted until 2023, four years after his home was searched by the authorities. Cases like this can take time for the authorities to investigate and assemble all the evidence, especially when some members of the conspiracy may still be at large, or may be being separately pursued.

SIM swapping is popular with fraudsters for a very simple reason - it doesn't demand technical prowess. It just needs someone with some social engineering skill to dupe a member of staff (perhaps in a call centre) into helping. Or, in this case, the assistance of an insider from the beginning who isn't afraid to put his retail job and personal liberty at risk for a backhander from a group of criminals.

If your online accounts are still defended by the paper-thin protection of an SMS authentication code, now would be a great time to switch over to using an authentication app or hardware key as an additional layer of defence, and to ask your mobile phone carrier to add a PIN or passcode that must be provided before any SIM change can ever go through.