A former AT&T retail employee has been sentenced to 16 months in federal prison following his role in a sophisticated SIM-swapping conspiracy. The scheme, which exploited internal access to telecommunications systems, aimed to bypass banking security measures and facilitate fraudulent wire transfers from victims' accounts.
Kenneth Carter, 44, of Portland, Oregon, was sentenced after pleading guilty to conspiracy charges related to wire and
The Mechanics of the Insider Threat
The operation relied on a division of labor between external hackers and an internal asset. According to court documents, a co-conspirator would identify targets and gather sensitive personal information, including Social Security numbers and phone details. This data was then passed to Carter, who used his position at an AT&T retail store—held between May 2018 and November 2019—to perform unauthorized SIM swaps.
By transferring a victim’s mobile number to a device controlled by the criminal group, the conspirators were able to intercept two-factor authentication codes and password reset links sent by banks. This access allowed them to bypass security protocols and initiate unauthorized wire transfers. Prosecutors noted that Carter and his associates typically received between $1,000 and $2,000 for each successful swap. While some funds were successfully moved, including nearly $100,000 sent to a bank account in Portugal, fraud prevention systems at various financial institutions blocked several other attempted transactions.
Security Implications for Mobile Users
The case highlights the vulnerability of relying on text-based two-factor authentication, which assumes that the mobile phone number remains under the exclusive control of the account holder. When an insider facilitates a SIM swap, these security layers can be effectively neutralized. Law enforcement officials discovered evidence of the scheme during a search of Carter’s residence in November 2019, where they recovered personal identifying information belonging to multiple victims.
The investigation, which involved the FBI, the FDIC Office of Inspector General, and the IRS, underscores the growing intersection between telecommunications fraud and financial crime. Security experts suggest that while no system is entirely immune to insider threats, customers can mitigate risks by utilizing authentication apps or physical security keys rather than relying solely on SMS codes. Furthermore, implementing account PINs and requesting port-out protections from mobile carriers can provide additional layers of defense against unauthorized account modifications. The sentencing of Carter concludes a significant chapter in the case, though it serves as a reminder of the ongoing challenges telecommunications companies face in monitoring employee access and protecting customer data.
