SIM Swapping – How a Bribe Bypassed AT&T’s Security

You are here: Home / Telecomms Hacking / SIM Swapping – How a Bribe Bypassed AT&T’s Security

SIM swapping is a fraud in which criminals take over someone’s phone number by moving it to a SIM card they control, without ever touching the phone itself.

SIM Swapping: How a bribe bypassed AT&T's security, beside tweezers lifting a SIM card out of a phone's tray.

This Stickler Files episode follows the case of cryptocurrency investor Michael Terpin, whose number was swapped in 2018 after, according to the Ninth Circuit’s account, a teenager bribed an employee at an AT&T authorised retailer.

Key highlights

The FBI received 1,611 SIM-swapping complaints in 2021, about five times the 320 it received in 2018, 2019 and 2020 combined.
The Justice Department said SIM hijacking was often facilitated by bribing a phone company employee, and at other times by calling customer service while posing as the victim.
Terpin alleged that after an earlier SIM swap in 2017, AT&T promised him “extra security”: a six-digit code instead of four digits.
In 2019 prosecutors in Detroit charged six members of a group called The Community, and three former phone-company employees accused of helping it for bribes.
In November 2023 the FCC adopted rules requiring carriers to authenticate customers securely before a SIM change or number port, and to notify them immediately.

Video: Stickler Files · SIM Swapping: How a Bribe Got Around AT&T's 'Extra Security' · 2026-10-25. More from Stickler Files.

Watch SIM Swapping: How a Bribe Got Around AT&T's 'Extra Security' on YouTube — Stickler Files · 2026-10-25

How SIM swapping works

The FCC pairs SIM swapping, which moves the number to a new SIM, with port-out fraud, which ports it to a new carrier. Either way, the phone stays in the victim’s pocket while the number answers somewhere else. Prosecutors said that once The Community controlled a victim’s number, it became a gateway into email, cloud storage and cryptocurrency exchange accounts. In Terpin’s case, the court said, the hackers received his password-reset messages and took $24 million of his cryptocurrency.

Questions answered

Did Michael Terpin win his case against AT&T?

Not on the record the episode covers. In September 2024, according to the Ninth Circuit’s published summary, his fraud claims failed, his negligence claims were barred and his contract limited the damages he could recover, but the court found a triable issue on one claim under Section 222 of the Communications Act. He separately won judgments of $22 million and $75 million against the two hackers.

Didn’t carriers have to protect customers before 2023?

They did. Carriers already had a statutory duty to protect the confidentiality of customers’ proprietary information, and the FCC’s 2023 order revised existing rules rather than creating that duty. The FCC said the problem was inconsistency in how carriers applied the protections they had, and a lack of uniformity across the industry, which left some customers vulnerable.

Archive and sources

For how account takeover became an industry, see our piece on credential stuffing. The primary sources here are the FCC’s 2023 order in the Federal Register, the Justice Department’s announcements in The Community case (2019 charges and 2021 sentencing), and the Ninth Circuit’s 2024 decision in Terpin’s case against AT&T.

Watch the full story on YouTube: SIM Swapping: How a Bribe Got Around AT&T's 'Extra Security'.