Man sues AT&T after fraudulent SIM swap led to $1.8M cryptocurrency theft

Enlarge / An AT&T sign outside a company office in New York City. (credit: Getty Images | Roberto Machado Noa )

A lawsuit against AT&T alleges that the carrier's employees helped hackers perform SIM-swap attacks on a customer and rob him of $1.8 million worth of cryptocurrency.

Plaintiff Seth Shapiro of Torrance, California, says that AT&T is liable for the acts of its employees and failed to implement systems and procedures to prevent them from pulling off the scheme. The complaint, filed on October 17 in US District Court for the Central District of California, says:

On at least four occasions between May 16, 2018 and May 18, 2019, AT&T employees obtained unauthorized access to Mr. Shapiro's AT&T wireless account, viewed his confidential and proprietary personal information, and transferred control over Mr. Shapiro's AT&T wireless number from Mr. Shapiro's phone to a phone controlled by third-party hackers in exchange for money. The hackers then utilized their control over Mr. Shapiro's AT&T wireless number—including control secured through cooperation with AT&T employees—to access his personal and digital finance accounts and steal more than $1.8 million from Mr. Shapiro.

In a SIM-swap attack, "the SIM card associated with the victim's wireless account is switched from the victim's phone" to someone else's, which "effectively moves the victim's wireless phone—including any incoming data, texts, and phone calls associated with the victim's phone—from their phone to a phone controlled by the third party," the lawsuit notes.