T-Mobile, Verizon Employees Targeted in SIM Swap Scheme

American mobile service providers T-Mobile and Verizon have been besieged by a wave of cybercriminal attacks, wherein employees are bombarded with messages on both personal and work phones offering financial incentives for engaging in illegal SIM card manipulations, including the well-documented cybersecurity threat of SIM Swapping.

According to the circulated messages, criminals offer $300 for each successful swapping operation. The targets include both current and former employees of the aforementioned companies. These messages are sent en masse, each slightly varied in wording to evade anti-spam systems.

The hackers claim in their messages that the contact information for the employees they are targeting was obtained from T-Mobile’s internal directory. Initially, this seemed plausible as the messages were initially only received by T-Mobile employees; however, it later emerged that Verizon employees were also receiving these texts en masse, suggesting a possible significant data breach.

Representatives from T-Mobile have noted that the company has initiated an investigation, but there is currently no reason to believe that their systems have been compromised. Meanwhile, Verizon representatives have not yet commented on the situation nor have they communicated with the press.

SIM Swapping attacks, in which criminals gain control over a victim’s phone number, can lead to unauthorized access to personal and financial data, identity theft, and significant emotional distress for the victim.

In February 2022, the FBI warned of an increase in the number of attacks aimed at stealing millions of dollars through “hijacking” phone numbers. Last year, over 2000 complaints about such attacks were registered, with total losses amounting to $72.6 million.

In November of the previous year, the U.S. Federal Communications Commission introduced new rules to protect against such attacks, requiring carriers to tighten authentication procedures before transferring numbers to other devices or networks and to notify customers of any requests to change SIM cards or transfer numbers.