AT&T’s defenses against SIM swap fraud were once again thrown into the spotlight after WWE wrestler A.J. Styles blamed the telco for inflammatory tweets published by his account on X, formerly known as Twitter. Speaking to his fans on Instagram, Styles named his telco before describing the hijacker of his X account as a ‘moron’.
My Twitter-slash-X, whatever you guys are calling it, has been hacked… they stole my SIM card, somehow that happened, somebody allowed that at AT&T, but I got another guy working on it. But anyhow, I just wanted to let you guys know: some idiot, some moron, stole my phone, or my SIM, whatever it is, and was able to hack Twitter for me…
Styles’ X account was used to post a series of repugnant racist and homophobic messages alongside obvious attempts to pump cryptocurrency. Look below for a couple of examples of tweets from the hackers that did not include bigoted language.
Using the hijacked social media accounts of celebrities to promote pump-and-dump cryptocurrency scams is a well-worn criminal technique. It was also the motivation for hackers who assumed control of X accounts belonging to Barack Obama, Bill Gates, Jeff Bezos and Kanye West, amongst others. The method typically involves seizing control of the celebrity’s phone service first. Perhaps the most famous hack of this type occurred in 2019 and featured the account of Jack Dorsey, the founder of Twitter who was also its CEO at the time. AT&T was also blamed for the SIM swap of Dorsey’s phone service.
American telcos should be conscious of the potential liabilities after it was recently revealed that T‑Mobile US had to pay USD33mn in damages to a cryptocurrency investor whose wallet was raided following a SIM swap. AT&T has no reason to be complacent, as that amount is dwarfed by the USD224mn sought from them by Michael Terpin, another victim of cryptocurrency theft enabled by a fraudulent SIM swap. Terpin’s lawsuit against AT&T began in 2018 but still rumbles on after Terpin won an appeal hearing last year.
Six or seven years of fighting customers over inadequate controls to prevent SIM swaps with potentially huge financial consequences should be enough time for a telco to learn from past mistakes. It is certainly enough time for a telco to recognize if it has a problem with its reputation. Telco execs prefer to be upbeat, and they typically prohibit staff from saying anything bad about their business, so it is telling that AT&T Vice President Lynette Aguilar recently admitted:
It’s no secret that the telecom space has, for a long time, been seen as an industry that does not put our customers first
Judging by the adverts produced by law firms, suing American telcos over SIM swaps is a lucrative business. Such lawsuits may soon be the only way to hold American telcos to account for their consumer protection failures. AT&T is in the vanguard of a comms industry movement that wants to gut the enforcement powers of its regulator. Nobody expects a WWE wrestler to explain the detail for how AT&T should protect customers from SIM swap fraud, but it beggars belief that celebrities have to keep turning to social media to inform millions of followers about the repeated failings of US telcos, or that celebrities may end up having more influence than the industry’s own regulator.
People keep telling me that I go too far in criticizing the US telecoms industry. They are wrong; my modest resources prevent me from going far enough. The same American professionals who spend years fighting their own customers in court and who hope to cripple their national regulator are simultaneously feeding foreigners a lot of guff about the USA being especially tough on fraudsters and successful at protecting consumers. Their measures of success are completely divorced from any objective scrutiny of how well the public is protected in actual practice. That makes them dangerous. Whilst I value the American readers of this website, my chief motivation is to counter the blizzard of disinformation about the US strategy for consumer protection because it also seeks to corrupt the consumer protection strategies of other countries too.
However, I do sense a shift in mood in some other countries. Perhaps some greater good is being served by all the lawsuits in US courts and by all the American celebrities who share news of being let down by their phone company. They may not be able to change the direction of travel within the USA, but they are sending a signal that other countries need to follow a different path. Given the high cost of US phone services, and the technology available to US telcos, the credibility of American strategies for fraud reduction has been torn to pieces by repeated failure. The only people who seem unaware of this are the people who are paid handsomely to represent the interests of US telcos. If any of them are reading, I implore them to consider the following.
When an irrational fear or hatred has taken hold of somebody, there is no amount of persuasion, and no number of worthy acts that will reverse that person’s opinion. Donald Trump is not all bad — I write that whilst acknowledging the vehement response it will provoke amongst some readers — but Trump is so loathed in some quarters that he has just had a profound influence on national elections in Canada and Australia. There are other aspects of America’s reputation that are also bad, such as foreign perceptions of American healthcare, gun crime and food hygiene. When American professionals tell inhabitants of other countries about how to protect consumers from phone scams, they need to be conscious of the way many factors, both rational and irrational, may influence the opinions formed by their audience. It is one thing for many people to agree that international cooperation is needed to reduce fraud; it is quite another to agree that the American approach needs to be emulated elsewhere.
If American customers of American phone companies feel they are treated badly then that makes it less likely that American companies will get what they want in foreign countries, irrespective of how much profit foreign companies might generate as a consequence. Some crimes do require international cooperation if they are to be tackled effectively, but SIM swap fraud is not one of those crimes. Each time an American telco fails to remedy the weaknesses that result in a SIM swap, or other frauds that a telco can tackle on its own, it gives everybody else another reason to question how much that telco can be trusted.
A.J. Styles’ Instagram video about the SIM swap account takeover can be replayed below.
