Former AT&T store worker jailed after moonlighting as a SIM

Kenneth Carter, a 44-year-old from Portland, Oregon, was sentenced to 16 months in federal prison for his involvement in a SIM swap scheme. The criminal activity reportedly occurred between May 2018 and November 2019, involving at least three co-conspirators. The scheme involved using privileged store access to move victim phone numbers onto SIM cards under the control of himself or an accomplice. Subsequently, co-conspirators triggered password resets on victims' online banking accounts, redirecting two-factor codes and reset links to devices controlled by the criminals. These codes were then passed to another member of the group who could log in and attempt to wire funds, often to bank accounts in Portugal. Incidents included an attempted transfer of US $247,652.74 and another of US $246,782.70 that were blocked by bank fraud checks. In December 2018, Carter successfully hijacked the number of a victim known as "S.Q.T," resulting in a successful drain of US $99,528.33. Carter admitted to carrying out SIM swaps against other AT&T customers. Investigators searched Carter's home in November 2019 and found sensitive personal data, including social security numbers, belonging to victims. The intended losses for the three victims totaled US $593,963.77. Carter received a share of the spoils of approximately US $2,000.

The narrative of the SIM swap scheme reveals a failure in systemic defenses layered across multiple entities—retail staff, mobile carriers, and banking systems. The mechanism relies not on sophisticated hacking but on exploiting weak points in operational procedure and human trust, specifically leveraging insider access. The long delay between the criminal activity (ending in late 2019) and indictment (2023) highlights a critical systemic bottleneck: the time required for law enforcement to correlate disparate data trails across jurisdictions and entities before establishing sufficient evidence against an individual. This points to patterns where low-level operational exploits are often hidden from immediate scrutiny until a larger pattern emerges, suggesting that investigations frequently lag behind the actual digital lifespan of the crime. The reliance on basic social engineering skills for execution underscores a fundamental vulnerability: when security relies solely on simple procedural checks (like SMS authentication), the system is inherently fragile against coordinated exploitation. The shift suggested in the final section—from SMS-based security to app/hardware keys and mandatory PINs for SIM changes—is an attempt to reintroduce friction as a necessary layer of defense, recognizing that operational exposure, rather than purely technical failure, is the root vulnerability exploited by these schemes. The question becomes: how can procedural safeguards be universally enforced without relying solely on individual vigilance?