Feds crack phone clone scam that cost Sprint $15m
More than 10,000 accounts spoofed
Agentless Backup is Not a Myth
Federal prosecutors have uncovered a scam that used tens of thousands of cloned cellphones to defraud Sprint out of $15m in lost long distance revenue.
The operation dates back to at least the latter half of 2009, when cellular customers began complaining that they were billed for international calls they didn't make, according to court documents made public on Wednesday. When Sprint employees looked into the matter, they discovered that many of the calls were made from hundreds of miles away from where the customers lived and within minutes of other calls made from the customers' homes.
Eventually, the Sprint investigators discovered that electronic credentials belonging to “tens of thousands of its customers” were used to make international calls that would have cost $15m had they been billed at the going rate. What's more, many of the defrauded customers' online accounts were breached so that changes could be made to passwords, international calling features and other settings.
The fraud came to light in a criminal complaint that accused nine Sprint employees of illegally accessing customer accounts more than 16,000 times between January and June of this year. Among the information they took were the MSID, or mobile station ID, and the ESN, or electronic serial number, that are used to uniquely identify each handset on the Sprint network. By plugging the credentials into new cellphones, people were able to make phone calls that were charged to the accounts of the defrauded customers.
The complaint didn't identify the cellular carrier, but Sprint officials confirmed the fraud after its name came up during court hearings on Wednesday.
“Sprint regularly monitors and works aggressively to identify and respond to fraudulent activity,” Sprint said in a statement. “The company has been assisting authorities in this case. Should a Sprint customer notice this sort of suspicious activity on their account, we would encourage them to contact our Care representatives for assistance.”
Sprint has credited the defrauded customers for the value of the calls, a press release from the US Attorney in the Bronx, New York, said.
Based on the allegations, the employees charged appear to be low-level operatives who used their access to Sprint's customer database to supply the credentials to people higher up in the scam.
One defendant, Tampa, Florida-based Princetta Dorisma, said a co-worker approached her and offered $1,000 in return for information associated with a range of phone numbers, according to the complaint, which was filed in US District Court for the Southern District of New York. Dorisma received two payments of $500 in exchange for sending the customers' names, cell phone numbers and ESNs associated with each number to an email address specified by the co-worker.
The other defendants named in the complaint are Pedro Rodriguez and Johnny Santana, who worked at Sprint stores in located in the Bronx; Luis Abad, Mathews Angel, Francis Lopez, and Luis Orriols, who worked at a store in North Bergen, New Jersey; and Lesly Esquea and Jacklin Volny, who also worked at a store in Tampa.
They are each charged with one count each of conspiracy to commit wire fraud, access device fraud and aggravated identity theft. If convicted on all counts, they face a maximum of 32 years in prison, in addition to fines. ®
COMMENTS
they should be routinely checking for this anyway
I worked for UK network about 15 years ago and they used to run reports looking for impossible events that meant there was fraud/cloning going on. More fool Sprint for not doing this, its not hard, and now they have lost $15M
Its easy
I filled my car up on the M4 in Reading and paid by credit card. I then drove to White Waltham in Maidenhead and flew a private plane to Northern France. When I tried to pay for lunch on the same credit card I was told it was refused.
Later in the day I got a call from the credit card company to say somebody had tried to use my card in Northern France after use in Reading. I said yes it was me. I was told it was impossible for me to have been in Reading at 8:00am and Northern France by 1:00pm so I explained.
I was not unhappy that they refused my card, just used another one, but was very impressed with the fact that they noticed that a transaction was suspect.
So if credit card companies can do it why not Cell phone Networks.
Sprint is vigilent against fraud? Horse-hockey.
> “Sprint regularly monitors and works aggressively to identify and respond to fraudulent activity,”
I call shenanigans on this one. I obtained evidence of account breaches of myself and almost a dozen other Sprint customers a couple of years back. I made a detailed map of the corporate phone tree while trying to make contact with anyone within Sprint who had even the slightest clue as to what I was presenting to them. I finally managed to get hold of one guy who understood exactly what I had, and he was supposed to have a manager call me the next business day. Never heard from them.
Sprint's fraud group told me that account breaches are outside of their scope of action until the information is used to make fraudulent purchases or calls. In other words, they did not care that the personal information of at least a dozen customers was somehow in the possession of someone without authorization to have that information. They only cared if the information was used within the confines of Sprint itself. Which, I suppose, constitutes the "fraudulent activity."
Lies and damned lies. I submitted my stack of evidence to the White Collar Crime Center and let them have a go. Who knows where it wound up.
Paris, it wasn't mine, I swear.
IT infrastructure monitoring strategies
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
Data control in the cloud
Cloud based data management
Agentless Backup is Not a Myth
