Man Sentenced to 12 Years in Prison for Defrauding AT&T by Unlocking Phones

• A Pakistani who was unlocking AT&T devices that were still locked in contract received an imprisonment sentence.
• The man caused AT&T a total estimated loss of over $200 million, which he's now called to pay back in full.
• The fraud lasted for over five years and involved multiple AT&T employees who were bribed to participate.

Muhammad Fahd, 35, a citizen of Pakistan and Grenada, was sentenced to 12 years in prison for leading a seven-years-long operation that resulted in the unlocking of 1,900,033 phones of AT&T, causing the company financial damages that are estimated to surpass $200 million. The sentenced individual will not just serve a lengthy prison sentence but was also ordered to compensate the telecommunications provider an equal amount.

When you buy a phone from a company like Verizon or AT&T, the device is locked to use the firm’s telecommunication services for a specific period of time (typically two years). This is done because the device is offered at a special bundle price, paid in installments or even for free in the context of a subscription contract. However, unlocking the phone is a freeing event for the consumer, as they can use it with any company’s network. Unlocking the device is actually legal in the U.S., but only if the contract restrictions no longer apply.

What Fahd did, though, was outright illegal, bribing AT&T employees at a call center in Washington to unlock a large number of cellular phones that were otherwise still locked in contracts. The employees dropped a special kind of malware into the devices that gave Fahd the capability to unlock the phones remotely from Pakistan. Fahd used the alias “Frank Zhang” to approach AT&T employees through Facebook and recruit them by promising significant payments.

This started in June 2012, and when AT&T implemented a more secure IMEI locking system in the spring of 2013, Fahd hired a software developer to build a malware that would bypass the new authorization steps that had been introduced. The man gave the developer sensitive technical details and network access credentials shared by bribed AT&T employees, so the fraud continued to work until 2018, when he was arrested in Hong Kong. After his extradition to the U.S., he pleaded guilty to conspiracy to commit wire fraud in September 2020, and today, the final sentence was announced.

AT&T has definitely had an “insider threat” problem in recent years, as SIM swappers have also engaged in recruiting telco employees to port other people’s numbers to new SIM cards. In practice, it is very hard to control this phenomenon since the hackers offer employees large sums of money to convince them to help in the scheme.