The AT&T unlocking scheme: bribed call center staff and 1.9 million phones

For about 7 years, a man in Pakistan paid AT&T's own call center workers to unlock phones, and prosecutors say it cost the carrier more than $200 million across 1.9 million devices.^[1] This case file covers how bribes turned into malware inside a customer service floor, how the scheme was finally shut down, and the one control that would have exposed it years sooner.

What happened

How it worked

The whole scheme rested on insiders with legitimate access. Call center staff had the power to approve unlocks as part of their job, so their requests looked like ordinary work.^[1]

When AT&T tightened the process, the insiders did what outsiders could not. They passed along confidential details about AT&T's systems and installed the malicious software on work computers.^[2] According to reporting on the case, the first version recorded what was typed, collecting credentials and network information, and a later version gave the operators remote control. The software then sent unlock requests using real employee credentials, so each one appeared to come from a trusted worker.^[3][4] Unlocking was sold as a service to customers who wanted out of their payment plans.^[2][3]

How it was caught

AT&T's own investigators eventually noticed. When the company confronted several employees around 2014, they left, and the scheme recruited new ones to keep going.^[4] Charges followed in 2017.^[1]

Fahd was arrested in Hong Kong in 2018 and extradited to the US in August 2019. He pleaded guilty to conspiracy to commit wire fraud in September 2020.^[1] A co-conspirator in Pakistan died before he could be brought to court.^[3] Bribed AT&T employees were prosecuted separately.^[1] The acting US Attorney described Fahd as a modern cybercriminal who paired technical skill with old-school bribery and intimidation.^[2]

What it cost

Forensic analysis found that 1,900,033 phones were unlocked fraudulently, and AT&T's losses came to about $201.5 million.^[1] On September 16, 2021, a federal judge in Seattle sentenced Fahd to 12 years in prison and ordered about $200.6 million in restitution.^[1][2]

The missing control

The missing control: monitoring what privileged support staff actually do. That means reviewing the actions taken with employee access, such as how many unlocks each person approves, for whom and when, rather than assuming a valid login means valid work.

A handful of workers pushing through large numbers of unlocks for customers who did not qualify is a pattern that stands out in plain numbers. Regular per-employee reports, alerts for unusual volume, and spot checks of approvals against eligibility rules would have flagged the first recruits early. Watching for new software on call center machines, and for requests arriving from outside the building, would have caught the second phase.

What to do in your business

• Know which staff actions cost you money. Refunds, credits, discounts, account unlocks and write-offs are the ones to watch. List who can do each.
• Run a monthly per-person report. Count those actions by employee. Anyone far above their peers gets a friendly question and a closer look.
• Spot-check approvals. Each month, pull 10 random approvals and confirm the customer really qualified.
• Lock down work computers. Stop staff from installing software on customer service machines, and have your IT provider alert you when new programs appear.
• Give people a safe way to report offers. Tell staff plainly that approaches offering money for access happen, and that reporting one is rewarded, not punished.

Facts are drawn from court records, government reports, company statements and reputable reporting, listed below. People are named only where they were convicted, pleaded guilty or spoke publicly in an official role.