at&t wireless account fraud battle€¦ · at&t intellectual property and/or at&t...

© 2019 AT&T Intellectual Property. AT&T, Globe logo, and DIRECTV are registered trademarks and service marks of AT&T Intellectual Property and/or AT&T affiliated companies. All other marks are the property of their respective owners.

AT&T WIRELESS ACCOUNT

FRAUD BATTLEAugust 2, 2019

© 2019 AT&T Intellectual Property. AT&T, Globe logo, and DIRECTV are registered trademarks and service marks of AT&T Intellectual Property and/or AT&T affiliated companies. All other marks are the property of their respective owners.

WIRELESS ACCOUNT FRAUD & IDENTITY THEFT

POLICE RESPONSE & INVESTIGATION

INTERNATIONAL TRAFFICKING OF WIRELESS DEVICES

2 AT&T Wireless Account Fraud Battle / August 2, 2019 / © 2019 AT&T Intellectual Property

AT&T Company Owned Retail (2259 Stores)

3 AT&T Account Fraud Battle / August 2, 2019 / © 2019 AT&T Intellectual Property

AT&T Authorized Retailer (Agent store)


AT&T cricket


Authorized Retailers continued

NATIONAL ACCOUNTS

• Apple stores

• Best Buy

• Target

• Walmart


Add-on Fraud occurs when someone steals a cell phone customer’s personal information, uses it to impersonate the cell phone customer, adds a new phone number subscription to an existing account. The fraudster has the charges for the new service and/or equipment applied to the victim customer account.

Handset Upgrade Fraud occurs when someone steals a cell phone customer’s personal information, used it to impersonate the victim cell phone customer, buys a new cell phone handset, and has charges for the new handset applied to the victim customer account. This can be done in three ways:

1. By adding an authorized user name to an existing cell phone account. Someone then presents photo ID in the name of the authorized user at a cell phone store.

2. By using counterfeit ID in the name of the victim cell phone customer.

3. By ordering phones online.


Common Mobility Wireless Account Fraud

Common Mobility Wireless Account Fraud

• Subscription Fraud: Fraudster, using the identity of a customer, signs up for service with the intent to steal service, equipment or content.

• Upgrade Fraud: Fraudster obtains iPhone for $0 down payment on an active customer account who is eligible for a device upgrade. Fraudster only pays taxes for the device.

• Consumer add-on Fraud: Fraudster adds additional lines of service to existing customer account(s) to obtain iPhones, tablets and other accessories.

• Hi-jacking Fraud: Fraudster obtains a new SIM card to activate mobile device on existing phone line on an active account. (International calling)

• Small Business Fraud: Fraudster acquires and presents information of a or creates a fictious business with fraudulent/forged incorporation/tax ID documents.


Fraud in the Retail Store(what did we know and when did we know it)

• In July 2015 Kansas City’s Asset Protection investigators learned from corporate store managers that they suspected they were selling iPhones to “customers” who were probably fraudsters using the identities of customers.

• These fraudsters were presenting driver’s licenses from states located near the eastern seaboard as proof of identification.

• Management’s suspicions were reinforced by the number of chargebacks their stores were incurring due to fraud.


Asset Protection’s Response

• Kansas City AP investigators (API) directed store managers to call the API when a customer presented an out-of-state driver’s license, ID card or passport card as identification in an attempt to obtain iPhones.

• API researched account names in an effort to obtain current and historic customer information and identifiers.

• API would contact the named person to confirm they were not in the store.

• API would then direct store management to call 911 to report an identity theft in progress, which resulted in a number of arrests.


Possible Fraud Indicators


Arrests at the Point of Sale

Since August 2015, Kansas City Asset Protection Investigations have resulted in the arrest of over 250 fraudsters attempting to obtain iPhones in AT&T retail stores.

Approximately 90% of those arrested were of Dominican origin residing in the Bronx borough of New York City and Texas.

Approximately 15 fraudsters have been charged in U.S. District Court with wire fraud and aggravated identity theft.

Fraudsters almost always are found in possession of multiple IDs upon arrest.

There are usually two or more fraudsters traveling in the same vehicle.


What We’ve Learned About Organized Crime Rings


What We’ve Learned About Identity Theft Methods

These Dominican based fraud networks obtain cell phone customer information needed to commit identity theft in three main ways:

1. By email and text phishing messages that direct victims to false phone company websites.

2. By calling wireless customers, impersonating company employees, and social engineering account information. Social engineering calls are typically facilitated by spoofing the caller ID numbers of company customer service departments.

3. Through Russian malware distributors.


Overview: Dominican Republic and Fraud Targeting Telecom

• Since at least 2011, every major North American wireless telecommunications carrier has suffered from persistent organized fraud originating in the Dominican Republic.

• Dominican Republic based criminal networks specialize in telecommunications fraud and target North American phone companies.

• These persistent threats are responsible for hundreds of millions of dollars in financial loss impacting North American phone companies and hundreds of thousands of their customers.

• These criminal activities also impact critical infrastructure as fraud victims typically lose phone services for a short period of time.


Training – Store Managers & RSCs

• Store management and retail sales consultants (RSCs) are trained by Asset Protection to look for out-of-state DLs/IDs, not from a contiguous state.

• Management and RSCs scrutinize account by looking deeper into account notes for recent suspicious activity such as recent click2store, same day or previous sales in nearby cities and states.


API Proactive Actions & Tools

• Training in-store personnel on current fraud trends/activities

• In-store CCTV video surveillance

• BOLOS/3VR CrimeDex / MORCA (MO Organized Retail Crime Assoc.)

• IMEI Tracking database

• Partnering with other wireless carrier investigators (C2C info sharing)

• Partnering with law enforcement (BOLO info sharing)

• Real-time responders to fraud in progress calls.


Example of Forged Electronic Signature


Questions


AT&T Asset Protection General Number: 800-807-4205

Bill Carroll, Senior Investigator

AT&T Asset Protection

5400 Foxridge Drive, Suite 216

Mission, Kansas 66202

Office: 913-676-3588

Mobile: 615-513-9993

email: [email protected]


at&t wireless account fraud battle€¦ · at&t intellectual property and/or at&t...

Documents