14 Charged in Bank Account Takeover Scheme That Used SIM Swaps and Corrupt Insiders

What the Indictment Says

A federal grand jury returned the 22-count indictment on August 26. It stayed sealed until November 3, after the arrest in Florida of co-defendant Terrence Dudley, whom prosecutors call a key co-conspirator.

Between July 2023 and November 2024, prosecutors say, the group:

• obtained victims’ personal identifying information and made and trafficked counterfeit ID documents;
• impersonated victims;
• manipulated victims’ phone lines by spoofing and SIM swapping, and intercepted the security codes sent to them;
• used “corrupt insiders within banks and telecommunications companies to bypass authentication measures.”

According to the release, the group accessed or withdrew money from accounts at Truist Bank, Bank of America, First Bank, Woodforest National Bank, JPMorgan Chase and Charles Schwab. One attempted wire, for $2 million, was headed to Emirates Islamic Bank.

The release doesn’t say at which banks or carriers the insiders worked, or how the group got the personal data in the first place.

The charges are conspiracy to commit wire fraud and bank fraud, bank fraud, wire fraud and aggravated identity theft. The bank fraud conspiracy carries up to 30 years in prison, and aggravated identity theft adds a mandatory two years. An indictment is an allegation; all defendants are presumed innocent until proven guilty.

An Arrest at the Gate

According to the government, Dieye’s family had moved out of their Dallas home and shipped most of their belongings to Kenya. He then traveled with them to New York to board a one-way flight to Malaysia and was arrested at the JFK gate after his boarding pass was scanned. Prosecutors say he resisted, tried to destroy a phone and had to be subdued by several agents.

A magistrate judge in the Eastern District of New York first ordered him released on bond. The government obtained an emergency stay, and Dieye was moved to Texas, where he and several co-defendants are held pending trial.

The investigation was led by the State Department’s Diplomatic Security Service, with help from the Secret Service, the FBI, Homeland Security Investigations, the Postal Inspection Service and others, among them the US Embassy in Dakar’s overseas criminal investigations office.

Why Security Codes Didn't Stop It

When a bank sends a one-time code by text message, it trusts that the phone number belongs to you. A SIM swap moves your number to a SIM card the attacker controls, so the code goes to them. Spoofing does a similar job for calls: the attacker’s call shows up with your number, or with the bank’s.

Carriers know this. In November 2023 the FCC adopted rules against SIM swap and port-out fraud that require carriers to use secure ways to authenticate customers, and the large US carriers now offer free locks on SIM changes and number transfers. All of these defences assume the employee doing the checking is honest. In this case, prosecutors say, some of them were not.

A text-message code proves that someone controls your phone number. With an insider at the carrier, that someone does not have to be you.

How to Protect Your Accounts

You can’t vet your bank’s staff. You can make your phone number matter less, and make a takeover easier to notice:

• Lock your number with your carrier. Verizon has Number Lock and SIM Protection in My Verizon (Verizon); T-Mobile has SIM Protection and Port Out Protection under My account > Profile > Privacy and Notification (T-Mobile); AT&T has Wireless Account Lock in the myAT&T app (MacRumors). These stop the common con, where someone talks a store or call-center agent into moving your number. Against a corrupt employee they may not be enough, so the next step matters more.
• Take your phone number out of your bank login where you can. If your bank offers an authenticator app, a passkey or a security key, use it instead of text-message codes.
• Turn on alerts for transfers, new payees and changes to your phone number, email or address, so you hear about a takeover while there is still time to call the bank.
• If your phone suddenly loses service where it normally works, call your carrier from another phone right away. It can be the first sign of a SIM swap.
• If “your bank” calls you, hang up and call the number on the back of your card. Caller ID can be faked.