AT&T Faces Court Showdown Over $224m SIM Swap Case

AT&T will be forced to defend itself in court after a judge refused to throw out a $224m lawsuit alleging the firm is liable for handing over the defendant’s SIM card to hackers.

The telco giant is in the dock after entrepreneur Michael Terpin was hit by a classic SIM swap attack, in which hackers persuaded an AT&T agent in a Connecticut store to transfer his mobile phone number to a new SIM.

They were then able to intercept one-time passcodes sent via text to unlock Terpin’s cryptocurrency accounts and drain it of funds worth an estimated $24m.

In August last year, Terpin’s lawyers filed 16 counts of fraud, including gross negligence, invasion of privacy, unauthorized disclosure of confidential customer records, violation of a consent decree, and failure to supervise its employees and investigate their criminal background.

More broadly, Terpin is arguing that AT&Ts contract is too one-sided.

“Mr Terpin’s claim seeks to declare AT&T’s wireless customer agreement as unconscionable, void against public policy, and unenforceable in its entirety,” presiding judge Otis Wright said. “Specifically, he objects to the exculpatory provision that exempts AT&T from liability from its own negligence, acts or omissions of a third party, or damages or injury caused by the use of the device.”

Wright ruled that Terpin’s lawyers had “sufficiently alleged” that AT&T may have violated the Federal Communications Act by allowing unauthorized access to their client’s accounts – meaning the $224m lawsuit will proceed.