SIM swapping, SMS OTP interception, voicemail hacking, Wangiri callback fraud, IRSF and toll fraud.
After TFreak (Dan Moschuk) released smurf.c in October 1997, attackers spoofed ICMP Echo Requests to the directed-broadcast addresses of misconfigured networks, turning every responding host into an amplifier and flooding victims' uplinks — prompting CERT/CC Advisory CA-1998-01 in January 1998.
In February 2005, Paris Hilton's Sidekick address book, notes and photos — synchronized to Danger's servers and reachable through T-Mobile's customer website — were posted online after attackers took over her account. A Massachusetts teenager, later identified as Cameron LaCroix, pleaded guilty in September 2005.
On 4 July 2011 the Guardian reported that a private investigator working for the News of the World had accessed the voicemail of murdered schoolgirl Milly Dowler; the paper closed on 10 July and the government set up the Leveson Inquiry, which reported in November 2012.
Cybercriminals abused SS7 roaming interfaces to intercept bank-issued SMS one-time passcodes (OTPs), draining accounts of customers at O2 Germany and Metro Bank UK.
In May 2019 U.S. prosecutors in Michigan charged six members of the hacking group "The Community" and three former mobile-carrier employees (two at AT&T stores, one at Verizon) over SIM swaps used to steal more than $2.4 million in cryptocurrency, documenting insider bribery as a SIM-swap channel. The pattern persisted: the FCC adopted SIM-swap and port-out rules in November 2023, and in November 2025 the Manhattan DA indicted a ring that included four AT&T and T-Mobile store employees.
On 30 August 2019 the "Chuckling Squad" took over Jack Dorsey's @jack account and posted offensive tweets; Twitter blamed "a security oversight by the mobile provider" that let attackers control the phone number tied to the account.
In August 2021 T-Mobile US confirmed a breach, later sized at about 76.6 million current, former and prospective customers, exposing names, dates of birth, Social Security numbers and driver's licence data; John Binns, a US citizen living in Turkey, claimed responsibility.
In a 12 July 2024 SEC 8-K, AT&T disclosed that attackers copied call and text records of nearly all its wireless customers (about 109–110 million) from May–October 2022 and 2 January 2023, taken from its workspace on a third-party cloud platform later identified as Snowflake.
Attackers executed an unauthorized SIM swap against the phone number tied to the US SEC official X account, broadcasting a fraudulent Bitcoin ETF approval that caused hundreds of millions in market swings.