AT&T sues former workers and California-based Swift Unlocks, alleging scheme to download malware to AT&T computers to unlock hundreds of thousands of phones
Jacob Demmitt / GeekWire :
Context & Ripple Effects
AT&T's civil suit against ex-employees and California-based Swift Unlocks is the opening move in what becomes a decade-long pattern of insider-enabled phone unlocking. The alleged mechanism — malware installed on AT&T's own computers by people with legitimate access — targets exactly the internal tools carriers use to authorize unlocks.
The pattern recurs even after this suit: four years later the Justice Department charged a Pakistani man with paying over $1M in bribes to AT&T staff to install malware that unlocked more than 2M devices on the company's network, and in 2022 a US jury convicted a former T-Mobile store owner of hacking staff credentials to run an unlocking operation worth $25M hacking T-Mobile's internal tools. The through-line is that the carrier perimeter holds while the insider path pays.
First-order effects
- The named former workers and Swift Unlocks now face AT&T litigation over hundreds of thousands of unauthorized unlocks, putting the third-party unlock business's supply of compromised AT&T access under legal threat.
Second-order effects
- The suit fails to close the channel it targets — the later DOJ bribery case shows the same malware-via-insider method continuing at larger scale, forcing carriers to treat their own employees as an attack surface rather than trusting credential-based access alone.
Third-order effects
- Because unlocking fraud consistently routes through insiders and internal tools, carriers converge on account-level controls as the durable fix — a line running from this lawsuit to AT&T's 2025 Account Lock feature against SIM swapping, which followed similar moves from T-Mobile, Verizon, and Google Fi.
The trend: Phone-unlocking fraud is shifting from external hacking to bribed and rogue insiders with tool access, pushing carriers from network defense toward hardened employee controls and customer-side lock features.