Account Takeover Fraud , Cybercrime , Fraud Management & Cybercrime

Massachusetts Man Pleads Guilty in SIM Swapping Case

A Massachusetts man who used SIM swapping and other account takeover techniques to target business executives and steal more than $530,000 worth of cryptocurrency has pleaded guilty to several federal charges, according to the Department of Justice.

See Also: OnDemand: Assuming control | Can AI reach Autonomous Levels?

Declan Harrington, 21, pleaded guilty last week to five counts of wire fraud and one count each of conspiracy, computer fraud and abuse, and aggravated identity theft, federal prosecutors say.

The most serious of the charges, wire fraud, carries a maximum 20-year sentence and a $250,000 fine. A sentencing date for Harrington has not been scheduled.

Harrington, along with another Massachusetts resident, Eric Meiggs, were arrested by the FBI in November 2019 after the two allegedly targeted 10 executives who worked for blockchain companies and cryptocurrency exchanges or who published guides and advice about virtual currencies and digital wallets, according to the U.S. Attorney's Office for the District of Massachusetts, which is overseeing the case (see: DOJ: Pair Used SIM Swapping Scam to Steal Cryptocurrency).

Harrington and Meiggs targeted these executives because they "likely had significant amounts of cryptocurrency," prosecutors say. Many of the victims also had significant social media followings, according to the Justice Department.

Meiggs pleaded guilty to seven federal criminal charges in April, including conspiracy, wire fraud, computer fraud and abuse, and aggravated identity theft, according to the Justice Department. He is scheduled to be sentenced on May 24, 2022.

SIM Swapping

Between November 2017 and their arrest in November 2019, Meiggs and Harrington allegedly used a number of account takeover techniques to compromise victims' email accounts, including Yahoo Mail and Gmail, as well as social media accounts, such as Facebook, Twitter and Instagram, according to the federal indictment in the case.

In several of the cases investigated by the Justice Department and the FBI, Meiggs and Harrington appeared to favor SIM swapping techniques to target their victims, according to the indictment. These attacks started by convincing a mobile operator's customer service employee to move a cellphone number to a different SIM card - a swap - or port it to another carrier.

Once they had swapped SIM cards, Meiggs and Harrington would pose as one of the victims and then contact online service providers to request a password reset be sent to the compromised phone number, the indictment alleges.

After the passwords were reset, Meiggs and Harrington allegedly began taking over email and social media accounts. In one incident, the two men hacked into a victim's Coinbase accounts - a type of digital wallet that can be used to buy, sell and store various cryptocurrencies - to steal about $200,000 in virtual currency, according to the indictment.

In another incident, the two men allegedly used one victim's compromised Facebook account to send messages to a number of his contacts and businesses associates. Once these messages had been sent, Meiggs and Harrington were able to persuade one of these contacts to transfer about $100,000 in cryptocurrency to an account that they controlled, federal prosecutors say.

Meiggs and Harrington also allegedly resorted to threats in some instances. In one case, they threatened to kill the wife of one victim if he didn't divulge the password for his Instagram accounts, according to the indictment.

Other Cases

While Meiggs and Harrington were arrested in November 2019, the issue of using SIM swapping to steal cryptocurrency and take over accounts grabbed headlines in July 2020, when three people, including a Florida teenager, were charged in connection with the hacking of 130 high-profile Twitter accounts - including those belonging to Bill Gates, Barack Obama and Joe Biden - to pull off a cryptocurrency scam.

In that case, the three suspects allegedly gained control of several high-profile Twitter accounts, reportedly by using phone phishing and SIM swapping techniques, and sent fake messages to steal about $120,000 in bitcoin from victims. It's also believed that the suspects gained access to some Twitter account user data, including information stored in the Direct Message feature (see: Twitter Hack: Suspects Left Easy Trail for Investigators).

In March, the teenager in that case, Graham Ivan Clark, who is now 18, pleaded guilty to multiple charges and was sentenced to three years in a juvenile facility, according to Florida officials.

In a separate case, police in Europe arrested 10 individuals in February suspected of being part of an international gang that targeted U.S. celebrities by taking control of their phone numbers and using SIM swaps to steal large amounts of cash and cryptocurrency (see: SIM-Swapping Hackers Steal Celebrities' Cryptocurrency).