A prolific teenaged SIM-swap hacker has been indicted in New York for stealing the identities of at least 75 people across the United States and more than $1 million USD in cryptocurrencies from them via SIM-swap attacks on victims’ cell phones.
Yousef Selassie, 19, is charged with Identity Theft, Grand Larceny, Computer Trespass, Computer Tampering, Scheme to Defraud, and other charges.
Manhattan District Attorney Cyrus J. Vance gave the following account of the case:
“From his Brooklyn apartment, this defendant accessed accounts belonging to 75 victims in 20 different states…As alleged, in just 4 months he drained his victims of more than $1 million in cryptocurrency with little more than an iPhone and computer.”
Vance said this is the third such case lately handled by his office:
“This is the third major SIM-swapping case my Office has brought in recent months, and it won’t be the last.”
A press release from the Manhattan DA’s office explains this relatively new type of cyber crime:
“SIM swapping…refers to a scam in which a thief transfers a victim’s phone number to a phone owned by the thief. Once the phone number has been transferred to the thief’s phone, that person can then receive or place calls and send text messages using the stolen number. He or she can then circumvent text-based two-factor authentication security measures and intercept text messages containing security codes needed to reset passwords and access the victim’s online accounts, including cryptocurrency accounts.”
According to the indictment, “between January 20 and May 19, 2019, SELASSIE fraudulently transferred the cell phone numbers of at least 75 different individuals across the United States, including New York County, to Apple iPhones in his possession. SELASSIE then circumvented two-factor authentication security measures to access the victims’ online accounts, by requesting that recovery codes be texted to the phone numbers already associated with those online accounts – phone numbers which he now controlled.”
From there:
“SELASSIE accessed the victims’ online accounts, including but not limited to Gmail, Yahoo, and Dropbox, in order to determine whether the victims maintained cryptocurrency accounts. In some instances, SELASSIE also changed the passwords on accounts to prevent the victims from regaining control. As alleged, SELASSIE intentionally selected and targeted victims known to be active in cryptocurrency, due in part to the inherent difficulty in tracing the theft and transfer of cryptocurrency. In total, SELASSIE accessed accounts belonging to victims in 20 different states, and stole more than $1 million in cryptocurrency.”
Investigators claim they found evidence of hacking in Selassie’s Brooklyn residence, on electronic devices and in a”reconstituted” cryptocurrency wallet:
“Upon executing a search warrant at the defendant’s home in Brooklyn, New York, investigators recovered numerous electronic devices and a handwritten note containing a seed phrase for a cryptocurrency wallet. A search of an Apple iPhone X revealed artifacts tying SELASSIE to a number of known victims, while a search of the reconstituted wallet connected SELASSIE to the theft of hundreds of thousands of dollars’ worth of cryptocurrency.”
Selassie was not apprehended in New York, however, but in California:
“SELASSIE was arrested in Corona, California, pursuant to the execution of a search warrant that resulted in the recovery of numerous electronic devices and multiple pieces of custom-made jewelry that had been purchased with bitcoin.”
The press release about the accused also provides details about the two other alleged cases of SIM-swapping prosecuted by District Attorney Vance’s office:
“Last month, DAWSON BAKIES pleaded guilty to one count of Identity Theft in the 1st Degree and one count of Scheme to Defraud in the 1st Degree, with a promised sentence of 2-to-6 years in prison, for stealing the identities and funds of more than 50 victims across the United States in a SIM-swapping scheme executed from his Ohio home.”
As well:
“In July 2019, RICHARD LI was charged with a third SIM-swapping scheme that resulted in the theft of more than $3,000 from a Manhattan resident.”
Vance asks members of the public to be forthright if they experience or have information about this type of attack:
“We urge anyone with information about a SIM-swapping scheme to report it directly to our Cybercrime and Identity Theft Bureau at 212-335-9600. You can also submit tips anonymously to our Office through Signal, Wickr, Telegram, or WhatsApp at (347) 463-2198. Help us put SIM swappers out of business.”