What Happens When Your Smartphone Is Hacked

One man took a soul-crushing trip through AT&T’s customer-service maze and found out.

Admittedly, this was not my finest moment. It’s always a special kind of frustrating when technology stops working, especially a smartphone. It can feel like your entire life is interrupted. What if someone from work needs to reach me immediately? What if there’s an emergency involving someone I love, but nobody can tell me because my damn phone isn’t working? Those are the thoughts that had begun to creep into the back of my mind.

Add to that the many hours I’d already spent dealing with what seemed like corporate ineptitude, bouncing around a network of computerized voicemail menus that taunt you by claiming you can talk to them in full sentences, and then—when you finally break through—talking to incredibly unhelpful human beings. At this point, I’d lost nearly an entire day trying to get my cellphone turned back on and my hacked account back under my control. So I did something I’m not proud of.

I was using someone else’s phone trying to call the AT&T store at the corner of Lemmon and Oak Lawn in Dallas—not too far from the company headquarters. I was told I’d need to go in to pick up a new SIM card that would, in theory, get my phone working again. But ironically, it’s remarkably difficult to call a phone store. When I dialed the first number listed, I was sent back into the voicemail menu maze. When I finally got a person on the phone, I begged to be put through to an actual human at the actual store.

That gentleman—the one I was begging—seemed polite. He said he’d put me through, no problem.

Please, I remember saying. I just want to talk to someone there before I drive through traffic to pick up the card. I really don’t want you to transfer me to another computer.

He said he wouldn’t.

In that moment, I wanted to stress one more time how much I didn’t want to deal with yet another automated system. And this is where I went wrong.

Listen, I think I said in one of those calm-but-close-to-not-calm voices. If you put me on the line with another computer, I will come find you. And I will find your family. And we are all going to have a long talk about what happened here.

Yes, there’s no excuse for this, and I really didn’t mean it. But that’s what came out.

I started to apologize and explain that I was just having a bad day and that I knew it wasn’t his fault. That I was mad at his employer for putting us both in this situation, and not at him.

But it was too late. He had already hung up.

The Saga Begins

It all started with a text message that came into my cellphone from AT&T one recent day at 6:42 p.m. It said that “an authorized user” had been changed for my account and gave me an 800 number to call if I hadn’t made the change. It was probably an hour or so before I saw the text, and I didn’t think much of it at the time. I knew I hadn’t added any users, so I figured whatever happened would be easy to fix. I called the number and the automated voice that answered explained that the call load was heavy and that there’d be a considerable wait.

I put down my phone, thinking that I’d call back in an hour or so. Little did I know how long that is in the world of telecom fraud, or that I was about to go on a tedious, days-long journey through the soul-crushing gauntlet that is AT&T’s customer-service department—an experience so maddening that I eventually reached out to the company’s CEO to tell him about it. (More about that soon.)

A few minutes after I saw the text message and made the aborted call, my fiancée walked in the front door looking annoyed. She told me she’d been calling me, hoping I’d help her carry bags in from the car, and wanted to know why I wasn’t answering my phone. I picked it up, and in the top left corner of the screen, where it usually says AT&T, there were now the words “No service.” The circles that are usually filled in to indicate the strength of my signal were now all empty.

My fiancée let me use her phone and I dialed the 800 number from the text. The faux-friendly computer voice kept telling me that I could talk in complete sentences, but it didn’t understand “My account has been hacked!” or “I need my phone turned back on!” or “Please, for the love of anything good or holy in this world, just let me talk to a person!”

When I did finally get a human being on the phone—the magic word, I finally learned, was “fraud”—the situation did not improve. I suspect, looking back, that the woman who answered may have been having a headset problem, but it sounded like she was talking to me from a ham radio on a deserted island or a mountainside somewhere. There were times when I definitely couldn’t hear her at all, and times when I could sort of hear her through what sounded like a fuzzy wave crashing a few feet from her head.

Through all of this, I told her about the text message and the disconnection and—FSSSSSSSHH—“Ma’am, are you there? Hello? Ma’am? Can you hear me?” It took several recitations to get her all the details. She read a name I’d never heard before—the one apparently added to my account—and told me that it sounded like something called “upgrade fraud.” This, I found out, is when someone adds themselves to your account and signs up for extended service in exchange for free phones—in this case, two new iPhone 6s Pluses for the two lines on the account—that are then sent to an address you’ve never heard of. As soon as the new phone is activated, your phone shuts off. By the time you’ve figured it out and unraveled the situation with the phone company, the crook is often long gone with some valuable loot. The 6s Plus retails for around $800, so, repeated enough times, this felonious enterprise can be quite profitable.

I verified all my information and codes and passwords with the woman on the phone and answered enough questions to convince her that I was who I said I was and that my account had indeed been hacked. Unfortunately, she explained, the fraud department was closed for the night.

So there’s no way I can get my phone back on tonight? I remember asking, incredulous after the two hours I’d just spent repeating myself.


I asked if she could tell me more about what was happening with my account.


I asked if she could at least tell me again the name of the person who was added to my account. She’d said it earlier when she asked me if I knew the person. But now she wouldn’t repeat it. I was worried about what information this person might have about me, including my social security number, and I wanted to know how this had happened.

This is someone who hacked into my account, I recall saying. And you sent this person two new phones. So you have a name and an address right there on your screen and you won’t read them to me?


When I asked why, she said it was “for your safety.”

It sounds more like it’s for that guy’s safety, I remember saying.

Then she promised that someone from the fraud department would call my fiancée’s phone first thing in the morning.

Did anyone call?


Problems, Problems

I’ve been a customer of AT&T’s in one form or another for a long time. In the 1980s, my family had a Southwestern Bell telephone line. (Southwestern Bell bought AT&T Corp. in 2005 and changed its name to AT&T Inc. the next year.) When I got my first cellphone in 2001, it was with Cingular Wireless, which was acquired by AT&T a few years later. I had an issue when the first few bills showed I was roaming even in my own bedroom, but that eventually got straightened out.

For a while, I could mark different times in my life by the phones I had between upgrades: the first flip phone, the first phone with a camera, the first with a camera that took photos that weren’t just blurry pixelated mosaics, the first smartphone. I never loved signing up for the company’s two-year contracts, but I also never left. The service itself always seemed decent—at least as good as my friends got with other companies—so I didn’t have much cause to deal with the “customer care” department.

Hordes of other people, I’ve since discovered, haven’t been so lucky. When you have roughly 139 million wireless customers (and 280,000 employees), as AT&T does, some of the customers are bound to be unsatisfied. But for the last few years, the Zogby Analytics group and a financial website called 24/7 Wall St. have conducted an annual national survey about customer service, and AT&T is a regular on their “Customer Service Hall of Shame” list. (See chart below.) Last year was AT&T’s third straight appearance in the “Hall of Shame.” The company’s closest competitors, Verizon and T-Mobile, also were on the 2015 list.

Zogby-24/7 isn’t the only group doing these kinds of rankings for poor customer service. A quick Google search will yield a trove of similar lists, and AT&T appears on most of them. On the flip side, the consumer research firm J.D. Power and Associates has given AT&T awards for its customer service over the years—including one in early 2015, just a few weeks before the FCC fined the telecom giant $100 million for apparently slowing down service to customers who’d been sold “unlimited” data plans.

Over the last year or so, The Dallas Morning News also has run a series of “Watchdog” columns criticizing AT&T’s customer service. The columns by writer Dave Lieber included material ranging from individual horror stories about difficult service reps and upgrades gone horribly wrong to AT&T employee “testimonials” recounting an atmosphere where numbers and the bottom line mattered more than satisfying customers. Online, the comments sections on the columns have become mass grievance forums, with complaints both from wronged customers and former employees. (If you want more, YouTube has many pages of customer-service-call videos that are guaranteed to raise your blood pressure.)

For what AT&T deems “security reasons,” it declines to disclose how many customer service reps it employs, any specifics about exactly how calls get routed, or even the number of countries where it operates call centers. (I was able to learn that the agents I spoke to were in New Jersey and Texas.) So, I wanted to ask CEO Randall Stephenson—the company’s top man, with whom the buck theoretically stops—what it feels like to have so many people so upset with the company he runs, and what he’s doing to solve the persistent problems. I also wanted to discuss with him the frustration I felt over my particular situation, including my efforts to navigate the AT&T customer-service maze.

I reached out to the company’s public relations team to try to make it happen, explaining my plight. I said I’d been a customer for most of my life. I stressed that, in the end, my phone was turned back on—“a happy ending,” I called it. I said I wanted to discuss all this with the chief executive and write a story about the entire experience.

A very polite, very sympathetic PR rep told me she would check and get back to me. We talked on and off for more than three weeks, trying to set something up. Finally, two days after my original deadline had passed, she told me that I would not be able to speak with Stephenson, that I wouldn’t be able to ask him what his company is doing to keep its customers from going through what I went through. “He’s traveling so much right now, we just can’t work it into his schedule,” I was told.

Not even a phone call? I recall asking.


Not even just for five minutes?


Instead, I was given time to talk to Vicki Jones, an AT&T senior vice president. She started working at Southwestern Bell when she was a kid, she said. She was smart and considerate, asking about my experience and thanking me for sharing. She said she couldn’t tell me anything more about my case, or about whether the company had initiated a criminal investigation. There’s no way to know how typical my case may have been, or how AT&T compares with its competitors on something like fraud—though a survey done by the Communications Fraud Control Association found that this type of fraud is down nearly 20 percent from two years ago. But it still cost the industry an estimated $38 million in 2015.

Jones said the company doesn’t publicize how often, exactly, this type of fraud happens, but she stressed that it’s extremely rare. “On a percentage basis, it’s a very, very small—like, a handful of zeroes to the right of the decimal—number of customers that are impacted,” she told me. She pointed out that the text message I received is part of the company’s effort to catch problems before they happen. She sounded a little like a police officer when she talked about how AT&T searches for “new ways to fight the bad guys,” and how the security team “looks for the point of breach.” Sometimes, she said, “it’s like chasing a ghost.”

In a follow-up email, a PR rep told me that AT&T works with other carriers to battle this type of fraud and is “constantly upgrading” security procedures and “making improvements to customer service.” She also explained the idea behind the automated speech-recognition menus: “We have learned through customer-experience surveys and data analytics that sometimes customers prefer to handle issues on their own—using our online tools or through automated service.”

Funny, but none of that made me feel any better.

The Resolution

At the AT&T store, there was an awkward moment when the customer service rep-cum-salesman told me that it looked like I would need to pay to get my phone turned back on. I knew that he was just reading what was on the screen, and I knew that AT&T probably doesn’t have a lot of ways of coding upgrade fraud to make it easy for employees on the ground. But I also knew that it can’t be a coincidence that right next to so many AT&T stores there are Verizon stores. I could see the sign through the window and could feel myself floating in that direction. I made it all the way to the door before a manager came over and calmed things down. Even then, I pondered what it would take to make the switch: would it be more or less of a hassle than continuing to deal with this with AT&T?

After 45 minutes of clicking through touch screens, the first rep put a new SIM card in my phone and it came back to life. After all that, I asked if there was anything they were willing to do to keep me as a customer. Some sort of discount or money for my time, maybe, or some cool new accessory off the wall?


The manager explained that I was in a franchise store, and that if I wanted something from the company itself, I would need to work it out with “corporate.”

So, three days after my phone originally went off, my account was finally back to normal. That’s when I called back to the customer care line. I shouted through the voicemail menu. Once I got a human, I explained what I’d been through and asked what they as a company were going to do to keep me as a customer. I stressed my history with the company and the thousands of dollars I’d sent them over the years.

It took a few tries to find someone on the other end who cared, but eventually I did. He said his name was Ruben. He was polite and apologetic, and in that moment he seemed like some sort of angel. In the end, he found someone to lower my monthly bill by $50 and to double my monthly data plan. I was too busy thinking about what that would save me in a year to wonder why I wasn’t already on this plan, and why it took a fraud on my account to get the offer.

I told Ruben that I appreciated him doing his best to right the situation, and that I looked forward to this new, smaller phone bill. Then he asked me: Was I ready to upgrade my phone and sign on to another two-year contract?



Our D CEO Weekly newsletter helps you stay up to speed with breaking news, interviews with industry leaders, and market insights from the editors of D CEO.