Follow US:

Practice English Speaking&Listening with: The $5 Million Phone Hack

Normal
(0)
Difficulty: 0

[music]

- I'm Nev from Catfish,

the series that investigates social media mysteries.

Tonight, the new series, "True Life Crime,"

investigates the most harrowing true crime mysteries

rocking headlines and social feeds.

These victims were young.

The crimes against them were shocking

and haunting questions remain.

"True Life Crime"

is here to expose the truth.

In tonight's case,

imagine, you pick up your phone

only to realize you're locked out of Instagram,

Snapchat, email,

and even your bank account.

When you finally do get back online,

all of your personal information is stolen

and your money is gone.

Tonight, MTV News Reporter, Dometi Pongo,

investigates a multi-million dollar hack

and discovers the very real dangers

facing every one of us

who owns a phone.

[music]

- There's a new breed of cybercriminal

that can target anyone from anywhere.

- Everyone is walking around with bad security

and no one cares until they're hacked.

- The victim's weakness?

Their cell phone numbers.

- What do you do when you can't trust your phone number?

- Once these hackers take control,

it's game over.

- Everything was gone. - You mean all of your money?

- Yes. - And it's just terrifying.

- This little-known threat is a multi-million dollar scam

that's devastated people's lives.

- These were very serious and heinous crimes.

- Victims became suicidal

over the complete financial ruin.

- I was shocked because I have never thought

of anything crazy like that would happen.

- No one is safe. It can happen to anyone.

- That includes the rich and famous.

A wave of celebrity attacks put the cybercrime

in the spotlight.

Adam Sandler, Mariah Carey,

even the CEO of Twitter, Jack Dorsey,

fell victim.

Actor-comedian King Bach

live-streamed about it.

- So my passwords are not easy.

And for my [bleep] to get hacked,

give me a new phone or some [bleep]

because this is crazy.

- These thieves believe

they were untouchable. - No one had been arrested.

They really didn't have too much to fear.

- They stole over $40,000 worth of [bleep].

- Until an elite team of cybercrime cops

made the first-ever arrest of its kind

in history. - He stole a ton of money

to pay for this lifestyle.

- You are not gonna believe

who's behind a scheme this sophisticated.

[music]

- Hi, guys. - What's up? I'm Dometi.

- I have actually heard a lot about you.

- Oh, that's scary as hell.

- Does any of this kind of look familiar to you?

- [bleep] outta here. [laughs]

It can take only minutes for a hacker to find

all your personal information

so they can assume your identity

and infiltrate your online accounts.

- Look, this information right here?

I can probably open up a couple of credit cards

in your name, steal your money,

and destroy your life.

- [laughs] He's just trying to creep me out

and it's [bleep] working.

- I've just saw every password I've ever had,

and a lot of other personal information.

Basically a hacker's dream,

almost some guy's laptop I've never met.

So anyone out there who doesn't think

they could be a target for hackers,

think again.

With social media being so integral

to our lives, careers, and identity,

all our personal info is out there,

and digital data has become

a criminal's greatest commodity.

Cyber-attacks are more of a threat than ever right now.

And there's one hack in particular

that scared the [bleep] out of me.

Never in my worst nightmare could I've conjured up a hacker

taking complete control of my cell phone

from anywhere in the world

and having access to my social media,

emails, pictures,

all of my money.

And that's why I had to find out

how these hackers were doing this

and if there was anybody doing anything

to stop them.

I had no idea of the rabbit hole

I was about to head down.

[music]

- It all started with an online article

I read on medium.com

written by a guy named Diego Pulido.

He had something stolen I didn't even know

there was a market for.

His Instagram name which was simply @diego.

- Diego had what's known as a vanity handle.

You can think of it as an Elite Twitter

or Instagram name.

They're usually pretty short,

they could be a letter or a word.

And they're pretty desirable

because they signal some sort of status.

There's market places that popped up online

to sell them.

They go for as low as $50.

Or some vanity handles are sold

for hundreds of thousands.

- Now it's perfectly legal to buy, sell,

or trade vanity handles.

But then hackers figured out a way to steal them

which is what happened to Diego.

How did they do it?

Diego and I both live in New York.

- Hello. Welcome. - Hey, how are you doing, man?

So it's time to meet him in person.

What happened? - It was a crazy ordeal

because my actual phone line

wasn't working.

It just had no service.

So I called about my phone not working.

They were like, "Oh, no worries.

"We just texted you the instructions

"to your LG Vu Android phone."

"No, like, I don't have an Android phone.

"I have an iPhone." They're like, "No, you switched

"your phone to an Android phone,

"you did it yourself, like you called."

I hadn't.

- Holy [bleep].

Diego's phone service was eventually restored.

But when he logged into his Instagram account,

he made a startling discovery.

The hackers had stolen his username,

leaving another in its place.

- They changed my username

from @diego to @diegorips.

- Like, RIP? - Yeah.

Rest in peace, almost like Diego's dead.

- That's an [bleep] move, man. - Oh.

Four days later, someone texted me

and they said, "Hey,

"your account is back up."

It's someone else.

- Diego believes the hacker sold his stolen handle

to "Rock of Ages" star Diego Boneta.

And there wasn't anything he could do to get it back.

How do you feel about his whole experience, man?

- It made me feel a little less secure

that I was being targeted by malicious people.

It's like I felt that I was potentially

just--just robbed out of my identity.

That's not a place you wanna be in.

- 2500 miles away in Los Angeles California,

a teenager with a coveted vanity handle, @0,

was partying like a rock star

and flexing on Instagram when he caught the attention

of armed robbers and was held-up at gunpoint.

- Like I was so [bleep] scared,

like, he was literally was supposed--

about to pull the trigger on me and [bleep]

I must've, uh-- I'm lucky I'm alive.

- I would later find out that @0

was tied to the same scam that targeted Diego.

What was the connection?

And how exactly were these hackers

stealing vanity handles?

It turns out stealing vanity handles

was just a gateway into an even bigger scam.

Hackers had figured out a way to get into people's

financial accounts and clean them out.

And I found out exactly how they were doing this.

I'm headed to Silicon Valley, California,

the heart of the tech world.

Aside from the big players like Google and Facebook,

Silicon Valley is also a home base

for an elite group of cops

called REACT, which stands for

the Regional Enforcement Allied Computer Team.

I'm meeting Detective Samy Tarazi

who heads the 12-man task force

created to combat cybercrime.

How do hackers pull off this scheme?

- They'll contact the telephone company

and say, "Hey, I'm Samy Tarazi."

And after verifying a bunch of security questions

that they have the answers to, then they'll say,

"What's the number of the new SIM card?"

And on the SIM card,

there's a long series of numbers

they type it in to the computer,

they hit enter, and now,

the victim's phone loses service.

And then the bad guy's phone

that they just read that SIM card off to

goes live with that service.

So now the victim can no longer receive phone calls,

or make phone calls, or receive text messages,

or send text messages.

And every future text message and phone call

will go to the bad guy phone.

- But when you call your mobile carrier

and you say, "I've got a new SIM card,"

they ask all of these security questions,

how were these hackers getting the access

to the answers to those questions?

- Through website,

compromises, phishing compromises,

email scams.

- Cybercrimes like phishing are the most common way

to gather personal data and passwords

by using fraudulent emails, texts,

and websites disguised as real businesses.

They also troll social media for things

like birthdates and pet names.

[music]

- So what they do is,

once they have control of the phone number,

they go to the victim's email address and say,

"I forgot my password."

Google will send a text message saying,

"Please type in the text message code

"we just sent you."

They type it in

and they're in to the Google account.

And from there they do the same technique

over and over again, resetting passwords

to every account they have.

- I'm just getting anxiety hearing you

talk about this, bro.

Within minutes, hackers can infiltrate

your emails, private photos,

and personal documents stored on the Cloud.

But the biggest prize of all?

Your money.

Just how much money are we talking?

- SIM swapping has resulted

in at least $75 million in theft.

We have, you know, over 2,000 victims,

probably 50 to 75 bad guys.

- REACT had been investigating the scam for 18 months

before they got their first big break.

Hackers are known for being hard to track down.

That's kind of their thing,

that's how they're able to do what they do.

So the REACT team had their work cut out for them

when they had to figure out a way to locate these guys.

Samy's putting me in touch with some

of his fellow REACT investigators

who are on this case from the beginning.

You are not gonna believe

who's behind a scheme this sophisticated.

So tell me about that moment

when Samy brings this case to you.

- So in March of 2018,

we had one victim who had about $10,000 stolen from him

and reported that his cell phone had stopped working

and subsequently,

he had lost access to a bunch of his online accounts.

- Then we just started looking at the phone records

of who took over the phone.

And we see that the victim's cell phone

was in San Jose area,

then when it switches, it goes right to Boston,

just south of Harvard.

We figured out it's an Android-based phone

and we sent off warrants to Google

to ask for whatever data they had

that correlates to that number of the phone

that the bad guy was using.

We got a guy named Joel Ortiz's email address,

and we got his whole account

with all the emails he's ever sent and received.

And within those emails, we see a picture of him

holding up his driver's license.

- 19-year-old Joel Ortiz

is none other than @0,

that guy who's flexing online and then held up at gunpoint.

- Two guys came to the house with guns

and pointed them at me and my friends.

It's [bleep] crazy.

- That piece of information was a huge break.

It seems like the victim

was actually the criminal.

The clock was ticking to catch Joel

before he hacked another time.

[music]

- He posted that he was leaving California,

he was gonna go to Belgium.

We were worried if he left the country,

he wouldn't come back.

- So once the robber got robbed, the race was on?

- The race was on, yeah.

- Yeah. - That's for sure.

[music]

- In Silicon Valley, California,

an elite cyber crime task force called REACT

were investigating a SIM swapping scam

in which hackers convince cellphone providers

to switch your cell phone number to their device.

Then, they take control of your email,

social media,

and steal your money.

For the first time, the REACT team

could finally put a face and a name

to one of the SIM swappers.

So once you identified Joel Ortiz,

what happened next? - From that point,

I started doing research into who he was

and what he was up to.

- In a matter of months,

19-year-old Joel Ortiz had SIM swapped his way

into the life of a multimillionaire.

He then did what any young adult would do

when they suddenly find themselves rich.

Posted about it on social media.

[music]

- What's up, guys?

Uh, it's @0 here.

I will be making a little live stream

about what happened yesterday.

- Joel Ortiz had the Instagram handle 0,

just the number 0,

which we later found out he paid $40,000 for.

And on instagram.com/0,

it had him wearing Rolex watches,

partying in clubs.

There's no explanation

other than he stole a ton of money

to pay for this lifestyle.

- It was [bleep] insane, ese, like, last night, uh...

- I think it was definitely an element of Joel

and some of the other guys

having this be their opportunity

to kind of impress people

and get people to pay them attention

and to be their friend.

- Joel Ortiz wanted to be like the Instagram celebrity

where they're living that flashy life,

flashing jewelry, flashing cars.

They call it flexing.

- Flexing, yeah.

I know a little bit about flexing.

I got you. - Yeah, yeah.

- They would buy what they thought

would make them look good on Instagram.

- I think in the back of their mind,

no one had been investigated, no one had been arrested,

they really didn't have too much to fear.

- So we just started following him.

- Joel Ortiz had fueled his extravagant lifestyle

by stealing millions of dollars

from innocent victims.

- The victims in this case lost everything.

- Some of these victims are absolutely devastated.

Life savings, gone.

- We had a victim who put aside money

for his daughter's college education.

And overnight, it was gone.

We have victims who became suicidal

over the complete financial ruin.

- Who were Joel's victims?

And how were their lives impacted?

To get some answers, I'm headed to Florida

to talk to one of them.

[music]

- I'm in Palm Harbor, Florida,

getting ready to meet with Anthony Covone,

a 26-year old who works in children's charity.

He saved a large chunk of money

for his wedding to his fiancée, Emi,

and apparently, lost it all.

What was the hack? Talk about that. What happened?

- So I was actually on a work trip in Atlanta.

Last night we were there,

all of sudden,

my phone went completely blank.

I had no cell service,

I couldn't connect to Wi-Fi, anything.

So I figured, okay.

Maybe just bad SIM cards.

So once I get a new SIM card in,

I had a flood of text messages saying,

"Are you okay? What's going on?

"Why are you posting these things on Twitter?"

I'm, like, freaking out.

- Anthony's Twitter had been compromised

and a series of hateful, offensive comments

were posted on his timeline.

What did the posts say?

- They were the most horrible things

you can ever even imagine

ever saying about anybody,

like, from the racist things

to the homophobic things,

to anti-Islamic things.

With today's cancel culture,

it could've ruined everything for him.

He could have gotten fired. - Especially in the work you do,

because you work at a charitable foundation.

- Yeah. - And it's just terrifying

and just awful.

- The attack wasn't random.

Anthony had something that SIM swappers

like Joel Ortiz were specifically targeting.

Cryptocurrency.

- I saw a bunch of log-in notifications,

people trying to get on my emails.

So I open my email app and I noticed

they have changed the passwords

on a whole bunch of different accounts.

And when I was finally able to log back into that,

everything was gone. - By everything,

you mean all of your money? - Yeah.

They got into the exchanges.

- And by getting into the exchanges,

that means... - They had access

to all the cryptocurrency I own there.

- How much money are we talking?

- It was about 70,000, 75,000.

- [sighs]

For somebody in their 20s, like,

this was life-changing amount of money.

- Yeah. - We have a wedding

that we were planning next year,

so I was hoping to use those funds for that.

Maybe put on, like, a down payment

for a house or something.

- How did this whole thing

change your plans as far as getting the house

and the wedding? - Well, it definitely pushed

the wedding plans on the backburner for sure.

You know, that's upsetting, it's something

you look forward to.

Still to this day, the house is not an opportunity.

- How was Anthony handling all of this

from your point of view? - So stressed.

He wouldn't be able to fall asleep at night.

Typically, the second his head hits the pillow,

he's out.

Just like so emotional

and just--just every day seeing how hard it was on him

to try to get things back together,

it, like, hurt me to see how hurt he was.

- How did they know you had crypto?

- I have no clue. - Have you gotten back

into cryptocurrency? - I haven't gotten back

into it all.

- Since Bitcoin hit the market in 2008,

65 million people worldwide

have invested in cryptocurrency.

Worth a total value

of over a hundred billion dollars,

for SIM swappers, crypto was a massive,

untapped gold mine.

And majority of investors are typically between

the ages of 18 and 34.

The question is, how exactly do hackers like Joel

know their victims have cryptocurrency

to begin with?

[music]

- I'm back in Silicon Valley linking up with someone

I found on Twitter who can give me some insight.

Hey, hey, what's up? - Hey, Dometi.

- Rachel was an influencer, speaker, and host

who drops content through her platform

at cryptofinally.

- This was huge.

And again, 2017,

we all know what happened then,

and that's when all the celebrity start going,

that's when Bitcoin starts running,

we're in the news, we're everywhere,

people are hearing about it.

- One of the reasons I wanted to reach out to you

is because you're, like, knee-deep

in the crypto world.

Explain crypto.

- Cryptocurrency is an electronic currency.

There are lots and lots of cryptocurrencies.

- And it's basically an investment, right,

like investing in the stock market?

The value changes over time. - Exactly.

- Why do these hackers specifically focus on people

with cryptocurrency?

Isn't it more secure than a bank?

- No. What makes it less safe to hold

than money that you have in a bank

is that there is no additional security.

You are 100% in control of that money.

If a hacker decides to steal it,

it's much easier than robbing a bank,

if they take the money out of your crypto account,

the money is gone.

- Wow.

How do these hackers know who has crypto?

- This can be as easy as trolling your Instagram

or your Twitter, trying to get information

that you've put out there.

- Oh, my God.

[music]

- Ironically, while Joel Ortiz and other SIM swapping crews

were trolling social media in order to commit crimes,

law enforcement was doing the same thing

to try to stop them.

- These bad guys were making millions of dollars

but making rookie mistakes.

- Joel was about to make

one of the biggest mistakes of all.

[music]

- You think that money is still out there?

- I do think that. I told him

that we could be more lenient

if he would tell us where the rest of his money was.

- The total amount that the hacker stole

from me and my family

was a million dollars.

[music]

- 19-year-old Joel Ortiz had siphoned a fortune

from victims' cryptocurrency accounts

through a cellphone hacking scam

called SIM swapping.

In Silicon Valley, California,

a cyber crime task force called REACT

had been tracking his movements via social media

from his home in Boston

to the club scene in Hollywood.

[music]

- You see a bunch of nerdy kids

at a club in LA, flexing,

paying people to hold up signs

with their Instagram alias,

and they're doing bottle service constantly,

and they're constantly flexing cash, they drew attention.

- But it wasn't the attention Joel was looking for.

Things took an unexpected turn,

then he made a critical mistake

that would ultimately lead to his downfall.

- In the beginning of July, like, 2018,

he posted to his Instagram storyline

that he had been robbed at gunpoint.

He had reported the robbery that happened at his Airbnb

to the Hollywood Division

of Los Angeles Police Department and...

- Wait a minute. The hacker who got robbed

has the gall to report the robbery to the authorities

even though he's involved in all those criminal activities?

- Yes. - He's stolen all of these?

- Correct. - Yes. He didn't follow

the criminal guidebook of not reporting crime

if you're a criminal. - And it gets better

because he also went to social media

and made sure to tell his story about what happened.

- He live-streamed it on Instagram

the morning after.

- He stole, like, over $40,000 worth of [bleep]

I had, like, $8,000 cash

and a Rolex and a Bitcoin chain.

They stole a bunch of iPhones and [bleep]

but what [bleep] about jewelry that I lost,

I could just buy that [bleep] back.

It was just like [bleep]

it really [bleep] like

screwed my mind over, like.

- He posted to his Instagram

that he was leaving California,

he was gonna go back to Boston,

and then go to Belgium to go to a concert.

We were worried if he left the country

he wouldn't come back.

- So once the robber got robbed, the race was on?

- The race was on, yeah.

- Yeah. - That's for sure.

- The REACT team couldn't take the risk

of losing track of Joel if he left the country.

- We were working with the Los Angeles Airport Police,

when we figured it out which flight he was gonna be on

and which terminal he was gonna have to go through,

we flew down to LA. When we decided that

it probably would be best to get him

after he walks through the metal detector,

you know, puts all his luggage down

and puts all the stuff in the bucket,

then me and Caleb just walked up

as he was walking through the metal detector

and we have out badges out.

We arrest him at the airport on his way back to Boston.

- If not for that social media post,

you don't even find this guy.

- Nope. We would not-- we'd have no idea

he was leaving the country.

Lucky for us that he posted that.

[sirens wailing]

- Joel Ortiz was the first person

ever arrested for SIM swapping.

He was charge with 41 counts

and including grand theft,

identity theft, and assorted computer crimes.

Did Joel work alone?

Were there other people involved?

- Basically, there's kind of this loose community

of these guys that know each other,

that work with each other off and on,

uh, so, there weren't a lot of different people

that Joel Ortiz was associated with.

It's not like he had a robbery group,

four guys and every time they went out to do a hit

it was the same four guys. - Got you.

Figured each person is in a different state

or a different country.

They're talking to each other on headsets

and they're communicating by typing into chat rooms

and because these suspects

don't know how much time they're gonna have

with the victims' phones and accounts,

they have to split all the tasks up.

So one person is in charge of switching

the victims information with the cell phone carrier,

another person is actually holding the phone

and the SIM card, one person is in charge

of resetting the password on accounts

and then finding information for cryptocurrencies

and then pass down onto somebody else.

So, usually there's three, four,

five people on a hack doing this.

- Joel's big mistake was the phone

that he's using for crime was his old phone

that he used for his personal life

and that's what got him caught.

When we arrested Joel at the airport,

we tried to keep it as secret as possible.

- The REACT team feared other hackers

would begin covering their tracks

if they learned of the arrest.

So Joel was secretly driven

to Elmwood Correctional Facility

in Milpitas, California.

But their efforts to keep his arrest a secret

were in vain.

- His arrest became notoriety

in the community of hackers.

Within 24 hours, they got our police report,

they got our affidavits

and now they're reading exactly how we caught him.

Then it became more difficult to find them.

- So that--these criminals are getting smarter.

- Yeah. There were a lot of social media profiles

that went dark. So things got a little less obvious

as far as who was out there flashing their world.

[music]

- What about the money?

How much was hacked

and would any of it be recovered?

Was Joel cooperative? To find out,

I'm meeting with Deputy District Attorney Erin West,

the prosecutor of the case.

How much money did Joel steal?

- We believe that Joel stole five million dollars,

probably more.

- Where is that money right now?

- Joel is arrested at LAX and what he has with him

that's super important in this case

is he has a ledger.

And the ledger is almost like a thumb drive

that holds cryptocurrency.

He gave them the password and they recovered $300,000.

- That's a drop in a bucket

compared to what he'd taken, right?

- It sure is.

I had conversations with Joel

and told him that we could be more lenient

if he were to tell us

where the rest of his money was.

We know that he didn't get all of the money

that he stole. He split it with his partners

but there was a significant amount of money missing.

- You think that money is still out there?

- I do think that.

- Samy mentioned thousands of victims.

Are all these thousands tied to Joel

or we're talking about a thousand people

who experienced some sort of SIM swapping

and they might be tied to Joel?

- A thousand people have reported to us

that they have been SIM swapped.

We don't know always who they are directly tied to.

That's part of the mystery yet.

- Speaking of mysteries, who exactly is Joel Ortiz?

Did he mastermind this whole thing?

My plan was to interview Joel in prison to get some answers

but California has a strict no-media policy.

Instead, I've sent him a few letters,

so far though, no response.

In the meantime, I hit up Joel's defense attorney Dennis Dawson.

I was completely taken aback by what he told me.

So I'm on my way to meet up with him

and get the full story in person.

[music]

- SIM swapping is a terrifyingly simple cybercrime

that has left thousands of victims in financial ruin.

The first person in history

to ever be arrested for this scam

was 19-year-old Joel Ortiz

or Joel as his name is also pronounced.

I'm curious to know who this kid is

and how he ended up involved

in the five million dollar phone hack.

So I'm meeting with his defense attorney,

Dennis Dawson.

What did you notice about him when you first met him?

- He didn't seemed bothered by the fact that he was in jail

despite the fact he never been in jail.

That was an immediate alarm bell for me

come to find out he is on the autism spectrum.

He's autistic.

It all made sense at that point.

Yes, Joel had a full scholarship

to University of Massachusetts,

was a valedictorian in his high school.

What I didn't know about him when I first met him,

so he had really tough background,

um, growing up. My understanding is,

he didn't even speak until he was in junior high.

- Wow. What was his upbringing like?

- Joel grew up in Boston, Massachusetts.

His mother was an immigrant from Puerto Rico.

She's also a hundred percent disabled with a back injury,

father was never in the picture.

Joel grow up very poor. Um, had no friends,

made all his friends on the internet

including the probably the folks that got him involved

in this case as well. - Do you believe they're folks

that got him involved in this case

rather than him being the mastermind

of this whole thing? - Joel's participation

in SIM swapping was literally the riskiest.

Joel was the actual person who have the cell phone

that would be switched from whoever the target's phone is

to the one that Joel's holding.

The problem with that is,

cell phones ping off cell towers.

That's one of the ways they figured out

who was holding that cell phone.

- So you believe if he was the mastermind,

he wouldn't have given himself the riskiest job?

- Correct.

- Joel obviously had to overcome some huge obstacles

and it seemed like he was on the path

to a right academic future.

So what happened?

For some answers,

I need to go to Joel's hometown,

Boston, Massachusetts.

I'm getting ready to meet with Amelia George.

She was Joel's mentor for several years

and if anybody can shed some light on

why he may have done what he did,

I'm hoping it's her. First off,

I've been hearing people pronounce his name

several different ways, Joel and Joel?

- I've always known him as Joel.

- What's your first impression of him?

- I first met Joel when he was about 16 years old.

I could tell that he was struggling.

He would look down,

he had a hard time making eye contacts.

He just didn't exude a lot of self-confidence.

He was a young person looking for more support,

so week after week, could really see

that change in him physically. He would hold himself higher,

um, just having a chance to actually speak with someone.

He didn't do that very often.

- What did you learn about his family

and home life in the time that you worked with him?

- He felt very isolated.

He shared about not even being able to speak Spanish fully,

not even being able to understand the relationships

and the dynamics within his family.

- How did you feel when you found out

that Joel was arrested?

- I was really sad.

You have been, kind of, walking alongside Joel

for a couple of years and to really see

how hard he had been working,

it was pretty heartbreaking.

- Why do you think Joel ended up going down this path?

- I can't live in his mind and I can't answer for him.

I don't have autism.

I'm not a young Latino boy that doesn't have a dime

and goes into trashcans and finds cans

to save up just to buy my mom flowers.

So why he did it? I'm not sure.

Does he regret it? I--absolutely no.

He's very aware that his actions have not made

a positive influence in the world.

- So at this point in the investigation

that I started having conflicted feelings.

What Joel did destroyed lives

but I also feel some sympathy for this dude.

- Everyone just, like [bleep] uses me in a way,

like [bleep] all they want to do is firing away,

not respect me in a way and [bleep] so.

- Because Joel is on the autism spectrum,

if that'd make him more susceptible

to peer pressure,

I reached out to Dr. Judy Ho, a clinical psychologist

to understand what effect Joel's autism

may have had on his actions.

- In some ways, the online community

can be even more dangerous for individuals with autism

because people can hide behind a computer.

Although I've never met Joel,

just looking at some of his social media posts,

he was alone most of the time.

When he's in this virtual world,

he was powerful and finally, he was popular.

This money was getting him attention from other people.

You can see how in his mind

he just didn't want that to go away

and it's almost like he blocked out the fact

that these were very serious and heinous crimes.

- On January 24th, 2019,

Joel pleaded no contest to the 41 counts against him.

In effect, it was a guilty plea.

His sentencing hearing was scheduled

for two months later.

He was facing a minimum of one year in county jail

to a maximum of 10 years in state prison.

- When I went into his sentencing,

I was very hopeful.

I was very hopeful that the court would see that

he is remorseful,

where after he served his sentence

they would make sure he was going to school.

He wasn't using the internet for illegal purposes.

That's what I thought would happen.

- We were sentencing a hacker who was relatively young

but who had committed a very sophisticated crime

and that had causes so much damage.

- Joel was the first SIM swap hacker

to face sentencing.

How did the judge rule?

- Behind the computer screen, you stole millions of dollars.

- It was a major theft.

The punishment had to account for that.

- We have anger towards him

because you know that he knows what he's done.

[music]

- What's up guys? It's @0 here.

- Joel Ortiz awaits sentencing, is the first hacker

to be arrested for SIM swapping.

He's on the autism spectrum.

But there are currently no legal clauses

that allow autism

as a consideration for leniency.

- He's young,

typically the criminal justice system

treats young folks

without any criminal record differently

than what we might call hardened criminals.

So I was very hopeful that court would see that.

- The state versus Joel Ortiz

obviously had a different agenda.

- The victims in this case lost everything

and came into court to explain exactly

how devastated they were.

- One victim who couldn't confront Joel in court

did the next best thing. He sent a video

that was played at Joel's sentencing.

- To Joel Ortiz, no thanks to you

I've been sick with paranoia for much of the last two years

and felt though I could never touch the internet again.

I'm speechless really to think that

it was even possible for this incredible REACT team

from California to find you.

I hope you grow from this

and rejoin society and benefit the world.

- Joel was facing a minimum of a year in jail

up to the max of 10 years in state prison.

- It was a major theft.

The punishment had to account for that.

- And account? It did.

The judge gave Joel the max.

- Joel was sentenced as 10 years in California State Prison.

I'm sure the victims don't see this sentence as egregious.

But what does a rapist get?

What does a young kid who points a gun at someone

and takes their money? What do they get?

They're getting, what, four years,

five years, six years?

It just seems so out of whack.

- Joel's victims felt differently.

- Joel Ortiz was a coward.

Behind the computer screen he stole millions of dollars.

He-he deserves the punishment that he got.

- I was blown away by 10 years.

To me, that's a long time

especially knowing how young he is

but I think it's justified. - I was pretty happy

because that's a pretty [bleep] thing to do to people.

[music]

- Joel began serving out his 10-year sentence

at San Quentin State Prison,

but was recently transferred to a facility near Sacramento.

Since his arrest in June of 2018,

no one he knows has visited him.

After repeated attempts to contact Joel in prison,

a four-page letter finally arrives.

"Every day I would lay on my bed with myself

"thinking about all the nostalgic memories

"I've been through,

"living ostentatious lavish lifestyle.

"It felt like a movie.

"It also comes with consequences.

"Being locked up changed my life.

"I look back to my past

"and wish I was never involved in SIM swapping.

"Taking away my passion in technology

"is like taking away my life."

He says he's extremely remorseful.

"I wanna pay back what I owe

"to be a leader into my community."

- Joel's SIM swapping days may be in his past,

but he wasn't the only person out there doing this.

- This case is huge, Joel worked with a lot of people

and there's other people that we're actively investigating.

- After Joel Ortiz was arrested

Santa Clara County and REACT

made a total of five arrests

within a period of about five months.

- The person I know as the ring leader

of my SIM swap gang was Nick Truglia.

He was arrested in Manhattan.

The total amount that the hackers stole from me

and my family was a million dollars.

- And actually see him in person

in his, like, orange jumpsuit,

you have like anger towards him looking at him

because you know that he knows what he's done.

- The arrest weren't the deterrent.

It just drove them deeper underground.

- New bad guys are coming out from the community

and learning from the mistakes of others.

The cops adapt, bad guys adapt again.

- Harder still to track down is the stolen cryptocurrency.

Will victims get any of their money back?

- I really have a high doubt about that,

it's not traceable in the crypto world.

- I hope to get some restitution.

- Anything would be better than nothing.

- Part of that investigation is tracking down every cent.

A lot of it was purposely spent.

Ultimately, we may not be able to account

for where the money went.

- Crypto is uninsured,

so once it's gone, it's gone.

Is there any way to protect our money

and ourselves from being hacked?

[music]

- That stuff isn't going away.

You can take that information

and do whatever you want with it.

- Yeah. Exactly.

That's when they begin tracking you,

then it's all a matter of if they'll hack you or when.

[music]

- I've been investigating this massive SIM swapping scam

in which hackers convince phone carriers

to switch a victim's phone number to their phone.

So what I wanna know is what I can do to protect myself.

Who better to get the answer from than a hacker.

He only agreed to talk to me and Rachel

if he could remain anonymous.

- Does any of those kind of look familiar to you?

- [bleep] outta here.

Oh, my God.

Damn, this is going back to right out of high school.

- The email list unverified, are those all your emails?

- These are all my emails.

I got my mom's name, my dad's name,

both of my sisters on here.

- Did you have to put any money forward

in order to get that information on Dometi?

- No, ma'am. - No.

It's all free. - Free?

Yes. Legal?

Not necessarily.

- Okay.

- What can you do with this info?

- With this information right here,

not only could I steal your cell phone

but I can probably open a couple of credit cards

under your name.

- I'm even thinking about my nieces,

they already have a lot of social media accounts.

That stuff isn't going away.

You can take that information

and do whatever you want with it.

- Yeah. Exactly.

Another way a SIM swap happens is an inside job.

A hacker will bring a cell phone

provider employee in on a scam and pay them off basically.

And the employee swaps a target's number

to the hacker's phone no questions asked.

- Wow. So how do people protect their accounts?

- You got to set up your account so your recovery information

doesn't go to your phone number. Create a brand new email

with a password you've never used.

So if someone SIM swaps you

and they try to reset your password

that recovery code

won't be texted back to your phone number

which is now in the hands of the SIM swapper.

It's also important not to share personal details

or talk about trades on social media.

That's where they begin tracking you.

Then it's not a matter of if they'll hack you but when.

[music]

- For now it's up to law enforcement

to track down these thieves and put them behind bars.

- Slowly we'll get there I think.

It's always a game of cat and mouse.

As long as people wanna steal money

they'll steal money.

[music]

- There's something intrinsically wrong

with the fact that all the person needs

is your phone number to get access to all

of the personal information about you.

If there's anything I've learned

is that knowledge really is power.

Hackers use it to attack,

but we can use it to defend ourselves.

Being aware of how SIM swapping happens

doesn't make it less scary

but at least I now feel like I have a fighting chance

of protecting myself,

and I hope the same for you.

Peace.

[music]

The Description of The $5 Million Phone Hack