A Florida man has been sentenced to 10 years in federal prison for his involvement in sophisticated SIM-swapping attacks as a member of the cybercrime group Scattered Spider, marking a significant development in the ongoing battle against mobile identity theft. Noah Michael Urban, 20, from Palm Coast, must also pay approximately $13 million in restitution to victims and serve three years of supervised release following his prison term.
Urban entered a guilty plea in April 2025 to charges of wire fraud, conspiracy to commit wire fraud, and aggravated identity theft. Court documents show he conspired with others to steal at least $800,000 from five victims through SIM-swapping attacks, which involved redirecting victims’ mobile phone communications to devices controlled by the perpetrators to facilitate cryptocurrency theft. Such attacks have become increasingly prevalent, with the FBI reporting that victims lost over $48 million to such schemes in 2023 alone.
The criminal activities occurred between August 2022 and March 2023 for the SIM-swapping operations, while broader social engineering attacks targeting corporate employees across the United States took place from September 2021 to April 2023. The group used sophisticated phishing techniques to obtain employee credentials and one-time passcodes, enabling unauthorized access to corporate networks. Their methods matched the typical approach of Scattered Spider, which specifically targets IT support teams to bypass multi-factor authentication systems.
Operating under multiple online aliases including Sosa, Elijah, King Bob, Gustavo Fring, and Anthony Ramirez, Urban was active on “The Com,” a cybercrime forum. His activities reportedly included stealing unreleased music tracks through SIM-swapping and distributing them through underground channels. The case highlights the growing sophistication of mobile identity theft schemes and their impact on both individual and corporate victims.
The sentencing represents the first prison term for a member of Scattered Spider, also known as Oktapus, Scatter Swine, and UNC3944. The group has conducted social engineering attacks against numerous high-profile organizations including Twilio, Coinbase, DoorDash, Caesars, MailChimp, Riot Games, and Reddit. Their attacks have prompted several major telecommunications providers, including AT&T, to implement enhanced security measures specifically designed to prevent SIM-swapping incidents.
The federal judge imposed a 10-year sentence, exceeding the prosecutors’ recommendation of 8 years. Urban was arrested in January 2024 and faced charges in both Florida and California jurisdictions, with the restitution amount covering victims from both cases. The severity of the sentence reflects the growing concern among law enforcement agencies about the rising threat of mobile identity theft and cryptocurrency-related crimes.
Sources: Krebs on Security, The Hacker News, Infosecurity Magazine, Bleeping Computer
