'SIM swap' theft victim can't sue phone company, B.C. court rules

A Surrey man says more than $60,000 worth of bitcoin was stolen from him in a sneaky "SIM swap" scam, but a recent B.C. Supreme Court ruling has reluctantly hung up on his lawsuit against the phone company he says is to blame.

The case is one example of a troubling type of scheme police have warned is growing across Canada, prompting calls in recent years for telecommunications companies to increase customer protections.

Sepehr Tahmasebpour claimed Freedom Mobile gave a new SIM card with his phone number to an unknown scammer impersonating his father — who pays for the account — in early January 2021, who then used it to access Tahmasebpour's email, lock him out of his accounts and drain his bitcoin.

"This was caused by the grossly negligent actions and inactions of Freedom," including failing to have proper safeguards over clients' personal information, according to the January 2023 notice of civil claim.

Tahmasebpour and his father had argued Freedom Mobile, owned by Shaw at the time of the alleged fraud, should pay them more than $63,000 for the current market value of the stolen bitcoin and legal costs, as well as aggravated and punitive damages due to prior police warnings and news coverage by CBC and other outlets about the risk of such scams.

"Despite Freedom being armed with this knowledge, it failed to take reasonable and necessary steps to prevent a similar type of attack from occurring," read the claim.

Internal arbitration process

For its part, Freedom applied to stay the case in September, arguing that before bringing legal action, Tahmasebpour and his father Alireza first needed to try to resolve the matter through an internal arbitration process outlined in its terms of service. Both the father and the son claimed they had never seen, been made aware of or agreed to the document.

But last week, a B.C. Supreme Court judge reluctantly ruled in Freedom's favour, staying the negligence claims in relation to the scam but denying Freedom's application for the plaintiffs to cover its legal costs.

"While the evidence is weak, there is at least an arguable case that the terms of service, including the arbitration clause, apply to Alireza and Sepehr," wrote justice F. Matthew Kirchner in his May 1 decision, noting he had not decided "either way" whether the arbitration does indeed apply.

"Nevertheless, the evidence that I do have on this application does not persuade me that Freedom Mobile specifically drew either plaintiff's attention to the arbitration clause at any time."

In his decision, Kirchner also ruled a smaller part of the Tahmasebpours' claim — for $150 they paid to a collections agency for Freedom charges after their cell service was cut off — could continue.

When contacted by CBC News, Freedom Mobile said in a statement it cannot comment on individual cases and would not comment further on the Tahmasebpours' lawsuit.

"Ensuring the security of our customers' personal information is and will always be a priority for Freedom Mobile," the company said Tuesday. Its privacy policy posted to its website says Freedom limits the collection, use and disclosure of such information.

SIM swaps worse than losing credit card: expert

In SIM swap scams, also known as number porting, fraudsters impersonate a victim to steal their phone number and then have it transferred to a new service provider.

This cuts off the victim's cell service and enables the scammer to send and receive texts and calls to the victim's number, reset passwords via two-factor authentication, and lock victims out of financial and other accounts.

"A lot of damage could be done; it's probably much more severe than just losing your credit card," Toronto-based telecommunications consultant Neeraj Kumar previously told CBC News.

Tahmasebpour was skiing with a friend on Mount Seymour on Jan. 4, 2021, when he says he received two texts from Freedom Mobile saying the account's email and access PIN had been changed, according to an affidavit obtained by CBC News.

His phone then lost service, as did his mother and his sister's phones under the same Freedom plan. Tahmasebpour reported the issue to police, and to Freedom Mobile customer service both in person and using his brother's phone.

The next day, "someone withdrew the entire balance of my bitcoin, after resetting my password to my email address, and then my password to my Shakepay [cryptocurrency] account," Tahmasebpour wrote in his Jan. 18, 2024, affidavit.

The scam's impact was also exacerbated by "reprehensible" actions by Freedom afterwards, the Tahmasebpours argued.

Freedom continued to bill Alireza for the plan after the scam cut off their service and access to that account, according to the decision, eventually sending the $150 bill to collections. 

Alireza paid the sum only after Freedom cut off his own phone line, which was on a separate Freedom account that he had continued to pay for, according to the decision. The Tahmasebpours said this amounted to "exerting undue pressure" and lowered Alireza's credit limit from close to $30,000 to just $1,000, the claim said.

"As a result of the above, both plaintiffs have suffered mental anguish and harm including stress, anxiety and inconvenience," said the lawsuit, noting they are also at ongoing risk of financial fraud in the future because of the breach.

The Tahmasebpours' claim for the $150 to be returned has not yet been heard or decided. CBC News reached out to the plaintiffs via their lawyer but did not hear back by publication.