Two former executives plead guilty and reveal the global network of technical support scam

Two ex-executives of the C.A. call tracking and analysis company Cloud Attribution Ltd. they have pleaded guilty to having covered up for years a global scheme of "technical support" scams that let down thousands of victims, many of them old. According to the judicial documents and the announcement of the Department of Justice, former executive director Adam Young and former security director Harrison Gevirtz admitted a post of misprosecution of a serious offence, that is, to have known and hidden a crime, with a maximum sentence of up to three years in prison and fines of up to $250,000; the sentence is scheduled for June 16. See the case documents in DocumentCloud and the report of the justice.gov.

The scheme operated through misleading pop-up windows that alarmed users with messages about alleged viruses and a phone number for "support"; by calling, victims were convinced to pay hundreds of dollars for fictitious services, or allowed remote access where they were deprived of financial information. The prosecution accused the executives of not only not reporting these activities, but of facilitating impunity: they sold them or leased large rotary phone number tools, they instructed their sales force to capture customers knowing they were scammers and even connected criminals to each other to buy and sell calls.

This case is more than an anecdote: it involves a lesson on how seemingly neutral services - such as call routing, recording and analysis - can become fraud facilitators when governance and diligence are weak. The design of the numbering market and the ease of rotating and anonizing numbers make traceability difficult and multiply the damage. Recent figures highlight the magnitude of the problem: the FBI / IC3 report points to losses for technical support scams that exceeded the $2.1 billion in the last year, with tens of thousands of complaints collected; the full report is available in IC3 2025, and the FBI keeps guides to identify these scams in your page about tech support scams.

In addition to economic damage, these frauds have a human cost: fearful victims, loss of confidentiality, bank account theft and lasting psychological consequences. The presence of a call centre operated by the same executives in Tunisia between 2016 and 2022, where attacks took place with committed links and false invoices, shows the international dimension and the operational sophistication behind many schemes.

For technology companies, communication service providers and digital media platforms, the case presents specific compliance and design requirements: more stringent Know Your Customer (KYC) controls by hiring customers and marketing services, proactive traffic monitoring to detect patterns of abuse, limits on the creation and mass rotation of numbers, and more agile collaboration with authorities to facilitate research. The widespread implementation of call authentication protocols such as STIR / SHAKEN and the monitoring of call integrators can reduce the confidence that scammers exploit in the appearance of "legitimate calls."

For users and potential victims, the recommendations are clear: do not call numbers that appear in emerging windows or provide remote access to strangers; always check the official support channels of companies such as Microsoft or Apple by visiting their official websites or accounts verified on social networks; if you have already contacted or paid, contact your bank and file a complaint through the IC3 (FBI) or your country's consumer protection agency. The FBI offers educational resources on how to recognize and report these scams on the page listed above.

The authorities have begun to harshly punish operators and leaders of these networks: in 2024 a head of a technical support network was sentenced to seven years after collecting more than $6 million of at least 6,500 victims. However, pursuing service chain facilitators - platforms that rent numbers, payment processors, call centre operators - is essential to dismantle the ecosystem that allows impunity.

Ultimately, this case should serve as a call for action for regulators, companies and users: the liability does not end in the offer of a neutral technical service where there are clear signs of abuse, and cooperation between the private sector and law enforcement is essential to protect the most vulnerable. For those who manage communications services, the lesson is to invest in preventive controls today to avoid being complicit tomorrow; for the public, the lesson is to be informed, to doubt the urgency and to report any incident to the official channels.