Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsThe Federal Communications Commission announced on July 22, 2024, that TracFone Wireless would pay a $16 million civil penalty to resolve Enforcement Bureau investigations into three breaches that occurred between January 2021 and January 2023. The FCC said attackers exploited application programming interfaces (APIs), accessed customer proprietary and personally identifiable information, and carried out unauthorized port-outs.
The payment is owed to the U.S. Treasury—not directly to customers. A separate private class action addressed some customer claims and used a different settlement process.
What the FCC settlement covers
The FCC resolved its investigations through a Consent Decree with TracFone Wireless, Inc., a Verizon-owned provider whose brands include Straight Talk, Total by Verizon Wireless and Walmart Family Mobile. A Consent Decree resolves an agency investigation; it is not a trial verdict establishing that every allegation was proven.
The FCC materials describe three separate breaches during January 2021 through January 2023. They do not present the period as one December 2021 incident.
#1 Best Overall
- Carrier: This phone is locked to Tracfone, which means this device can only be used on the Tracfone wireless network. Tracfone plan required, activating is easy, just 3 steps.
- DISPLAY: Immersive viewing on a 6.7-inch super-bright 120Hz display with powerful stereo speakers and Bass Boost for cinematic entertainment.
- CAMERA SYSTEM: Advanced 50MP Quad Pixel camera captures sharp, detailed photos and videos in any lighting condition
- PERFORMANCE: Lightning-fast 5G connectivity paired with a powerful processor and RAM Boost for smooth multitasking.
- BATTERY LIFE: Long-lasting 5000mAh battery with TurboPower charging technology delivers hours of power in minutes.
The agency said the incidents involved exploitation of customer-facing APIs and unauthorized access to customer proprietary information, including certain customer proprietary network information (CPNI) and personally identifiable information (PII). The FCC also linked the incidents to numerous unauthorized port-outs. Public materials do not provide a complete victim count, a breach-by-breach inventory of fields, or a full technical incident report.
Announcement: FCC July 22, 2024 release.
Why APIs mattered
An API is an interface that lets software components exchange requests and data. A customer app or website may use an API to authenticate a user, retrieve account details or request a SIM change. If authentication, authorization, rate limiting, input validation or monitoring is inadequate, an internet-facing API can expose data or permit actions without the account holder’s authority.
The public FCC record establishes API exploitation and requires remediation, but does not identify every vulnerability or attack technique used in each breach. The decree requires assessments against the OWASP API Security Top 10 or comparable guidance.
What information was involved
CPNI generally means information about a customer’s telecommunications service and use that a carrier obtains through the carrier-customer relationship. It is a regulated category; it is not a synonym for every type of personal data.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →The FCC described the investigated information broadly as customer proprietary information, certain CPNI, PII and information associated with unauthorized port-outs. The decree’s broader covered-data definition includes combinations such as a name with government-issued identification information, or a username or email address with a password, security answer or other authentication information. That definition describes the information-security program’s scope and does not mean every listed field was exposed in every breach.
Legal provisions cited by the FCC
The adopting order says the investigations concerned possible violations of:
Rank #2
- Enjoy flip-phone for modern times with intuitive dual displays
- Experience pristine call quality with dual mic with noise cancelation
- Talk for up to 14 hours with a long-lasting 1850 mAh battery
- Single line unlimited talk & text plans plus data start at only $20/mo. plus taxes and fees
- To find the no-contract Tracfone plan for you, visit the Tracfone Store Link located below the product title
- Communications Act Section 201(b): practices that are unjust or unreasonable;
- Section 222(a): the carrier’s duty to protect customer proprietary information;
- Section 222(c): use and disclosure of CPNI; and
- 47 C.F.R. § 64.2010(a): reasonable measures to discover and protect against unauthorized access to CPNI.
Read the FCC adopting order and Consent Decree for the operative terms.
What TracFone must do under the Consent Decree
The decree imposes a continuing information-security and compliance program rather than only a payment.
Free tools Windows power users keep installed
One-click scans. No signup required.
| Requirement | What it means |
|---|---|
| Compliance leadership | Designate a compliance officer with relevant information-security knowledge. |
| Security program | Protect information collected, processed, stored or accessed by web applications, including APIs. |
| Program deadline | Revise the information-security program within 210 days after the decree’s effective date. |
| Annual review | Assess the program at least annually and revise it promptly after a covered incident. |
| API risk management | Assess customer-facing APIs for vulnerabilities and maintain remediation and risk-management processes. |
| Training | Provide privacy and security-awareness training to employees and certain third parties; specified employee training was due by February 28, 2025, with annual training thereafter. |
| SIM changes and port-outs | Use stronger authentication, customer notices, employee authentication and post-change confirmations. |
SIM-change and port-out controls
- Authenticate the customer before executing a port-out or SIM-change request.
- Review and update authentication methods at least annually.
- Notify the customer before executing the request and confirm it afterward.
- Require successful employee authentication before execution.
- Make a number-transfer PIN available and require it for porting.
- Give customers accessible information about account-protection measures.
- Train covered employees to identify and remediate unauthorized SIM-change and port-out attempts.
A port-out is more than a service interruption: control of a phone number can enable password resets or interception of SMS-based authentication.
Where does the $16 million go?
The decree identifies the $16 million as a civil penalty payable to the United States Treasury. It required payment within 30 calendar days after the decree’s effective date. The public materials reviewed do not independently document a payment receipt, so the supported statement is that the decree required TracFone to pay it.
Nothing in the FCC Consent Decree creates a customer compensation fund or directs the penalty to affected subscribers.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.The separate TracFone class action
Customer compensation was handled, if at all, through a different case: Barcomb v. TracFone Wireless, Inc., Case No. 1:24-cv-08710-NRB. The authorized settlement website describes claims arising from alleged unauthorized access in or around December 2021, including alleged account hijacking or service interruptions. TracFone denied liability and wrongdoing.
Rank #3
- Carrier: This phone is locked to Tracfone, which means this device can only be used on the Tracfone wireless network. Activating is easy, just 3 steps.
- ACTIVATION Promotion: Includes 1500 min, 1500 texts & 1500 MB Data + add more as you need it
- CAMERA SYSTEM: 50MP Quad Pixel camera. Capture sharper, more vibrant photos day or night with 4x the light sensitivity.
- PERFORMANCE: Blazing-fast Qualcomm performance. Get the speed you need for great entertainment with a Snapdragon 680 processor and 4GB of RAM.
- 64GB built-in storage. Get plenty of room for photos, movies, songs, and apps. Made for US
| Private-settlement benefit | Published terms |
|---|---|
| Ordinary expenses and lost time | Up to $3,250 for qualifying approved claims |
| Extraordinary documented losses | Up to $50,000 for qualifying identity-theft losses |
| Credit monitoring | Three years of one-bureau monitoring with stated identity-theft insurance |
These were private-settlement benefits, not distributions from the FCC penalty. The settlement FAQ and documents page identify a private claim deadline of August 7, 2025.
As of the administrator’s website update cited for August 18, 2026, approved-claim payments were issued on April 9, 2026, and uncashed checks became void after July 8, 2026. Because the website also retains historical “proposed settlement” language and old hearing dates, treat those dates as the administrator’s stated status and verify any individual issue through the authorized site: tracfonesettlement.com, FAQ and documents.
Which brands and customers were covered?
The FCC release names Straight Talk, Total by Verizon Wireless and Walmart Family Mobile among TracFone’s brands. The private settlement site additionally lists current or former customers of Straight Talk, Simple Mobile, Net10 Wireless, Walmart Family Mobile and Total Wireless.
Brand ownership alone does not establish that a person was affected. Eligibility depended on whether the customer’s information was involved in the relevant incident or fell within the private settlement class.
Recommended Free Tools
What customers should do now
- Contact the carrier through an official support channel and ask whether an account lock, port-out lock or SIM-change lock is available.
- Change the carrier-account password and every reused password; use unique credentials stored in a reputable password manager.
- Create or reset the account PIN and number-transfer PIN.
- Review recent account activity and all SIM-change or port-out notices.
- If your number was hijacked, contact banks, email providers and other critical services immediately, then replace SMS authentication with an authenticator app or hardware security key where supported.
- If identity information may have been exposed, consider a credit freeze with each of the three nationwide credit bureaus. A freeze restricts access to a credit file; monitoring mainly provides alerts and is not a substitute for a freeze.
- Use only the settlement administrator’s published website for claim information. Do not pay an unsolicited “claim helper” or trust a look-alike domain.
These are general precautions, not a determination that any particular customer’s account was compromised.
What remains unknown
- The exact number of affected customers.
- The precise fields exposed in each of the three breaches.
- The detailed attack mechanics for each API.
- Independent public evidence of the penalty payment receipt.
- Whether every Consent Decree obligation has been completed and verified in a current compliance filing.
The decree requires specified controls, but compliance obligations cannot guarantee that no future breach will occur.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
