Recommended Free Tools
Verizon-owned TracFone Wireless agreed to pay a $16 million civil penalty to resolve Federal Communications Commission investigations into three data breaches that occurred between January 2021 and January 2023. The FCC announced the settlement on July 22, 2024.
TracFone—not Verizon’s core wireless business—was the named settling company. The incidents involved vulnerabilities in customer-facing application programming interfaces (APIs), exposure of certain customer information, and numerous unauthorized port-outs. The FCC announcement does not create a customer compensation program or say that affected customers will automatically receive money.
As an Amazon Associate I earn from qualifying purchases.
Who is paying the $16 million?
The formal settlement is with TracFone Wireless, which is wholly owned by Verizon Communications. Verizon acquired TracFone in November 2021. TracFone’s associated brands include Straight Talk, Total by Verizon and Walmart Family Mobile, among others.
That makes “Verizon to pay” understandable shorthand, but it is not the most precise description of the enforcement action. The FCC’s announcement identifies TracFone Wireless as the company agreeing to the $16 million civil penalty.
#1 Best Overall
- Carrier: This phone is locked to Tracfone, which means this device can only be used on the Tracfone wireless network. Tracfone plan required, activating is easy, just 3 steps.
- DISPLAY: Immersive viewing on a 6.7-inch super-bright 120Hz display with powerful stereo speakers and Bass Boost for cinematic entertainment.
- CAMERA SYSTEM: Advanced 50MP Quad Pixel camera captures sharp, detailed photos and videos in any lighting condition
- PERFORMANCE: Lightning-fast 5G connectivity paired with a powerful processor and RAM Boost for smooth multitasking.
- BATTERY LIFE: Long-lasting 5000mAh battery with TurboPower charging technology delivers hours of power in minutes.
The matter was resolved through a Consent Decree, not a criminal conviction or a court finding after a trial. The FCC investigated whether TracFone failed to reasonably protect customer information under Section 222 of the Communications Act, which addresses customer proprietary information and customer proprietary network information (CPNI), and Section 201, which addresses unjust and unreasonable practices.
What happened in the TracFone breaches?
The FCC described three separate incidents spanning January 2021 through January 2023. Public reporting provides the following chronology:
- First incident: TracFone discovered the “Cross-Brand” incident in December 2021 and self-reported it to the FCC on January 14, 2022. Investigators determined that attackers had accessed customer data since January 2021.
- Second incident: TracFone reported another incident involving an order website on December 20, 2022.
- Third incident: TracFone reported a further order-website incident on January 13, 2023.
The incidents were linked to vulnerabilities in APIs. An API is a set of rules that lets software systems exchange information. Customer-facing APIs may connect account, order, identity and network systems. If authentication, authorization, input validation, rate limiting or monitoring is inadequate, an attacker may be able to request information or perform actions that should be restricted.
According to the FCC, the first incident involved exploitation of authentication and other API vulnerabilities. In the two order-site incidents, unauthenticated attackers exploited a vulnerability to access order information. The public description does not establish that one vulnerability or one continuous attack caused all three incidents.
What information was exposed?
The FCC said the incidents involved certain:
- Personally identifiable information (PII)
- Customer proprietary network information (CPNI)
- Other customer proprietary information
CPNI generally refers to information connected with a customer’s telecommunications service, such as service usage or account-related network information. The public materials do not establish that every affected customer’s payment-card details, passwords or Social Security number were exposed.
The reviewed sources also do not provide a verified total number of affected customers, exposed records or unauthorized port-outs. Some figures in the public Consent Decree were reported as redacted, so claims that millions of customers were affected should not be treated as established fact.
Rank #2
- Carrier: This phone is locked to Tracfone, which means this device can only be used on the Tracfone wireless network. A Tracfone plan is required to activate this device. Activating is easy, upon receipt go to Tracfone Website and select “Activate” and follow the prompts.
- 📱 Classic Flip Design & Dual Displays: Features a pocket-friendly flip design with a large internal display for easy reading and navigation, plus a convenient external preview screen to check time, incoming caller ID, and notifications at a glance without opening the phone. Sim Card Included - Separate Purchase Not Necessary
- 📶 Reliable 4G LTE Connectivity & VoLTE: Powered by 4G LTE network speeds for crystal-clear HD voice calls, reliable text messaging, and dependable nationwide coverage across America's top networks.
- ⌨️ Tactile Keypad & Loud Speakerphone: Designed with large, easy-to-press buttons for comfortable dialing, intuitive menu navigation, and a powerful speakerphone for hands-free conversations.
- 🔋 All-Day Battery: Stay connected with a long-lasting battery designed for extended talk and standby time. Wi-Fi Note: Wi-Fi is locked until device is activated. Note: Network-locked to TracFone for 365 days from activation.To find the no-contract Tracfone plan for you, visit the Tracfone Store Link located below the product title
Why unauthorized port-outs matter
A port-out occurs when a phone number is transferred from one carrier to another. An unauthorized port-out can remove a customer’s number from their account, interrupt service and give an attacker control of a number used for account recovery.
Free tools Windows power users keep installed
One-click scans. No signup required.
Once in control of a number, an attacker may be able to intercept SMS authentication codes, request password resets or attempt to take over email, banking and other accounts. The FCC said the incidents involved “numerous unauthorized port-outs,” but did not publish an exact number.
A port-out is related to, but different from, a SIM swap. In a SIM swap, an attacker moves service to another SIM or eSIM, generally within the same carrier. In a port-out, the number is transferred to a different carrier.
What did the settlement require?
In addition to the civil penalty, the Consent Decree required TracFone to strengthen its security and customer-protection practices. The requirements included:
- An information-security program: TracFone had to establish a program designed to reduce API vulnerabilities using widely accepted practices associated with the National Institute of Standards and Technology (NIST) and the Open Worldwide Application Security Project (OWASP).
- SIM-change and port-out safeguards: The company had to improve authentication, customer notifications, number-transfer PINs and other controls for SIM changes and number transfers.
- Assessments: TracFone had to conduct annual assessments, including independent third-party assessments, of its information-security program.
- Training: The company had to provide privacy and security awareness training to employees and certain third parties.
A contemporaneous report identified February 28, 2025, as the implementation deadline for the listed measures. That date has passed. However, the sources reviewed for this article do not independently verify whether every obligation was completed or whether the FCC later issued a compliance update. A reported long-term fix for the order-site vulnerability was implemented by February 2023, but that should not be treated as proof that all Consent Decree obligations were complete.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Will affected customers receive part of the $16 million?
There is no consumer payout or claims process identified in the FCC announcement. The $16 million was described as a civil penalty paid in connection with the regulatory settlement. It was not described as restitution, a class-action fund or an automatic refund to affected customers.
Rank #3
- Carrier: This phone is locked to Tracfone, which means this device can only be used on the Tracfone wireless network. Activating is easy, just 3 steps.
- ACTIVATION Promotion: Includes 1500 min, 1500 texts & 1500 MB Data + add more as you need it
- CAMERA SYSTEM: 50MP Quad Pixel camera. Capture sharper, more vibrant photos day or night with 4x the light sensitivity.
- PERFORMANCE: Blazing-fast Qualcomm performance. Get the speed you need for great entertainment with a Snapdragon 680 processor and 4GB of RAM.
- 64GB built-in storage. Get plenty of room for photos, movies, songs, and apps. Made for US
Customers should therefore not assume they can claim a share of the penalty. The public materials reviewed here also do not establish whether separate private lawsuits, state actions or company-specific notification remedies existed.
This case should not be confused with an unrelated 2015 Verizon mobile-cramming settlement. That earlier matter involved allegations that third-party charges were placed on customers’ mobile bills and included consumer-refund provisions. It was not a TracFone data-breach case. See the Virginia attorney general’s announcement and the Massachusetts government announcement for that separate matter.
What should TracFone customers do?
The settlement announcement does not prescribe individual remedies for customers, but these general precautions can reduce the risk of account takeover:
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors- Check account activity. Look for unexpected SIM-change notices, port-out alerts, account changes or service interruptions.
- Contact the carrier through an official channel. If your service suddenly stops or you receive an unexpected number-transfer notification, use the carrier’s official website, app or billing information—not a link in an unsolicited message.
- Change your account PIN. Set or replace the account PIN and ask whether a separate number-transfer PIN is available.
- Ask about port-out controls. Request any available account lock, transfer restriction or additional verification feature.
- Reduce reliance on SMS authentication. For email, banking and other high-value accounts, use an authenticator app or hardware security key where supported.
- Monitor important accounts. Review email, financial accounts and credit reports for password-reset attempts, unauthorized transactions or other signs of misuse.
- Be cautious with urgent messages. Unexpected requests to “verify” an account may be phishing attempts, particularly after a phone-number takeover.
What remains unknown?
The FCC settlement confirms the regulatory action and the broad categories of information involved, but it does not answer every customer-specific question. The reviewed public sources do not establish:
- The exact number of affected customers or exposed records
- The exact number of unauthorized port-outs
- Whether particular TracFone brands or customer groups were affected differently
- Whether all remediation obligations were completed and independently verified after February 28, 2025
It is also important not to overstate what the settlement means. The FCC described unauthorized access to customer information and port-outs; the available materials do not support calling the incidents ransomware, a breach of Verizon’s entire wireless network or a SIM-swap campaign.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
