Tejay Fletcher

Tejay Fletcher never phoned a victim. He built iSpoof — a website that allowed users to make phone calls that appeared to come from any number the user chose. A call placed through iSpoof to a victim could appear on the victim's phone as a call from their own bank's customer service line. Fletcher charged users for the service, accepted payment in Bitcoin, and ran the platform from approximately 2020.

The use case his customers found for it: call a victim while appearing to be their bank, tell them there is a problem with their account, and convince them to disclose security codes, transfer funds, or take other actions they would not take for a stranger but would take for their bank. The attack exploits the trust relationship between a bank and its customer — specifically the trust people have in an incoming call that appears to originate from a known number.

UK losses attributed to iSpoof-enabled fraud: at least £43 million. [SOURCE: Metropolitan Police] Worldwide losses are estimated at approximately £100 million or more — that figure is an estimate and must be labeled as such. Fletcher's own take was a share of the subscription revenue, not the total victim losses.

The platform was taken down in November 2022 in a coordinated operation involving the Met Police, Europol, and international partners. There were 142 arrests across the operation, most of them in the UK, of iSpoof users — people who had used the platform to make fraudulent calls and were separately convicted. Fletcher was arrested and pleaded guilty. He was sentenced to 13 years and 4 months on May 18, 2023. [SOURCE: Metropolitan Police; BBC]

The SIM-swap cases in this series (025 Truglia, 067 Ortiz, 066 Urban) and the iSpoof case share a fundamental mechanism: they exploit the trust that people place in a phone call as a verification method.

SIM swapping attacks the inbound side: convince the carrier to move the target's number to your SIM, then use it to receive authentication codes. Phone spoofing attacks the outbound side: make calls that appear to come from trusted numbers, then use the apparent legitimacy to extract information or actions.

Both work because the phone number has been treated as a proxy for identity — a number is assumed to represent a person or institution. That assumption is wrong, and both attack types prove it. The defense against both is the same: treat the phone number as an identifier, not an authenticator. Verify through a channel the caller cannot control.

The 13-year sentence reflects the scale of the harm enabled by the platform and the deliberate commercial operation of a fraud-enabling service. The users who were separately convicted received shorter individual sentences — their conduct was enabled by the platform but was individually smaller in scale. The operator of the service received the longest sentence because the service was the multiplier.