Trump Mobile Skipped FCC Filings, Got Hacked, and Apparently Has No Security Team
A US Senator is demanding answers from Trump Mobile after it emerged that the company may have been operating its international calling service without the necessary federal authorisation, while simultaneously failing to properly register with robocall prevention databases, and losing customer data to hackers.
Senator Maggie Hassan (D-N.H.) sent a letter to Trump Mobile CEO Patrick O'Brien laying out what she describes as a string of regulatory failures. According to Hassan, Trump Mobile appears to lack the Section 214 authorisation required under the Communications Act of 1934 to offer international calling services, despite advertising calls to more than 230 countries and territories. For a company built largely on brand cachet, that's a fairly embarrassing oversight.
The Section 214 process exists partly to force disclosure of foreign ownership so the FCC can assess national security risks. That applies to both full carriers and Mobile Virtual Network Operators like Trump Mobile, which resells someone else's network rather than running its own. Hassan referenced the 2021 revocation of China Telecom Americas' authorisation as a benchmark for why this matters, with the FCC warning at the time that a foreign-controlled carrier could be used to intercept, reroute, or disrupt US communications.
Which brings us to Liberty Mobile Wireless, a Florida-based MVNO that Trump Mobile officials previously described to The Verge as the 'enabler' and 'backbone' of the operation, handling much of its technical, legal, and financial work. Hassan is now asking pointed questions about the exact nature of that relationship, including whether Trump Mobile effectively owns or controls Liberty Mobile. If both companies are run by the same people, the corporate separation starts to look more like a filing workaround than a genuine distinction.
Liberty Mobile did make a Robocall Mitigation Database filing, but Hassan says it was incomplete. Specifically, neither Trump Mobile nor Liberty Mobile appear to have included Know-Your-Customer process descriptions, which are required as part of annual RMD submissions. A search under Trump Mobile's name and its registered trading name T1 Mobile LLC returned nothing at all. Non-compliance with RMD rules can result in fines and, in more serious cases, other carriers being ordered to block the offending company's traffic entirely.
FCC Chairman Brendan Carr has actually proposed tougher KYC rules himself, though whether he'd apply them here is another question. Carr is a vocal Trump supporter who has backed Trump's attempts to exert control over historically independent regulators, and he recently declined to act on complaints that Trump TV commercials violate laws against using public funds for propaganda. Draw your own conclusions about the likelihood of enforcement.
Then there's the breach. A ransomware group reportedly stole personal data belonging to 3,615 Trump Mobile customers. When the attackers apparently notified the company, the response they claim to have received was: 'we have no team to handle this.' Trump Mobile had already acknowledged separately that a vendor had exposed customer data publicly online. Hassan's letter flags that the company also seems to lack robust identity verification at the point of activation, which she notes makes it easier for fraudsters to obtain US phone numbers.
As a bonus, the phone itself, once hyped as an all-American device and originally priced at $499, eventually shipped nearly a year late at $749 and appears to be a near-identical match for the HTC U24 Pro, a handset manufactured in China.
Hassan has requested a full response by 29 October, covering the data breach, Trump Mobile's ownership structure, its carrier relationships, subscriber verification practices, FCC filing history, and which countries supply components for the hardware. Trump Mobile, Liberty Mobile, and the FCC had not responded to press enquiries at the time of writing.