European law enforcement in an operation codenamed ‘SIMCARTEL’ has dismantled an illegal SIM-box service that enabled more than 3,200 fraud cases and caused at least 4.5 million euros in losses.
The cybercriminal online services had about 1,200 SIM-box devices with 40,000 SIM cards to provide phone numbers that were used in telecommunication crimes ranging from phishing and investment fraud to impersonation and extortion.
In an announcement today, Europol says that the cybercrime service operated through two websites, gogetsms.com and apisim.com, which have been seized and now display a law enforcement banner.
Taking down the digital infrastructure was a collaborative effort between Europol and the Shadowserver Foundation.
The fraudulent SIM-box service offered phone numbers registered to individuals in more than 80 countries, and rented them to customers that needed to create and verify fake online accounts, allowing them to hide their true identity and location.
“The criminal network and its infrastructure were technically highly sophisticated and enabled perpetrators around the world to use this SIM-box service to conduct a wide range of telecommunications-related cybercrimes, as well as other crimes,” Europol says.
SIM box farm on the raided location
Source: Europol
According to the European agency, the illegal service helped create more than 49 million fraudulent online accounts. Authorities so far have linked to some of them to 1,700 fraud cases in Austria and 1,500 Latvia.
Among the crimes facilitated by this service are fraud, extortion, migrant smuggling, online marketplace scams, “daughter-son” money transfer requests on WhatsApp, investment fraud through fake brokers, fake shops and bank sites, and impersonation of police officers.
The financial damage caused by these activities is estimated to approximately EUR 4.5 million ($5.3 million) in Austria and EUR 420,000 ($490,000) in Latvia.
During the SIMCARTEL operation, which occurred on October 10, the police arrested five Latvian nationals, and two other suspects, and seized the following items in the raids:
- 1,200 SIM-box devices operating 40,000 SIM cards
- Hundreds of thousands of SIM cards
- Five servers and two websites
- EUR 431,000 ($500,000) frozen in bank accounts and $333,000 in crypto accounts
- 4 luxury vehicles
The authorities have also published the video below from a search at one location in Latvia.
With the servers seized, a forensic analysis may help investigators identify customers of the illegal services.
Operation SIMCARTEL involved officers of multiple law enforcement units and authorities in Austria, Estonia, Finland, and Latvia, where the 26 searches were conducted.
46% of environments had passwords cracked, nearly doubling from 25% last year.
Get the Picus Blue Report 2025 now for a comprehensive look at more findings on prevention, detection, and data exfiltration trends.
Get the Blue Report 2025
