Europol Dismantles SIM Farm Network Behind 49 Million Fake Accounts

Operation SIMCARTEL SIM farm network Europol cybercrime SIM-box scam phishing investment fraud
Edward Zhou
Edward Zhou

CEO & Co-Founder

 
October 21, 2025 2 min read

TL;DR

Europol's Operation SIMCARTEL has dismantled a global SIM farm network that enabled cybercriminals to create over 49 million fake online accounts. This network facilitated phishing, smishing, and investment fraud, impacting thousands of victims worldwide with millions in financial losses. The operation resulted in seven arrests and the seizure of substantial assets, including SIM-box devices, servers, luxury vehicles, and cryptocurrency.

Operation SIMCARTEL Dismantles Massive SIM Farm Network

Europol's Operation SIMCARTEL dismantled a global SIM-box scam network spanning Austria, Estonia, Finland, and Latvia. This operation targeted a cybercrime-as-a-service (CaaS) platform facilitating various crimes, including phishing and investment fraud. The coordinated effort involved 26 searches, resulting in seven arrests.

Operation Simcartel
Image courtesy of Europol

Seizures and Arrests

During the raids conducted on October 10, 2025, law enforcement seized approximately 1,200 SIM-box devices containing 40,000 active SIM cards. Five servers supporting the criminal infrastructure were also dismantled. Additionally, authorities seized four luxury vehicles and froze €431,000 ($502,000) in bank accounts and €266,000 ($310,000) in cryptocurrency accounts belonging to the suspects. Two websites, gogetsms.com and apisim.com, which advertised the illegal service, were taken over and now display seizure banners. Five of the seven arrested suspects are Latvian nationals. Latvian authorities shared footage of a raid showing computer hardware and large quantities of SIM cards.

Criminal Network and Impact

The criminal network facilitated the creation of over 49 million fake online accounts. These accounts were used for various cybercrimes, including phishing, smishing, and financial fraud. The network offered phone numbers registered to individuals from over 80 countries, enabling criminals to obscure their identities and locations. The platform was designed for anonymous communication and payments, impacting at least 3,200 victims across multiple countries. Europol believes that the criminal enterprise offered phone numbers registered to people from more than 80 countries.

Financial Losses and Fraud Cases

The SIM farm has been linked to over 1,700 cyber fraud cases in Austria and 1,500 in Latvia. These cases resulted in financial losses of approximately €4.5 million ($5.25 million) in Austria and €420,000 ($489,000) in Latvia. The criminal network enabled a multitude of serious crimes, including fraud on online second-hand marketplaces, investment fraud, and fake bank websites. Total losses are counted in the millions, with financial loss just in Austria amounting to roughly €4.5 million. In Latvia, it was around €420,000. Europol and Latvian authorities estimated that the “sophisticated” SIM-box service enabled 49 million fake online accounts.

Services Offered and User Complaints

GoGetSMS was marketed as a way to obtain "fast and secure temporary phone numbers." The service offered over 10 million numbers to receive verification codes from over 160 online services. It also offered a way to monetize existing SIM cards by turning them into "powerful assets for generating passive income." Users on Trustpilot complained about issues with obtaining temporary numbers and unresponsive customer support.

Edward Zhou
Edward Zhou

CEO & Co-Founder

 

CEO & Co-Founder of Gopher Security, leading the development of Post-Quantum cybersecurity technologies and solutions.

Related News

WinRAR CVE-2025-6218 Vulnerability Under Active Attack by Threat Groups
WinRAR vulnerability

WinRAR CVE-2025-6218 Vulnerability Under Active Attack by Threat Groups

CISA flags WinRAR CVE-2025-6218 as actively exploited. Learn about this path traversal flaw and how to protect your systems. Update now!

By Jim Gagnard December 11, 2025 3 min read
Read full article
Malicious VSCode Extensions Launch Multi-Stage Attacks and Infostealers
malicious VSCode extensions

Malicious VSCode Extensions Launch Multi-Stage Attacks and Infostealers

Beware of malicious VSCode extensions & device code phishing scams. Learn how these attacks steal credentials, capture screens, and hijack sessions. Protect yourself now!

By Alan V Gutnov December 10, 2025 6 min read
Read full article
PRC State-Sponsored BRICKSTORM Malware Targets Critical Infrastructure
BRICKSTORM malware

PRC State-Sponsored BRICKSTORM Malware Targets Critical Infrastructure

Discover how PRC state actors are using BRICKSTORM malware to gain persistent access via VMware. Learn about its advanced evasion techniques and how to defend your systems. Read now!

By Divyansh Ingle December 9, 2025 3 min read
Read full article
Google Patches 107 Android Vulnerabilities, Including Zero-Days
Android security

Google Patches 107 Android Vulnerabilities, Including Zero-Days

Google's December update fixes 107 Android vulnerabilities, including two zero-days. Ensure your device is protected! Check your security update level now.

By Divyansh Ingle December 8, 2025 3 min read
Read full article