50 million accounts, 5 million euros in damages: a large IT infrastructure for online fraud has been dismantled in Latvia 0 4334

The platform was intended for anonymous communication and payment processing, offering over 80 mobile numbers from various countries. According to current estimates, around 50 million online accounts were created during the operation of this infrastructure, from which fraudulent activities were carried out in various countries. At least 3,200 people became victims of these crimes, with total material damages estimated at nearly 5 million euros.

Currently, investigations into this case are being conducted in Latvia, Estonia, and Austria. Another person has been detained in Latvia, who was previously wanted by the Estonian police on suspicion of committing other serious crimes.

Operation with EUROPOL's Participation

To combat online fraud, employees of the 1st Division of the Cybercrime Prevention Department of the State Police conducted a carefully planned international operation "SIMcartel" with the participation of EUROPOL, EUROJUST, Austria, and Estonia on October 10. During the operation, the SIMbox infrastructure located in Latvia was dismantled, which provided the ability to create anonymous online accounts for communication and payment processing that were subsequently used for internet fraud.

The SIMbox platform allowed the use of over 80 mobile phone numbers from various countries, enabling anonymous registration in more than 160 online services. According to investigators, around 50 million online accounts suitable for fraudulent activities were created using this platform.

It has been established that the victims of fraud related to this platform were residents of Latvia, Estonia, and Austria. Separate investigations are being conducted in each country. In Latvia, at least 1,500 people became victims, suffering a total loss of about 420,000 euros. In Austria, at least 1,700 people were affected, with damages of about 4.5 million euros.

All Detainees Are Citizens of Latvia

On October 10, employees of the 1st Division of the Cybercrime Prevention Department, with the support of the anti-terrorism unit OMEGA, dismantled the SIMbox criminal infrastructure and detained four individuals during investigative actions: the alleged organizer of the illegal service and three technical workers. All detainees are citizens of Latvia: two women born in 1987 and 1970, and two men born in 1977 and 1982.

In total, last week law enforcement conducted 14 searches at various addresses. They seized 1,200 SIMbox devices, which simultaneously used 40,000 SIM cards from different countries, as well as five servers that fully controlled the company's IT infrastructure. Two company domains — gogetsms.com and apisim.com — were also seized, which now host a special page with information about the transfer of the sites to law enforcement authorities. Additionally, four exclusive vehicles were confiscated, bank accounts with a total of 431,000 euros were frozen, and cryptocurrency worth 266,000 euros was seized.

What They Are Accused Of

The criminal proceedings, currently under the jurisdiction of the Cybercrime Prevention Department, are classified under the following articles of the Criminal Code:

• Article 193.1, part one — for obtaining, transferring, or distributing data that allows for the illegal use of financial instruments or means of payment;
• Article 195, part three — for the legalization of criminally obtained monetary funds or other property, if this was committed on a large scale or by an organized group;
• Article 244.1 — for altering data necessary for identifying end-user equipment in electronic networks, as well as for obtaining, storing, or distributing such data, software, or equipment without the consent of the manufacturer or its authorized representative, if the actions were committed for selfish purposes, by a group of individuals in collusion, or caused significant damage.

Three of the individuals detained on October 10 were assigned preventive measures not related to deprivation of liberty. The court chose a preventive measure in the form of arrest for the man born in 1982. As part of the ongoing investigation, on October 15, the police detained another man born in 1982, who was also assigned a preventive measure not related to detention.

Simultaneously with the aforementioned actions, within the framework of a joint investigative group in Latvia, supported by the Criminal Police Department of the Riga Regional Administration, another 12 searches were conducted. During these operations, with the participation of the special unit OMEGA, another individual was detained — a man born in 1988, who had previously been declared wanted by Estonia on suspicion of extortion and organizing arsons. Upon his arrest, cash amounting to 48,700 euros, suspected narcotics, and a large quantity of what are likely stolen car parts: 275 front headlights and 228 side mirrors were seized.

The State Police reminds that no individual is considered guilty until their guilt in committing a crime is proven in accordance with the law.

In the "SIMcartel" operation, the State Police was supported by the Riga District Prosecutor's Office, EUROPOL, EUROJUST, the police of Austria, the police of Estonia, CERT.LV, and the Shadowserver Foundation.