This is a joint media release from Australian Federal Police, New South Wales Police Force, Western Australia Police Force, Tasmania Police, Victoria Police, Queensland Police Service, and AUSTRAC
Editor's note: Vision and images are available via Hightail
Policing agencies across Australia have joined forces in a National Day of Action (Thursday 18 July, 2024), coordinated by the AFP-led Joint Policing Cybercrime Coordination Centre (JPC3), to disrupt cyber criminals allegedly using SIM boxes to scam hundreds of Australians.
SIM boxes are allegedly used by criminals to commit large-scale SMS phishing attacks known as 'smishing'. Smishing is a malicious attack that uses deceptive text messages to deceive victims into downloading malware or sharing personal information.
Police have arrested five alleged offenders including three people in NSW and two people to proceed by summons in Victoria. The alleged offenders are suspected of using SIM boxes to send fraudulent SMS phishing communications to access and obtain personal information from unsuspecting Australians via their banking or government-affiliated online accounts.
The investigation was initiated by NSW Police Force (NSWPF) in March, 2024, and utilised the JPC3 to coordinate state and territory police in the targeting, disruption and seizure of SIM boxes nationwide.
Members from the AFP, NSWPF, Western Australia Police Force, Tasmania Police, Queensland Police Service, and Victoria Police, worked together to execute six search warrants across a number of suburbs in New South Wales and Victoria yesterday (Thursday 18 July, 2024).
During the searches in Victoria, police located and seized three 16 slot SIM boxes, nine mobile phones, three laptops, stolen identity documents, and in excess of 500 used SIM cards from a Melbourne address.
Police also located SIM box parts, $25,000 in gift cards, two luxury watches, and a gel blaster at a Doncaster premises.
During the searches in New South Wales, Cybercrime Squad detectives seized 26 SIM boxes, thousands of mobile SIM cards, over 500 mobile phones and gift cards, $166,000 in cash and two luxury vehicles valued at $330,000.
The following individuals were arrested and charged as a result of the National Day of Action:
A Sydney man, 23, was arrested in Sydney's CBD and taken to Surry Hills Police Station where he was charged with the Commonwealth offence using equipment connected to network to commit a serious offence, as well as dishonestly obtaining/dealing in personal financial information.
He was refused bail to appear at Downing Centre Local Court today (Friday 19 July, 2024).
A Burwood man, 25, was arrested at Burwood. He was taken to Burwood Police Station of dealing with identity information to commit etc indictable offence, as well as tampering with evidence with intent to mislead judicial tribunal and failing to comply digital evidence access order direction.
He was refused bail to appear at Burwood Local Court today (Friday 19 July, 2024).
A man, 25, was arrested at Wolli Creek and later charged with the Commonwealth offence of using equipment connected to network to commit a serious offence.
He was refused bail to appear at Sutherland Local Court today (Friday 19 July, 2024).
A Melbourne woman, 32, and Doncaster man, 29, were arrested and interviewed in relation to the Commonwealth offences of using a telecommunications network with intention to commit a serious offence and dishonestly obtaining or dealing in personal financial information.
They are expected to be charged on summons.
AFP Detective Superintendent Tim Stainton said SIM boxes were cheap and malicious machines criminals used to defraud hundreds of victims at a time.
"Criminals will send millions of deceptive text messages to Australian mobile users' casting a wide net over the entire community in an attempt to trap and defraud as many victims as possible," Det-Supt Tim Stainton said.
"If not disrupted through police action, the SIM boxes had a combined potential to continue to distribute between four and six million fraudulent messages every day.
"The AFP will not tolerate the exploitation of Australians, especially victims who have had their personal data stolen, and is working tirelessly with our law enforcement partners to eradicate the criminal exploitation of SIM boxes nationwide.
"We encourage people to protect themselves against phishing scams by carefully reviewing emails or text messages before clicking on any links. If you think you are a victim of a phishing scam, please report it to police at via the report button at www.cyber.gov.au.
"There is virtually no legitimate reason to have a SIM box in your home. We encourage anyone, whether you are a landlord conducting an inspection on a rental property or a guest visiting someone's home, if you see a SIM box report it to police.
"If you work in retail and someone comes in buying hundreds of SIM cards or dozens of mobile phones, please report it to your management and to police."
Commander of the New South Wales Police Force Cybercrime Squad, Detective Superintendent Matt Craft, said SMS phishing is one of the most common tactics deployed by scammers to obtain banking and other personal information from a victim.
"The JPC3 fosters a collaborative approach where law enforcement is concerned, and NSW Police have worked closely with national and state agencies in a bid to disrupt and prevent the use of SIM boxes nationwide." Det-Supt Craft said.
"In NSW alone, the operation seized 26 SIM boxes which have sent over 318 million messages over the past several months, scamming victims out of millions of dollars.
"The results and success of today's operation comes from the joint approach co-ordinated out of the JPC3. The power of law enforcement and private industry in joining forces to disrupt crime is considerable.
"People considering engaging in this type of behaviour should think twice, as there is truly a national focus on SIM boxes."
Victoria Police Detective Superintendent Tim McKinney, Cybercrime Division said a single SIM box could hold over 100 SIM cards and is capable of sending hundreds of thousands of simultaneous malicious text messages a day.
"This kind of offending is cowardly. It involves criminals essentially casting their net out far and wide and taking advantage of the trust the community has in legitimate business names. They rely on a handful of unsuspecting recipients clicking the link and inputting their details, and the consequences for those people can be devastating and life changing," Det-Supt McKinney said.
"Alongside our partners, we will continue working to identify anyone in possession of a SIM box to ensure they are held to account.
"If you receive a text from a number purporting to be a legitimate business, treat it with absolute suspicion and don't click on any links. Genuine businesses do not interact with their customers via text messages."
Tasmania Police Acting Assistant Commissioner Doug Oosterloo said Tasmania Police works closely with partner agencies to coordinate operational activities and hold offenders to account.
"While we haven't seen smishing scams emanating from Tasmania yet, we know Tasmanians are not immune from being targeted," he said.
"We urge community members to take preventative steps like having strong, unique passphrases and enabling multi-factor authentication for online accounts."
How to protect yourself from smishing scams:
Cybercrime can affect anyone – individuals, employees of businesses and organisations as a whole need to take proactive steps to protect themselves and others.
Learn how to protect yourself and your business from smishing attacks by visiting www.cyber.gov.au.
- Some relevant resources include:
If you believe you or someone you know is a victim of smishing, you should:
- Contact your bank if you provided personal information or noticed unusual account activity.
- Contact any other services where your personal information could be used to access accounts, such as ATO or Services Australia.
- Change the password for any accounts that may be compromised. Strengthen your online accounts by using strong and unique passphrases that contain four or more random words.
- Report it to police via the report button at www.cyber.gov.au.
- Protect others by also reporting suspected scam messages to www.scamwatch.gov.au.
- If you are concerned that your identity has been compromised, contact the national identity and cyber support service IDCARE at www.idcare.org.
- If you, or someone you know needs help, we encourage you to contact Lifeline on 13 11 14 or Beyond Blue on 1300 224 636, who provide 24/7 support services.
The JPC3 brings together Australian law enforcement and key industry and international partners to fight cybercrime and prevent harm and financial loss to the Australian community.
We are committed to equipping all Australians with the knowledge and resources to protect themselves against cybercrime.
Watch our cybercrime prevention videos and protect yourself and others from being a victim of cybercrime.
If there is an immediate threat to life or risk of harm, call 000.
If you are a victim of cybercrime, report it to police using Report Cyber.