As part of the international operation “SIMcartel”, the State Police dismantled SIMbox infrastructure located in Latvia and detained five individuals who, under the guise of legitimate business activity, enabled the creation of anonymous online accounts used for fraudulent purposes. The platform was designed to facilitate anonymous communication and payments, offering access to mobile phone numbers from more than 80 countries. Current estimates indicate that during the infrastructure’s operation, approximately 50 million online accounts were created, which were used in various types of online fraud schemes affecting at least 3,200 victims worldwide, with a total estimated financial loss of nearly 5 million euros.
Published: 17.10.2025.
As part of the international operation “SIMcartel”, the State Police dismantled SIMbox infrastructure located in Latvia and detained five individuals who, under the guise of legitimate business activity, enabled the creation of anonymous online accounts used for fraudulent purposes. The platform was designed to facilitate anonymous communication and payments, offering access to mobile phone numbers from more than 80 countries. Current estimates indicate that during the infrastructure’s operation, approximately 50 million online accounts were created, which were used in various types of online fraud schemes affecting at least 3,200 victims worldwide, with a total estimated financial loss of nearly 5 million euros.
Ongoing investigations are currently taking place in Latvia, Estonia, and Austria regarding fraud and other crimes arising from the operation of this platform. In connection with these offences, another individual has been arrested in Latvia — a person previously wanted internationally by Estonian police on suspicion of other serious crimes.
To combat online fraud, officers of the First Division of the Cybercrime Combating Department of the State Police carried out a carefully planned international cooperation operation “SIMcartel” on 10 October this year. Within a joint investigation team (JIT) involving Europol, Eurojust, Austria, and Estonia, the police dismantled the SIMbox infrastructure located in Latvia that, under the cover of legitimate business, provided services for creating anonymous online accounts used for communication and payments linked to fraudulent activities.
The SIMbox platform allowed the use of mobile numbers from more than 80 different countries, technically enabling anonymous registration across more than 160 online services. Estimates obtained during the investigation suggest that the service facilitated the creation of around 50 million online accounts, which could be used for online fraud.
It has been established that victims of this platform include residents of Latvia, Estonia, and Austria, with separate investigations taking place in each country. Current information indicates that in Latvia, at least 1,500 individuals suffered losses of around €420,000, while in Austria, around 1,700 victims incurred losses of at least €4.5 million.
On 10 October, officers of the First Division of the Cybercrime Combating Department, in cooperation with the State Police Counter-Terrorism Unit OMEGA, dismantled the criminal SIMbox infrastructure and detained four individuals during procedural activities. One of them is believed to be the organizer of the illegal service, while the others are technical specialists. All detainees are Latvian nationals — women born in 1987 and 1970, and men born in 1977 and 1982. In total, law enforcement conducted 14 searches at various addresses, seizing 1,200 SIMbox devices containing 40,000 SIM cards from different countries, as well as five servers, thereby taking full control of the company’s IT infrastructure. This included two company websites — gogetsms.com and apisim.com — which were replaced with a “splash page” notifying users that the sites are under law enforcement control.
During the same operations, police seized four luxury vehicles, €431,000 from bank accounts, and €266,000 in cryptocurrency.
The criminal proceedings handled by the First Division of the Cybercrime Combating Department have been initiated under the following articles of the Criminal Law:
- Section 193¹, Paragraph One – for obtaining, transferring, or distributing data that enables illegal use of a financial instrument or payment tool;
- Section 195, Paragraph Three – for large-scale money laundering or money laundering committed by an organized group;
- Section 244¹ – for altering data required for identifying end-user equipment in electronic communication networks, or for obtaining, storing, or distributing such data, software, or equipment for profit or as part of a group agreement, or when such actions cause substantial harm.
Three of the detained individuals were subjected to non-custodial security measures, while the 1982-born male suspect was remanded in custody. Continuing the investigation, on 15 October, the State Police detained another suspect — a 1982-born male, who was also subjected to a non-custodial security measure.
At the same time, within the framework of the joint investigation team and with the support of the Criminal Police Department of the Riga Regional Board, an additional 12 searches were conducted in Latvia. During these, in cooperation with the OMEGA Counter-Terrorism Unit, police arrested a 1988-born male who had been internationally wanted by Estonian authorities for extortion and organizing arson. At the time of his arrest, police seized €48,700 in cash, possible narcotic substances, and a large number of suspected stolen car parts — 275 headlights and 228 side mirrors.
The State Police reminds that no person shall be considered guilty until their guilt in committing a criminal offence has been proven according to the law. The “SIMcartel” operation was supported by the Riga Regional Prosecutor’s Office, Europol, Eurojust, Austrian police, Estonian police, CERT.LV, and the Shadowserver Foundation.