Ten people have been arrested and more than 100 charges were laid in connection with a wide-reaching SIM swap scam, Toronto police said Thursday.
Investigators said more than 1,500 cellular accounts throughout Canada were compromised, resulting in more than $1 million in combined losses to victims that included telecom companies, financial institutions and individuals.
Det. David Coffey from the Toronto police Financial Crimes Unit said the SIM swap scam targets a weakness in two-factor authentication to take over a victim’s cellphone account.
Criminals either impersonate the customer at a cellphone store or otherwise trick a mobile carrier into switching the victim’s phone number to another SIM card, Coffey said. Once they gain access to an account, they can receive emails and texts about password recovery or changes and use that to compromise the victim’s bank accounts or social media profiles.
“It was alleged that perpetrators had taken over the cellphone accounts of multiple unsuspecting victims and made changes to the accounts, allowing them to access and compromise many of the victims’ online accounts,” he told reporters.
Get daily news
Coffey said in some cases, the suspects have also used phishing techniques such as false web links and websites.
Police seized more than 400 pieces of fake identification after search warrants were executed as part of the investigation dubbed “Project Disrupt,” which began in June 2023, he said.
The investigation was launched in collaboration with the police force’s Coordinated Cyber Centre Unit. Coffey said that co-ordination is necessary as fraud is becoming “heavily reliant on the internet.”
Det. Const. Michael Gow from the cyber centre said SIM swap often isn’t reported to police when it occurs because the victims don’t realize it until it is too late.
“From the victim’s perspective all they see is the ‘SOS’ on the top right hand corner of their phone, so what that means is that there is a SIM card in their phone and it is not transmitting any signal,” he said.
“They don’t know because it is a minor temporary outage. Everything gets switched back to their phone but they have lost funds from their bank account, they have lost cryptocurrency from their crypto accounts, they lost access to their social media accounts and they don’t know why.”
The 10 people who were arrested face various charges, including fraud, intercepting private communications and possession of property obtained by crime.
Police say two additional suspects are on the run, and ask anyone with information that might lead to their arrests to come forward.