Summary

• VodafoneThree shared suspected SIM farm intelligence with the National Crime Agency and City of London Police, contributing to investigations that resulted in eight arrests.
• Authorities seized cash and equipment and recovered more than one million compromised payment card details associated with phishing.
• New offences covering SIM farm possession and supply took effect on 29 October 2026, with statutory defences for legitimate activities.

Telecommunications operator VodafoneThree has helped UK law enforcement identify and disrupt suspected criminal SIM farm operations, contributing to investigations that resulted in eight arrests and the recovery of more than one million compromised payment card details.

The company disclosed the results on 3 November following a proof of concept developed with the National Crime Agency and City of London Police. The collaboration uses intelligence from mobile network activity to identify equipment suspected of supporting large-scale fraud.

Investigators have seized cash and telecommunications equipment alongside the recovered financial information. The Dedicated Card and Payment Crime Unit, a specialist police operation funded by the banking industry, used intelligence shared through the collaboration to investigate individuals suspected of using SIM farms to target members of the public.

The development follows the introduction of new UK offences covering SIM farm equipment, which came into effect on 29 October. The legislation gives investigators an additional route to intervene against equipment associated with fraudulent communications while preserving legal defences for authorised activities.

SIM farms allow large volumes of communications

A SIM farm uses equipment capable of operating multiple mobile subscriber identity modules, enabling large numbers of calls or text messages to be managed through cellular networks.

The systems can contain hundreds or thousands of SIM cards, allowing communications to be generated at volumes far beyond the activity associated with an ordinary mobile handset.

Criminal groups can use this capability to distribute phishing messages that impersonate banks, delivery companies, telecommunications operators, or other organisations. Recipients may be directed towards fraudulent websites or encouraged to provide personal and financial information.

Other applications involve creating large numbers of online accounts or using different mobile identities to support fraudulent activities. Where accounts or communications are linked to separate numbers, detecting that they originate from one coordinated operation can require examination of underlying network behaviour.

The scale of distribution can make these systems attractive to criminals. Sending messages to many recipients creates more opportunities for deception, even when only a relatively small proportion respond.

SIM farm equipment also has legitimate applications, including some telecommunications, broadcasting, transport, and logistics services. Its technical ability to operate multiple SIM cards does not independently establish that a particular user is involved in fraud.

The distinction between legitimate and criminal use is therefore important both when identifying suspicious network activity and when applying the new offences.

Network intelligence supports investigations

VodafoneThree developed an intelligence-sharing approach with law enforcement to help identify suspected SIM farm activity occurring through its networks.

After detecting relevant activity, the company shared information with the National Crime Agency and City of London Police’s Fraud Targeting Cell, allowing specialist investigators to assess the evidence and pursue suspected operators.

The approach extends beyond preventing an individual suspicious message from reaching its intended recipient. Where evidence identifies equipment or people supporting a wider operation, investigators can examine the infrastructure used to generate fraudulent communications.

The Dedicated Card and Payment Crime Unit subsequently investigated suspected activity using the information provided. That work contributed to arrests and the recovery of compromised payment card details, along with physical equipment and cash.

VodafoneThree has not disclosed the precise network detection methods used in the proof of concept. Details of the technical signals involved may be sensitive while related investigations continue.

Telecommunications operators can identify patterns across their networks, but investigators must still establish whether the activity is criminal and whether evidence supports enforcement against particular individuals.

The division of responsibilities is important because network intelligence may identify behaviour requiring examination without proving the intent or actions of every person associated with the equipment.

Evidence gathered subsequently can help connect devices, communications, accounts, and financial information to alleged offences.

More than one million card details recovered

The investigation recovered more than one million compromised payment card details that authorities believe had been obtained through phishing.

The National Crime Agency described the recovery as potentially one of the largest collections of compromised card information obtained through an operation of this kind.

That description concerns the volume of recovered information rather than the number of confirmed fraud victims. An individual record does not establish that a successful unauthorised transaction occurred, and the released figures do not provide a verified total of financial losses resulting from the suspected SIM farm activity.

Some recovered information may be connected to attempted fraud, while other records could already have been used or circulated between criminal groups. Investigators and financial institutions must determine the status of affected accounts before establishing what protective action is required.

Recovering payment card information can support the identification of accounts requiring further review, potentially allowing financial institutions to prevent additional misuse.

The operation also demonstrates how information obtained through digital communications can be used in financial crime beyond the original phishing message.

Details gathered from victims may enable unauthorised payments or be combined with other personal information to support further impersonation. Preventing the distribution of fraudulent messages and identifying the systems behind them are consequently related parts of the same investigative effort.

VodafoneThree reported eight arrests connected with the collaborative investigations but did not provide the date and location of every arrest. The announcement describes results achieved to date rather than an operation in which every enforcement action necessarily occurred on 3 November.

The individuals arrested remain suspects unless and until their responsibility is established through the appropriate legal process.

New legislation targets possession and supply

Sections 151 to 153 of the Crime and Policing Act 2026 came into force on 29 October under the relevant commencement regulations.

The provisions establish offences relating to possession and supply of qualifying SIM farm equipment, with statutory defences covering good reason or lawful authority.

The legislation recognises legitimate applications involving activities such as broadcasting, public transport, telecommunications networks, and freight tracking. These examples are not exhaustive, and their relevance depends on the circumstances in which equipment is held or used.

Suppliers seeking to rely on the statutory defence must also satisfy specific requirements, including checks concerning the intended recipient and records of qualifying transactions.

Those records include information about the equipment, recipient, date of supply, and steps taken to establish the intended use. The obligations provide a means of examining the commercial movement of equipment that can otherwise support high-volume fraudulent communications.

The new offences carry financial penalties on conviction. They operate alongside existing fraud and other criminal laws rather than replacing the need to investigate the underlying activity supported by the equipment.

VodafoneThree’s collaboration illustrates how technical intelligence and investigative powers can be used together. Network activity can help identify equipment requiring attention, while law enforcement determines whether further searches, seizures, or proceedings are justified.

Fraud disruption extends beyond message blocking

Telecommunications companies have long used measures intended to identify suspicious messages and protect customers from known fraudulent numbers or destinations.

However, criminal groups may replace individual numbers and websites when they are blocked. Investigating the infrastructure that generates communications offers another means of disrupting operations that can otherwise continue through new accounts or devices.

The wider financial consequences of fraud affect consumers, financial institutions, telecommunications providers, and businesses. VodafoneThree cited a Home Office estimate placing the economic and social cost of fraud during 2024 at £14.4 billion, a national figure covering fraud more broadly rather than losses associated specifically with SIM farms.

The operator intends to continue working with policing and government partners to identify criminal infrastructure. Its reported results establish that information-sharing has supported arrests and significant evidence recovery, although further work will determine the outcomes of the individual investigations.

Measuring the longer-term effectiveness of the approach will involve more than counting suspicious devices identified. The relevant outcomes include whether investigations prevent further fraudulent communications, whether recovered information protects potential victims, and whether criminal operators can restore their services through alternative infrastructure.

The collaboration has already produced substantial enforcement results. Its wider application will test how effectively telecommunications intelligence can be converted into repeatable action against the systems enabling organised fraud.