European police have arrested members of two separate SIM swapping gangs who targeted victims in Spain and Austria respectively.
In Operation Quinientos Dusim, Spanish police officers arrested 12 individuals belonging to a gang that stole over EUR3mn (USD3.3mn). The gang is responsible for over 100 separate attacks, in which they took between EUR6,000 (USD6,700) and EUR137,000 (USD153,000) from the bank accounts of victims. Their approach first involved using malware to steal passwords and usernames for online bank accounts. Then the fraudsters supplied fake documents to telcos in order to obtain replacement SIM cards that would then receive the one-time passwords (OTP) for payments to their mules. The execution of these thefts was slick, with transfers completed within two hours of a SIM being swapped.
Operation Smart Cash was a collaboration between the Romanian National Police (Poliția Română) and Austria’s Federal Criminal Police Office (Bundeskriminalamt) that identified 14 Romanians who stole over EUR500,000 (USD560,000) from Austrian bank accounts. The Romanian gang would take control of the victim’s phone number, then use stolen banking credentials to access a mobile banking application so they could execute withdrawals at ATMs without needing to present a card. Each transfer was validated by a password sent by SMS to the compromised phone number.
