The shadowy SIM farms behind those incessant scam texts - and how to stay safe

Infrawatch

Follow ZDNET: Add america arsenic a preferred source on Google.

ZDNET's cardinal takeaways

• "SIM workplace as-a-service" setups are utilized for fiscal fraud, spam, phishing, and online merchandise scalping. 
• These hidden telephone factories run successful the shadows to enactment large-scale scamming and phishing.
• SIM-related scams you should cognize about, and however to enactment safe.

Your sister texts you, frantic, requesting a speedy currency injection to get her retired of a sticky situation.

The occupation is, you don't person a sister. 

Cold-call security scams, fake promotional calls from your telecommunications provider, and adjacent panic-inducing phishing calls and texts are portion of our regular lives. They're frustrating, annoying, and sometimes, we autumn for them. But wherever bash these calls travel from? 

Also: 'Job seekers person to beryllium detectives': 3 signs that listing is simply a scam

Racks of mobile phones, SIMs, and cellular modems marque up today's SIM farms, which are often rented to cybercriminals to transportation retired automated attacks worldwide. Just due to the fact that a substance connection appears to person been sent from a section fig doesn't mean it really was, and unfortunately, it is this entree to section telecom infrastructure that galore scammers trust connected contiguous erstwhile trying to dupe you into trusting the fake messages and calls they send.

What is simply a SIM farm?

A SIM workplace is simply a web of hundreds, adjacent thousands, of mobile SIM cards -- backed by hardware specified arsenic modems and handsets -- that run simultaneously to execute a assortment of tasks. 

This mightiness bring to caput cryptocurrency mining farms, wherever precocious volumes of computing hardware and immense amounts of energy are utilized -- sometimes illegally -- to excavation cryptocurrency. SIM farms, too, necessitate dedicated hardware and are acceptable to execute tasks, but alternatively of focusing connected crypto oregon different integer assets, they're often utilized arsenic connection systems. 

SIM farms themselves are not needfully malicious. For example, businesses whitethorn usage them for telecom-related testing, measuring, and scaling; developers whitethorn usage them to behaviour mobile app tests, and they could besides beryllium utilized for morganatic bulk concern messaging. 

Also: Dealing with soundless robocalls? This is wherefore scam callers support quiet

However, they tin -- and often are -- utilized with malicious intent. When fraudsters person a web of SIMs astatine their disposal, they tin execute and automate spam texting and calling, sending a barrage of messages to imaginable victims with small quality oversight. 

SIM farm-backed phishing, spam, and organized fraud connected this standard causes misery and vexation for us, but the communicative doesn't extremity there. The U.S. Secret Service also believes that these operations could disrupt telco work and whitethorn beryllium utilized by transgression groups and cartels to nonstop encrypted messages to 1 another. 

SIM farms exposed: 94 locations, 17 countries

A recent investigation by Infrawatch highlights conscionable however SIM farms work, noting that specified rentable infrastructure "enables large-scale fraud and abusive automation." 

The SIM workplace web astatine the bosom of this probe included 94 carnal locations containing SIM-related hardware crossed 17 countries. Many of the SIM farms were located successful the US, with instances besides recovered successful Europe and South America. 

Also: Lock down your AT&T relationship to forestall SIM swapping attacks - here's how

A shared power sheet connected each workplace to the network, which has been linked to Belarus and to Russian-speaking audiences and promoted crossed Telegram and different online channels. SIM-related services were connected to astatine slightest 24 commercialized proxy providers and 35 cellular providers. Few Know Your Customer (KYC) checks were found, which suggests the web could beryllium accessed by "any buyer," according to the team.

Unfortunately, this is acold from the archetypal clip a SIM workplace has been discovered, and each 1 that spins up represents much problems for our privateness and security.  

Why are SIM farms a problem?

When SIM farms are operated oregon accessed by criminals, they are often utilized for bulk messaging, spam, and phishing. As each SIM acts similar a abstracted device, it tin besides beryllium utilized to make accounts for scalping, to tally malicious proxies, oregon to physique bot networks connected societal media and forums that dispersed misinformation and propaganda. 

Bots are a large issue, but due to the fact that SIM farms besides springiness users entree to a assortment of geographic areas astir the world, this benefits scammers who privation section connections successful their phishing attempts -- specified arsenic US telephone numbers to people US citizens. 

Also: I'm a tech professional, and an AI occupation scam astir fooled maine - here's however I caught on

"SIM farms alteration a scope of illicit and abusive enactment astatine [an] concern standard and are supported by a broader downstream ecosystem of software, infrastructure, and commercialized evasion services," the squad says. 

In September 2025, the US Secret Service dismantled a SIM workplace -- comprising implicit 300 SIM-based servers and packing implicit 100,000 SIM cards -- that was operating adjacent the UN. Law enforcement said this web could person been utilized for acold much than phishing, with the imaginable of cellular blackouts, web postulation floods, and jammed 911 lines making it a important information threat. 

Only a period later, Europol supported Operation SIMCARTEL, which led to the shutdown of a SIM workplace linked to implicit 1,700 cyber fraud cases successful Austria and Latvia. 

The ineligible problem

In galore countries, SIM farms are legal, and they were erstwhile a communal mode to behaviour morganatic investigating and connection tasks. The instrumentality itself isn't illegal, but SIM-farm applications and usage are successful a ineligible grey country and are apt challenging for regulators to grip properly.

However, times are changing. Recognizing however SIM farms often underpin wide scams, phishing campaigns, and bot-based scalping programs, governments are starting to instrumentality action.

Also: How to cheque if a substance connection is spam connected Android - and the escaped instrumentality I trust on

In the UK, for example, the authorities intends to ban the "possession and supply" of SIM farms.

"The barrage of scam texts and telephone calls we person seen from fraudsters causes affectional distress and fiscal misery to millions," said erstwhile UK Security Minister Tom Tugendhat. "The caller discourtesy volition mean criminals are nary longer capable to get SIM farms and akin technologies to perpetrate fraud. This volition springiness constabulary further tools to disrupt the vile criminals that people the UK public."

They won't person immoderate power implicit SIM farms located successful different countries, but it's a start. 

4 ways to enactment protected

1. Trust nothing: SIM farms supply the infrastructure to nonstop precocious volumes of spam and phishing messages globally. Just due to the fact that a telephone fig sending you a connection appears section doesn't mean it's not a scam.
2. Be alert of caller scams: Scam artists alteration their tactics each the time. Gone are the days of scams claiming you've won the lottery. Phishing and fraudulent messages often look to travel from trusted sources, specified arsenic family, friends, colleagues, oregon institutions, including banks and retailers. 
3. Notice patterns: Generic greetings, grammatical errors, and shortened URL links are each often indicators of a fraudulent message. You should ne'er click links successful substance messages; if you aren't definite whether the connection is genuine, usage different method to verify its contents -- specified arsenic making a call.
4. Urgent is seldom urgent: If you person a connection with "urgent" content, specified arsenic a request for payment, a missed delivery, oregon adjacent an SMS supposedly from a household subordinate who needs wealth for aesculapian treatment, retrieve that fraudsters absorption connected creating panic, successful the anticipation that their victims volition marque a rash determination and manus implicit either their information oregon their cash.

Also: I tested NordVPN's escaped scam checker with existent phishing emails - here's however it fared

Another SIM-based menace to beryllium alert of

Fraud, automated spam, and phishing aren't the lone threats that our cellular connections and mobile devices -- nevertheless utile they are -- exposure america to. You should besides cognize astir SIM-swapping. One of ZDNET's ain writers, Matthew Miller, was a victim of this attack, starring to the compromise of his online accounts and the theft of $25,000, which was withdrawn from his slope relationship to acquisition cryptocurrency. 

Also: I've been subscribed to a information removal work a period present - what I privation I knew sooner

SIM swapping occurs erstwhile a bearer hands implicit power of your SIM to a criminal. This happens erstwhile a fraudster impersonates you, typically done a telephone call, and convinces a lawsuit work typical to transportation power of your telephone fig to them. With capable accusation and your fig successful hand, they person a abbreviated model to hijack your accounts by utilizing phone-based 2FA authentication. 

Victims volition archetypal announcement a abrupt nonaccomplishment of service, and immoderate online relationship associated with their fig volition past beryllium astatine risk. 

The cardinal is accelerated action, with a sprinkle of luck and a batch of determination. You request to interaction your bearer and regain your number, and past travel Miller's guide connected what to bash adjacent if you are a unfortunate of this insidious onslaught method.